govyn 0.0.1 → 0.2.5

package/dist/alert-manager.js

@@ -0,0 +1,267 @@
+/**
+ * Alert manager for the Govyn proxy.
+ *
+ * Subscribes to govynEvents and evaluates incoming events against configured
+ * alert rules. When a rule matches, delivers a webhook POST to the configured
+ * URL and records the alert in the alert_history table.
+ *
+ * Supports two rule types:
+ * - budget_threshold: fires on budget_warning/budget_exceeded events
+ * - policy_trigger: fires on policy_denied events
+ */
+import { govynEvents } from './events.js';
+import { deliverWebhookJson, resolveWebhookTarget } from './security.js';
+import { adaptAlertStore } from './persistence.js';
+export class AlertManager {
+    store;
+    rules = [];
+    cooldownCache = new Map();
+    eventHandler = null;
+    constructor(storeOrSql) {
+        this.store = adaptAlertStore(storeOrSql);
+    }
+    /**
+     * Load rules from DB and subscribe to govynEvents.
+     */
+    async start() {
+        await this.reloadRules();
+        this.eventHandler = (event) => {
+            this.handleEvent(event).catch((err) => {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error('[alert-manager] Error handling event:', msg);
+            });
+        };
+        govynEvents.on('event', this.eventHandler);
+    }
+    /**
+     * Unsubscribe from events.
+     */
+    stop() {
+        if (this.eventHandler) {
+            govynEvents.removeListener('event', this.eventHandler);
+            this.eventHandler = null;
+        }
+    }
+    /**
+     * Reload all rules from the database.
+     */
+    async reloadRules() {
+        this.rules = await this.store.listRules();
+        // Populate cooldown cache from loaded rules
+        for (const rule of this.rules) {
+            if (rule.lastFiredAt) {
+                this.cooldownCache.set(rule.id, rule.lastFiredAt);
+            }
+        }
+    }
+    /**
+     * Handle an incoming event by evaluating all enabled rules.
+     */
+    async handleEvent(event) {
+        for (const rule of this.rules) {
+            if (!rule.enabled)
+                continue;
+            if (this.isInCooldown(rule))
+                continue;
+            if (this.evaluateRule(rule, event)) {
+                await this.fireAlert(rule, event);
+            }
+        }
+    }
+    /**
+     * Evaluate whether a rule matches the given event.
+     */
+    evaluateRule(rule, event) {
+        if (rule.type === 'budget_threshold') {
+            return this.evaluateBudgetThreshold(rule, event);
+        }
+        if (rule.type === 'policy_trigger') {
+            return this.evaluatePolicyTrigger(rule, event);
+        }
+        return false;
+    }
+    /**
+     * Check if a rule is within its cooldown window.
+     */
+    isInCooldown(rule) {
+        const lastFired = this.cooldownCache.get(rule.id) ?? rule.lastFiredAt;
+        if (!lastFired)
+            return false;
+        const cooldownMs = rule.cooldownMinutes * 60 * 1000;
+        const cooldownEndsAt = new Date(lastFired.getTime() + cooldownMs);
+        return Date.now() < cooldownEndsAt.getTime();
+    }
+    /**
+     * Fire an alert: deliver webhook, record history, update cooldown.
+     */
+    async fireAlert(rule, event) {
+        const firedAt = new Date().toISOString();
+        let webhookStatus = null;
+        let webhookError = null;
+        // Build webhook payload
+        const payload = {
+            alert: {
+                rule_id: rule.id,
+                rule_name: rule.name,
+                rule_type: rule.type,
+            },
+            event: this.serializeEvent(event),
+            fired_at: firedAt,
+            source: 'govyn',
+        };
+        // Send webhook
+        const webhookTarget = await resolveWebhookTarget(rule.webhookUrl);
+        if (!webhookTarget.ok) {
+            webhookError = webhookTarget.error;
+        }
+        else {
+            try {
+                const response = await deliverWebhookJson(webhookTarget.target, payload);
+                webhookStatus = response.status;
+            }
+            catch (err) {
+                webhookError = err instanceof Error ? err.message : String(err);
+            }
+        }
+        // Record in alert_history (even on webhook failure)
+        try {
+            await this.store.recordAlertHistory({
+                ruleId: rule.id,
+                ruleName: rule.name,
+                ruleType: rule.type,
+                eventType: event.type,
+                eventPayload: this.serializeEvent(event),
+                webhookUrl: rule.webhookUrl,
+                webhookStatus,
+                webhookError,
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error('[alert-manager] Failed to record alert history:', msg);
+        }
+        // Update last_fired_at
+        try {
+            await this.store.touchRuleLastFired(rule.id, new Date(firedAt));
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error('[alert-manager] Failed to update last_fired_at:', msg);
+        }
+        // Update in-memory cooldown cache
+        this.cooldownCache.set(rule.id, new Date());
+        // Emit alert_fired event
+        govynEvents.emit('event', {
+            type: 'alert_fired',
+            ruleId: rule.id,
+            ruleName: rule.name,
+            ruleType: rule.type,
+            webhookUrl: rule.webhookUrl,
+            webhookStatus,
+        });
+    }
+    async listRules() {
+        return this.store.listRules();
+    }
+    async createRule(input) {
+        const rule = await this.store.createRule(input);
+        await this.reloadRules();
+        return rule;
+    }
+    async updateRule(input) {
+        const rule = await this.store.updateRule(input);
+        if (rule) {
+            await this.reloadRules();
+        }
+        return rule;
+    }
+    async deleteRule(id) {
+        const deleted = await this.store.deleteRule(id);
+        if (deleted) {
+            await this.reloadRules();
+        }
+        return deleted;
+    }
+    async listHistory(limit, offset, ruleId) {
+        return this.store.listHistory(limit, offset, ruleId);
+    }
+    // ---- Private helpers ----
+    evaluateBudgetThreshold(rule, event) {
+        const config = rule.config;
+        if (event.type === 'budget_warning') {
+            // Check agent match
+            if (config.agent_id !== '*' && config.agent_id !== event.agentId)
+                return false;
+            // Check metric matches limitPeriod
+            if (config.metric !== event.limitPeriod)
+                return false;
+            // Check threshold
+            return event.percentUsed >= config.threshold_percent;
+        }
+        if (event.type === 'budget_exceeded') {
+            // Check agent match
+            if (config.agent_id !== '*' && config.agent_id !== event.agentId)
+                return false;
+            // budget_exceeded always exceeds any threshold
+            // Check metric by inspecting the code field
+            const isDaily = event.code.includes('daily');
+            if (config.metric === 'daily' && !isDaily)
+                return false;
+            if (config.metric === 'monthly' && isDaily)
+                return false;
+            return true;
+        }
+        return false;
+    }
+    evaluatePolicyTrigger(rule, event) {
+        if (event.type !== 'policy_denied')
+            return false;
+        const config = rule.config;
+        // Check agent match
+        if (config.agent_id !== '*' && config.agent_id !== event.agentId)
+            return false;
+        // Check policy name match
+        if (config.policy_name !== '*' && config.policy_name !== event.policyName)
+            return false;
+        return true;
+    }
+    /**
+     * Convert a GovynEvent to a plain object for webhook payload / DB storage.
+     * Converts camelCase event fields to snake_case for external consumption.
+     */
+    serializeEvent(event) {
+        const result = { type: event.type };
+        // Convert each event type's fields to snake_case
+        if (event.type === