@llm-dev-ops/agentics-cli 1.4.26 → 1.4.29

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/policy-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-evaluator.d.ts","sourceRoot":"","sources":["../../../src/agents/data-access-control/policy-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,QAAQ,EACR,aAAa,EACb,YAAY,EAGZ,cAAc,EACf,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,sCAAsC;IACtC,YAAY,EAAE,qBAAqB,EAAE,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,yBAAyB;IACzB,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC;IACrF,yCAAyC;IACzC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAClC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0BAA0B;IAC1B,kBAAkB,EAAE,cAAc,EAAE,CAAC;IACrC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,2BAA2B;IAC3B,mBAAmB,EAAE,KAAK,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;IACH,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,4BAA4B;IAC5B,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;IAC5C,0BAA0B;IAC1B,UAAU,EAAE,KAAK,CAAC;QAChB,SAAS,EAAE,mBAAmB,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC,CAAC;IACH,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,8BAA8B;IAC9B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,oCAAoC;IACpC,UAAU,EAAE,0BAA0B,CAAC;IACvC,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB;IACtB,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,CAAC;CACzE;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,6BAA6B;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,6BAA6B;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,4CAA4C;IAC5C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,qBAQ5B,CAAC;AAEF;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAyB;IAE/D;;;;;;OAMG;gBAED,QAAQ,EAAE,YAAY,EAAE,EACxB,qBAAqB,GAAE,oBAAoB,EAAO,EAClD,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM;IAO7C;;;;;;;;OAQG;IACH,QAAQ,CACN,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,cAAc,EAC1B,OAAO,EAAE,aAAa,GACrB,uBAAuB;IAoB1B;;OAEG;IACH,OAAO,CAAC,YAAY;IA2EpB;;OAEG;IACH,OAAO,CAAC,YAAY;IA8GpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiD1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA4EtB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAoBzB;;OAEG;IACH,OAAO,CAAC,aAAa;IA4BrB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiEzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAStB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;OAEG;IACH,OAAO,CAAC,4BAA4B;IASpC;;OAEG;IACH,OAAO,CAAC,2BAA2B;CAcpC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAgD5D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,oBAAoB,CA2C7D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAiC5D;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,YAAY,EAAE,EACxB,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,GACtC,eAAe,CAQjB"}

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/policy-evaluator.js

@@ -0,0 +1,634 @@
+/**
+ * LLM-Data-Vault: Policy Evaluator
+ *
+ * Evaluates RBAC/ABAC policies for data access control decisions.
+ * Supports regulatory constraints (GDPR, CCPA, HIPAA).
+ *
+ * CRITICAL CONSTRAINTS:
+ * - Evaluator MUST be stateless
+ * - Evaluator MUST NOT execute inference
+ * - Evaluator MUST return deterministic results
+ *
+ * @module agents/data-access-control/policy-evaluator
+ */
+/**
+ * Default policy evaluator configuration
+ */
+export const DEFAULT_CONFIG = {
+    defaultEffect: 'deny',
+    enableRBAC: true,
+    enableABAC: true,
+    enableRegulatory: true,
+    rbacWeight: 0.4,
+    abacWeight: 0.4,
+    regulatoryWeight: 0.2,
+};
+/**
+ * Policy Evaluator
+ *
+ * Evaluates RBAC, ABAC, and regulatory policies to make access control decisions.
+ */
+export class PolicyEvaluator {
+    config;
+    policies;
+    regulatoryConstraints;
+    /**
+     * Creates a new PolicyEvaluator
+     *
+     * @param policies - Access policies to evaluate
+     * @param regulatoryConstraints - Regulatory constraints to enforce
+     * @param config - Evaluator configuration
+     */
+    constructor(policies, regulatoryConstraints = [], config = {}) {
+        this.policies = policies;
+        this.regulatoryConstraints = regulatoryConstraints;
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /**
+     * Evaluate all policies for an access request
+     *
+     * @param subject - Who is requesting access
+     * @param resource - What resource is being accessed
+     * @param permission - What permission is requested
+     * @param context - Environmental context
+     * @returns Combined evaluation result
+     */
+    evaluate(subject, resource, permission, context) {
+        // Evaluate RBAC
+        const rbacResult = this.config.enableRBAC
+            ? this.evaluateRBAC(subject, resource, permission)
+            : { allowed: true, matchingRoles: [], grantedPermissions: [], reason: 'RBAC disabled', confidence: 1.0 };
+        // Evaluate ABAC
+        const abacResult = this.config.enableABAC
+            ? this.evaluateABAC(subject, resource, permission, context)
+            : { allowed: true, matchingRules: [], evaluatedConditions: [], reason: 'ABAC disabled', confidence: 1.0 };
+        // Evaluate regulatory constraints
+        const regulatoryResult = this.config.enableRegulatory
+            ? this.evaluateRegulatory(subject, resource, context)
+            : { allowed: true, applicableFrameworks: [], violations: [], confidence: 1.0 };
+        // Combine results
+        return this.combineResults(rbacResult, abacResult, regulatoryResult);
+    }
+    /**
+     * Evaluate RBAC policies
+     */
+    evaluateRBAC(subject, resource, permission) {
+        const matchingRoles = [];
+        const grantedPermissions = [];
+        let allowed = false;
+        let bestMatchConfidence = 0;
+        // Get applicable policies for the tenant
+        const tenantPolicies = this.policies.filter(p => p.tenant_id === subject.tenant_id && p.active);
+        for (const policy of tenantPolicies) {
+            // Sort rules by priority (higher first)
+            const sortedRules = [...policy.rules].sort((a, b) => b.priority - a.priority);
+            for (const rule of sortedRules) {
+                // Check if rule applies to this subject's roles
+                const roleMatch = this.matchSubjectRoles(rule, subject);
+                if (!roleMatch.matches)
+                    continue;
+                // Check if rule applies to this resource
+                const resourceMatch = this.matchResource(rule, resource);
+                if (!resourceMatch.matches)
+                    continue;
+                // Check if the permission is granted
+                if (rule.permissions.includes(permission) || rule.permissions.includes('admin')) {
+                    matchingRoles.push(...roleMatch.matchedRoles);
+                    grantedPermissions.push(...rule.permissions);
+                    if (rule.effect === 'allow') {
+                        allowed = true;
+                        bestMatchConfidence = Math.max(bestMatchConfidence, this.calculateRuleConfidence(rule, roleMatch.matchedRoles.length));
+                    }
+                    else if (rule.effect === 'deny') {
+                        // Explicit deny always wins
+                        return {
+                            allowed: false,
+                            matchingRoles: roleMatch.matchedRoles,
+                            grantedPermissions: [],
+                            reason: `Explicit deny by rule ${rule.rule_id}`,
+                            confidence: 1.0,
+                        };
+                    }
+                }
+            }
+        }
+        // Check default effect if no matching rules
+        if (matchingRoles.length === 0) {
+            return {
+                allowed: this.config.defaultEffect === 'allow',
+                matchingRoles: [],
+                grantedPermissions: [],
+                reason: `No matching RBAC rules, default: ${this.config.defaultEffect}`,
+                confidence: 0.5,
+            };
+        }
+        return {
+            allowed,
+            matchingRoles: [...new Set(matchingRoles)],
+            grantedPermissions: [...new Set(grantedPermissions)],
+            reason: allowed
+                ? `Access granted by roles: ${matchingRoles.join(', ')}`
+                : `Permission ${permission} not granted to any matching role`,
+            confidence: bestMatchConfidence || 0.7,
+        };
+    }
+    /**
+     * Evaluate ABAC policies
+     */
+    evaluateABAC(subject, resource, permission, context) {
+        const matchingRules = [];
+        const evaluatedConditions = [];
+        let allowed = false;
+        let bestMatchConfidence = 0;
+        // Get applicable policies
+        const tenantPolicies = this.policies.filter(p => p.tenant_id === subject.tenant_id && p.active);
+        for (const policy of tenantPolicies) {
+            const sortedRules = [...policy.rules].sort((a, b) => b.priority - a.priority);
+            for (const rule of sortedRules) {
+                // Evaluate subject conditions (ABAC)
+                const subjectConditionResults = this.evaluateConditions(rule.subjects?.conditions ?? [], { ...subject.attributes, ...subject });
+                evaluatedConditions.push(...subjectConditionResults.map(r => ({
+                    condition: `subject.${r.field}`,
+                    result: r.result,
+                })));
+                if (!subjectConditionResults.every(c => c.result))
+                    continue;
+                // Evaluate resource conditions (ABAC)
+                const resourceConditionResults = this.evaluateConditions(rule.resources?.conditions ?? [], { ...resource.attributes, ...resource });
+                evaluatedConditions.push(...resourceConditionResults.map(r => ({
+                    condition: `resource.${r.field}`,
+                    result: r.result,
+                })));
+                if (!resourceConditionResults.every(c => c.result))
+                    continue;
+                // Evaluate context conditions
+                const contextConditionResults = this.evaluateConditions(rule.context_conditions ?? [], { ...context });
+                evaluatedConditions.push(...contextConditionResults.map(r => ({
+                    condition: `context.${r.field}`,
+                    result: r.result,
+                })));
+                if (!contextConditionResults.every(c => c.result))
+                    continue;
+                // Check permission
+                if (rule.permissions.includes(permission) || rule.permissions.includes('admin')) {
+                    matchingRules.push(rule.rule_id);
+                    if (rule.effect === 'allow') {
+                        allowed = true;
+                        const conditionCount = subjectConditionResults.length +
+                            resourceConditionResults.length +
+                            contextConditionResults.length;
+                        bestMatchConfidence = Math.max(bestMatchConfidence, this.calculateConditionConfidence(conditionCount));
+                    }
+                    else if (rule.effect === 'deny') {
+                        return {
+                            allowed: false,
+                            matchingRules: [rule.rule_id],
+                            evaluatedConditions,
+                            reason: `Explicit deny by ABAC rule ${rule.rule_id}`,
+                            confidence: 1.0,
+                        };
+                    }
+                }
+            }
+        }
+        if (matchingRules.length === 0) {
+            return {
+                allowed: this.config.defaultEffect === 'allow',
+                matchingRules: [],
+                evaluatedConditions,
+                reason: `No matching ABAC rules, default: ${this.config.defaultEffect}`,
+                confidence: 0.5,
+            };
+        }
+        return {
+            allowed,
+            matchingRules,
+            evaluatedConditions,
+            reason: allowed
+                ? `Access granted by ABAC rules: ${matchingRules.join(', ')}`
+                : 'ABAC conditions not satisfied',
+            confidence: bestMatchConfidence || 0.7,
+        };
+    }
+    /**
+     * Evaluate regulatory constraints
+     */
+    evaluateRegulatory(subject, resource, context) {
+        const applicableFrameworks = [];
+        const violations = [];
+        for (const constraint of this.regulatoryConstraints) {
+            if (!constraint.enforced)
+                continue;
+            applicableFrameworks.push(constraint.framework);
+            // Sort requirements by priority
+            const sortedRequirements = [...constraint.requirements].sort((a, b) => b.priority - a.priority);
+            for (const requirement of sortedRequirements) {
+                const satisfied = requirement.condition(subject, resource, context);
+                if (!satisfied) {
+                    violations.push({
+                        framework: constraint.framework,
+                        requirementId: requirement.id,
+                        description: requirement.description,
+                        severity: requirement.effect,
+                    });
+                }
+            }
+        }
+        // Any deny violation means access is denied
+        const denyViolations = violations.filter(v => v.severity === 'deny');
+        const allowed = denyViolations.length === 0;
+        // Confidence based on number of applicable frameworks and violations
+        const confidence = applicableFrameworks.length > 0
+            ? Math.max(0.5, 1 - (violations.length * 0.1))
+            : 1.0;
+        return {
+            allowed,
+            applicableFrameworks,
+            violations,
+            confidence,
+        };
+    }
+    /**
+     * Combine RBAC, ABAC, and regulatory results into final decision
+     */
+    combineResults(rbac, abac, regulatory) {
+        const reasons = [];
+        let decisionSource = 'combined';
+        // Regulatory violations always take precedence (deny)
+        if (!regulatory.allowed) {
+            const denyViolations = regulatory.violations.filter(v => v.severity === 'deny');
+            reasons.push(`Regulatory violation: ${denyViolations.map(v => `${v.framework}:${v.requirementId}`).join(', ')}`);
+            decisionSource = 'regulatory';
+            return {
+                decision: 'deny',
+                confidence: regulatory.confidence,
+                rbac,
+                abac,
+                regulatory,
+                reasons,
+                decisionSource,
+            };
+        }
+        // Both RBAC and ABAC must allow (if enabled)
+        if (!rbac.allowed && this.config.enableRBAC) {
+            reasons.push(rbac.reason);
+            decisionSource = 'rbac';
+        }
+        if (!abac.allowed && this.config.enableABAC) {
+            reasons.push(abac.reason);
+            if (decisionSource === 'rbac') {
+                decisionSource = 'combined';
+            }
+            else {
+                decisionSource = 'abac';
+            }
+        }
+        const allowed = rbac.allowed && abac.allowed && regulatory.allowed;
+        if (allowed) {
+            reasons.push(rbac.reason);
+            reasons.push(abac.reason);
+        }
+        // Calculate weighted confidence
+        const confidence = this.calculateCombinedConfidence(rbac, abac, regulatory);
+        // Determine final decision source
+        if (rbac.allowed && abac.allowed && regulatory.allowed) {
+            if (rbac.matchingRoles.length > 0 && abac.matchingRules.length > 0) {
+                decisionSource = 'combined';
+            }
+            else if (rbac.matchingRoles.length > 0) {
+                decisionSource = 'rbac';
+            }
+            else if (abac.matchingRules.length > 0) {
+                decisionSource = 'abac';
+            }
+            else {
+                decisionSource = 'default';
+            }
+        }
+        return {
+            decision: allowed ? 'allow' : 'deny',
+            confidence,
+            rbac,
+            abac,
+            regulatory,
+            reasons: [...new Set(reasons)],
+            decisionSource,
+        };
+    }
+    /**
+     * Match subject roles against rule
+     */
+    matchSubjectRoles(rule, subject) {
+        if (!rule.subjects?.roles || rule.subjects.roles.length === 0) {
+            return { matches: true, matchedRoles: [] };
+        }
+        const matchedRoles = subject.roles.filter(role => rule.subjects.roles.includes(role) ||
+            rule.subjects.roles.includes('*'));
+        return {
+            matches: matchedRoles.length > 0,
+            matchedRoles,
+        };
+    }
+    /**
+     * Match resource against rule
+     */
+    matchResource(rule, resource) {
+        if (!rule.resources) {
+            return { matches: true };
+        }
+        // Check resource type
+        if (rule.resources.types && rule.resources.types.length > 0) {
+            if (!rule.resources.types.includes(resource.resource_type)) {
+                return { matches: false };
+            }
+        }
+        // Check resource IDs
+        if (rule.resources.ids && rule.resources.ids.length > 0) {
+            const idMatch = rule.resources.ids.some(pattern => this.matchPattern(pattern, resource.resource_id));
+            if (!idMatch) {
+                return { matches: false };
+            }
+        }
+        return { matches: true };
+    }
+    /**
+     * Evaluate policy conditions against attributes
+     */
+    evaluateConditions(conditions, attributes) {
+        return conditions.map(condition => ({
+            field: condition.field,
+            result: this.evaluateCondition(condition, attributes),
+        }));
+    }
+    /**
+     * Evaluate a single condition
+     */
+    evaluateCondition(condition, attributes) {
+        const value = this.getNestedValue(attributes, condition.field);
+        switch (condition.operator) {
+            case 'equals':
+                return value === condition.value;
+            case 'not_equals':
+                return value !== condition.value;
+            case 'contains':
+                if (typeof value === 'string') {
+                    return value.includes(String(condition.value));
+                }
+                if (Array.isArray(value)) {
+                    return value.includes(condition.value);
+                }
+                return false;
+            case 'not_contains':
+                if (typeof value === 'string') {
+                    return !value.includes(String(condition.value));
+                }
+                if (Array.isArray(value)) {
+                    return !value.includes(condition.value);
+                }
+                return true;
+            case 'starts_with':
+                return typeof value === 'string' && value.startsWith(String(condition.value));
+            case 'ends_with':
+                return typeof value === 'string' && value.endsWith(String(condition.value));
+            case 'regex':
+                if (typeof value !== 'string' || typeof condition.value !== 'string') {
+                    return false;
+                }
+                try {
+                    return new RegExp(condition.value).test(value);
+                }
+                catch {
+                    return false;
+                }
+            case 'in':
+                if (!Array.isArray(condition.value))
+                    return false;
+                return condition.value.includes(value);
+            case 'not_in':
+                if (!Array.isArray(condition.value))
+                    return true;
+                return !condition.value.includes(value);
+            case 'greater_than':
+                return typeof value === 'number' && typeof condition.value === 'number'
+                    ? value > condition.value
+                    : false;
+            case 'less_than':
+                return typeof value === 'number' && typeof condition.value === 'number'
+                    ? value < condition.value
+                    : false;
+            case 'between':
+                if (typeof value !== 'number' || !Array.isArray(condition.value)) {
+                    return false;
+                }
+                const [min, max] = condition.value;
+                return value >= min && value <= max;
+            default:
+                return false;
+        }
+    }
+    /**
+     * Get nested value from object using dot notation
+     */
+    getNestedValue(obj, path) {
+        return path.split('.').reduce((acc, part) => {
+            if (acc && typeof acc === 'object' && part in acc) {
+                return acc[part];
+            }
+            return undefined;
+        }, obj);
+    }
+    /**
+     * Match a glob pattern against a value
+     */
+    matchPattern(pattern, value) {
+        if (pattern === '*')
+            return true;
+        if (!pattern.includes('*'))
+            return pattern === value;
+        const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+        return regex.test(value);
+    }
+    /**
+     * Calculate confidence score for a rule match
+     */
+    calculateRuleConfidence(rule, matchedRolesCount) {
+        // Base confidence from having a matching rule
+        let confidence = 0.7;
+        // Increase confidence for more specific rules (higher priority)
+        confidence += Math.min(0.1, rule.priority / 1000);
+        // Increase confidence for multiple matching roles
+        confidence += Math.min(0.1, matchedRolesCount * 0.05);
+        return Math.min(1.0, confidence);
+    }
+    /**
+     * Calculate confidence based on number of satisfied conditions
+     */
+    calculateConditionConfidence(conditionCount) {
+        // More conditions satisfied = higher confidence
+        if (conditionCount === 0)
+            return 0.6;
+        if (conditionCount === 1)
+            return 0.7;
+        if (conditionCount === 2)
+            return 0.8;
+        if (conditionCount >= 3)
+            return 0.9;
+        return 0.6;
+    }
+    /**
+     * Calculate combined confidence from all evaluation results
+     */
+    calculateCombinedConfidence(rbac, abac, regulatory) {
+        const totalWeight = this.config.rbacWeight + this.config.abacWeight + this.config.regulatoryWeight;
+        const weightedSum = rbac.confidence * this.config.rbacWeight +
+            abac.confidence * this.config.abacWeight +
+            regulatory.confidence * this.config.regulatoryWeight;
+        return weightedSum / totalWeight;
+    }
+}
+/**
+ * Create default GDPR regulatory constraints
+ */
+export function createGDPRConstraints() {
+    return {
+        framework: 'GDPR',
+        enforced: true,
+        requirements: [
+            {
+                id: 'gdpr-legal-basis',
+                description: 'Processing must have a valid legal basis',
+                condition: (_subject, resource) => {
+                    // Check if resource has legal basis metadata
+                    const legalBasis = resource.attributes['legal_basis'];
+                    return legalBasis !== undefined && legalBasis !== null;
+                },
+                effect: 'deny',
+                priority: 100,
+            },
+            {
+                id: 'gdpr-data-residency',
+                description: 'Data must comply with EU data residency requirements',
+                condition: (_subject, resource, context) => {
+                    // Check if data residency is EU-compliant
+                    const dataResidency = resource.data_residency;
+                    const sourceRegion = context.geo_location;
+                    // If data is in EU and request is from outside, check for adequacy
+                    if (dataResidency?.startsWith('eu-') && sourceRegion && !sourceRegion.startsWith('eu-')) {
+                        // Would need to check for adequacy decisions or SCCs
+                        return true; // Simplified - always allow for now
+                    }
+                    return true;
+                },
+                effect: 'deny',
+                priority: 90,
+            },
+            {
+                id: 'gdpr-purpose-limitation',
+                description: 'Data access must be for specified purposes only',
+                condition: (_subject, resource) => {
+                    // Check if access purpose matches allowed purposes
+                    const allowedPurposes = resource.attributes['allowed_purposes'];
+                    // Simplified check - would need actual purpose from request
+                    return allowedPurposes === undefined || allowedPurposes.length > 0;
+                },
+                effect: 'warn',
+                priority: 80,
+            },
+        ],
+    };
+}
+/**
+ * Create default HIPAA regulatory constraints
+ */
+export function createHIPAAConstraints() {
+    return {
+        framework: 'HIPAA',
+        enforced: true,
+        requirements: [
+            {
+                id: 'hipaa-minimum-necessary',
+                description: 'Access must follow minimum necessary standard',
+                condition: (subject) => {
+                    // Check if subject has appropriate role for PHI access
+                    const allowedRoles = ['healthcare_provider', 'admin', 'auditor'];
+                    return subject.roles.some(role => allowedRoles.includes(role));
+                },
+                effect: 'deny',
+                priority: 100,
+            },
+            {
+                id: 'hipaa-authorization',
+                description: 'PHI access requires valid authorization',
+                condition: (_subject, resource) => {
+                    // Check if PHI data has authorization
+                    const classification = resource.classification;
+                    if (classification === 'restricted') {
+                        const hasAuthorization = resource.attributes['hipaa_authorization'];
+                        return hasAuthorization === true;
+                    }
+                    return true;
+                },
+                effect: 'deny',
+                priority: 90,
+            },
+            {
+                id: 'hipaa-audit-trail',
+                description: 'PHI access must be audited',
+                condition: () => {
+                    // This is always true - audit will happen via DecisionEvent
+                    return true;
+                },
+                effect: 'audit',
+                priority: 80,
+            },
+        ],
+    };
+}
+/**
+ * Create default CCPA regulatory constraints
+ */
+export function createCCPAConstraints() {
+    return {
+        framework: 'CCPA',
+        enforced: true,
+        requirements: [
+            {
+                id: 'ccpa-opt-out',
+                description: 'Respect consumer opt-out of sale',
+                condition: (_subject, resource) => {
+                    // Check if consumer has opted out and this is a sale
+                    const optedOut = resource.attributes['ccpa_opted_out'];
+                    const isSale = resource.attributes['is_sale'];
+                    if (optedOut === true && isSale === true) {
+                        return false;
+                    }
+                    return true;
+                },
+                effect: 'deny',
+                priority: 100,
+            },
+            {
+                id: 'ccpa-consumer-rights',
+                description: 'Honor consumer data rights requests',
+                condition: (_subject, resource) => {
+                    const pendingDeletionRequest = resource.attributes['pending_deletion'];
+                    return pendingDeletionRequest !== true;
+                },
+                effect: 'deny',
+                priority: 90,
+            },
+        ],
+    };
+}
+/**
+ * Create a PolicyEvaluator with all default regulatory constraints
+ */
+export function createDefaultPolicyEvaluator(policies, config) {
+    const constraints = [
+        createGDPRConstraints(),
+        createHIPAAConstraints(),
+        createCCPAConstraints(),
+    ];
+    return new PolicyEvaluator(policies, constraints, config);
+}
+//# sourceMappingURL=policy-evaluator.js.map

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/policy-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-evaluator.js","sourceRoot":"","sources":["../../../src/agents/data-access-control/policy-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA2IH;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAA0B;IACnD,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;IAChB,gBAAgB,EAAE,IAAI;IACtB,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,GAAG;IACf,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAwB;IAC9B,QAAQ,CAAiB;IACzB,qBAAqB,CAAyB;IAE/D;;;;;;OAMG;IACH,YACE,QAAwB,EACxB,wBAAgD,EAAE,EAClD,SAAyC,EAAE;QAE3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CACN,OAAgB,EAChB,QAAkB,EAClB,UAA0B,EAC1B,OAAsB;QAEtB,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU;YACvC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC;YAClD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAE3G,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU;YACvC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC;YAC3D,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAE5G,kCAAkC;QAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB;YACnD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;YACrD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAEjF,kBAAkB;QAClB,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,OAAgB,EAChB,QAAkB,EAClB,UAA0B;QAE1B,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAqB,EAAE,CAAC;QAChD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAE5B,yCAAyC;QACzC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CACnD,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,wCAAwC;YACxC,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;YAE9E,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,gDAAgD;gBAChD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,CAAC,SAAS,CAAC,OAAO;oBAAE,SAAS;gBAEjC,yCAAyC;gBACzC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC,aAAa,CAAC,OAAO;oBAAE,SAAS;gBAErC,qCAAqC;gBACrC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAyB,CAAC,EAAE,CAAC;oBAClG,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;oBAC9C,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;oBAE7C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC5B,OAAO,GAAG,IAAI,CAAC;wBACf,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAC5B,mBAAmB,EACnB,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAClE,CAAC;oBACJ,CAAC;yBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAClC,4BAA4B;wBAC5B,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,aAAa,EAAE,SAAS,CAAC,YAAY;4BACrC,kBAAkB,EAAE,EAAE;4BACtB,MAAM,EAAE,yBAAyB,IAAI,CAAC,OAAO,EAAE;4BAC/C,UAAU,EAAE,GAAG;yBAChB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO;gBAC9C,aAAa,EAAE,EAAE;gBACjB,kBAAkB,EAAE,EAAE;gBACtB,MAAM,EAAE,oCAAoC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBACvE,UAAU,EAAE,GAAG;aAChB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO;YACP,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;YAC1C,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACpD,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACxD,CAAC,CAAC,cAAc,UAAU,mCAAmC;YAC/D,UAAU,EAAE,mBAAmB,IAAI,GAAG;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,OAAgB,EAChB,QAAkB,EAClB,UAA0B,EAC1B,OAAsB;QAEtB,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,mBAAmB,GAAkD,EAAE,CAAC;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CACnD,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;YAE9E,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,qCAAqC;gBACrC,MAAM,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,CACrD,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,EAC/B,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,EAAE,CACtC,CAAC;gBACF,mBAAmB,CAAC,IAAI,CACtB,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACnC,SAAS,EAAE,WAAW,CAAC,CAAC,KAAK,EAAE;oBAC/B,MAAM,EAAE,CAAC,CAAC,MAAM;iBACjB,CAAC,CAAC,CACJ,CAAC;gBAEF,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAE5D,sCAAsC;gBACtC,MAAM,wBAAwB,GAAG,IAAI,CAAC,kBAAkB,CACtD,IAAI,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,EAChC,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,QAAQ,EAAE,CACxC,CAAC;gBACF,mBAAmB,CAAC,IAAI,CACtB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACpC,SAAS,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE;oBAChC,MAAM,EAAE,CAAC,CAAC,MAAM;iBACjB,CAAC,CAAC,CACJ,CAAC;gBAEF,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAE7D,8BAA8B;gBAC9B,MAAM,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,CACrD,IAAI,CAAC,kBAAkB,IAAI,EAAE,EAC7B,EAAE,GAAG,OAAO,EAAE,CACf,CAAC;gBACF,mBAAmB,CAAC,IAAI,CACtB,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACnC,SAAS,EAAE,WAAW,CAAC,CAAC,KAAK,EAAE;oBAC/B,MAAM,EAAE,CAAC,CAAC,MAAM;iBACjB,CAAC,CAAC,CACJ,CAAC;gBAEF,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAE5D,mBAAmB;gBACnB,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAyB,CAAC,EAAE,CAAC;oBAClG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC5B,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM,cAAc,GAClB,uBAAuB,CAAC,MAAM;4BAC9B,wBAAwB,CAAC,MAAM;4BAC/B,uBAAuB,CAAC,MAAM,CAAC;wBACjC,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAC5B,mBAAmB,EACnB,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAClD,CAAC;oBACJ,CAAC;yBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAClC,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,aAAa,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;4BAC7B,mBAAmB;4BACnB,MAAM,EAAE,8BAA8B,IAAI,CAAC,OAAO,EAAE;4BACpD,UAAU,EAAE,GAAG;yBAChB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO;gBAC9C,aAAa,EAAE,EAAE;gBACjB,mBAAmB;gBACnB,MAAM,EAAE,oCAAoC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBACvE,UAAU,EAAE,GAAG;aAChB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO;YACP,aAAa;YACb,mBAAmB;YACnB,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iCAAiC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC7D,CAAC,CAAC,+BAA+B;YACnC,UAAU,EAAE,mBAAmB,IAAI,GAAG;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,OAAgB,EAChB,QAAkB,EAClB,OAAsB;QAEtB,MAAM,oBAAoB,GAA0B,EAAE,CAAC;QACvD,MAAM,UAAU,GAA6C,EAAE,CAAC;QAEhE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACpD,IAAI,CAAC,UAAU,CAAC,QAAQ;gBAAE,SAAS;YAEnC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAEhD,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAC1D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAClC,CAAC;YAEF,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;gBAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAEpE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,UAAU,CAAC,IAAI,CAAC;wBACd,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC/B,aAAa,EAAE,WAAW,CAAC,EAAE;wBAC7B,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,QAAQ,EAAE,WAAW,CAAC,MAAM;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;QAE5C,qEAAqE;QACrE,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,GAAG,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,GAAG,CAAC;QAER,OAAO;YACL,OAAO;YACP,oBAAoB;YACpB,UAAU;YACV,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,IAA0B,EAC1B,IAA0B,EAC1B,UAAsC;QAEtC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,GAA8C,UAAU,CAAC;QAE3E,sDAAsD;QACtD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CACV,yBAAyB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;YACF,cAAc,GAAG,YAAY,CAAC;YAE9B,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,OAAO;gBACP,cAAc;aACf,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;gBAC9B,cAAc,GAAG,UAAU,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAEnE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,gCAAgC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAE5E,kCAAkC;QAClC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,cAAc,GAAG,UAAU,CAAC;YAC9B,CAAC;iBAAM,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,cAAc,GAAG,MAAM,CAAC;YAC1B,CAAC;iBAAM,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,cAAc,GAAG,MAAM,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACpC,UAAU;YACV,IAAI;YACJ,IAAI;YACJ,UAAU;YACV,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,cAAc;SACf,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,IAAsB,EACtB,OAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CACvC,IAAI,CAAC,EAAE,CACL,IAAI,CAAC,QAAS,CAAC,KAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,QAAS,CAAC,KAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CACtC,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;YAChC,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,IAAsB,EACtB,QAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CACrC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,CAC5D,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,UAA6B,EAC7B,UAAmC;QAEnC,OAAO,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC;SACtD,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,SAA0B,EAC1B,UAAmC;QAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAE/D,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3B,KAAK,QAAQ;gBACX,OAAO,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC;YACnC,KAAK,YAAY;gBACf,OAAO,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC;YACnC,KAAK,UAAU;gBACb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,cAAc;gBACjB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClD,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,aAAa;gBAChB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAChF,KAAK,WAAW;gBACd,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,KAAK,OAAO;gBACV,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC;oBACH,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,KAAK,IAAI;gBACP,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAClD,OAAQ,SAAS,CAAC,KAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxD,KAAK,QAAQ;gBACX,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACjD,OAAO,CAAE,SAAS,CAAC,KAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzD,KAAK,cAAc;gBACjB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;oBACrE,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK;oBACzB,CAAC,CAAC,KAAK,CAAC;YACZ,KAAK,WAAW;gBACd,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;oBACrE,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK;oBACzB,CAAC,CAAC,KAAK,CAAC;YACZ,KAAK,SAAS;gBACZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,KAAiB,CAAC;gBAC/C,OAAO,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,CAAC;YACtC;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAA4B,EAAE,IAAY;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAY,EAAE,IAAY,EAAE,EAAE;YAC3D,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAK,GAA+B,EAAE,CAAC;gBAC/E,OAAQ,GAA+B,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,OAAe,EAAE,KAAa;QACjD,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,KAAK,KAAK,CAAC;QAErD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAC,IAAsB,EAAE,iBAAyB;QAC/E,8CAA8C;QAC9C,IAAI,UAAU,GAAG,GAAG,CAAC;QAErB,gEAAgE;QAChE,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAElD,kDAAkD;QAClD,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,4BAA4B,CAAC,cAAsB;QACzD,gDAAgD;QAChD,IAAI,cAAc,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,IAAI,cAAc,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,IAAI,cAAc,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,IAAI,cAAc,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,2BAA2B,CACjC,IAA0B,EAC1B,IAA0B,EAC1B,UAAsC;QAEtC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAEnG,MAAM,WAAW,GACf,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU;YACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU;YACxC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAEvD,OAAO,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE;YACZ;gBACE,EAAE,EAAE,kBAAkB;gBACtB,WAAW,EAAE,0CAA0C;gBACvD,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBAChC,6CAA6C;oBAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;oBACtD,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC;gBACzD,CAAC;gBACD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,GAAG;aACd;YACD;gBACE,EAAE,EAAE,qBAAqB;gBACzB,WAAW,EAAE,sDAAsD;gBACnE,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;oBACzC,0CAA0C;oBAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC;oBAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;oBAE1C,mEAAmE;oBACnE,IAAI,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;wBACxF,qDAAqD;wBACrD,OAAO,IAAI,CAAC,CAAC,oCAAoC;oBACnD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,EAAE;aACb;YACD;gBACE,EAAE,EAAE,yBAAyB;gBAC7B,WAAW,EAAE,iDAAiD;gBAC9D,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBAChC,mDAAmD;oBACnD,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAyB,CAAC;oBACxF,4DAA4D;oBAC5D,OAAO,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,EAAE;aACb;SACF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE;YACZ;gBACE,EAAE,EAAE,yBAAyB;gBAC7B,WAAW,EAAE,+CAA+C;gBAC5D,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;oBACrB,uDAAuD;oBACvD,MAAM,YAAY,GAAG,CAAC,qBAAqB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;oBACjE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,GAAG;aACd;YACD;gBACE,EAAE,EAAE,qBAAqB;gBACzB,WAAW,EAAE,yCAAyC;gBACtD,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBAChC,sCAAsC;oBACtC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;oBAC/C,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;wBACpC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAwB,CAAC;wBAC3F,OAAO,gBAAgB,KAAK,IAAI,CAAC;oBACnC,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,EAAE;aACb;YACD;gBACE,EAAE,EAAE,mBAAmB;gBACvB,WAAW,EAAE,4BAA4B;gBACzC,SAAS,EAAE,GAAG,EAAE;oBACd,4DAA4D;oBAC5D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,EAAE;aACb;SACF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE;YACZ;gBACE,EAAE,EAAE,cAAc;gBAClB,WAAW,EAAE,kCAAkC;gBAC/C,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBAChC,qDAAqD;oBACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAwB,CAAC;oBAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAwB,CAAC;oBAErE,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACzC,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,GAAG;aACd;YACD;gBACE,EAAE,EAAE,sBAAsB;gBAC1B,WAAW,EAAE,qCAAqC;gBAClD,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBAChC,MAAM,sBAAsB,GAAG,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAwB,CAAC;oBAC9F,OAAO,sBAAsB,KAAK,IAAI,CAAC;gBACzC,CAAC;gBACD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,EAAE;aACb;SACF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAwB,EACxB,MAAuC;IAEvC,MAAM,WAAW,GAAG;QAClB,qBAAqB,EAAE;QACvB,sBAAsB,EAAE;QACxB,qBAAqB,EAAE;KACxB,CAAC;IAEF,OAAO,IAAI,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC"}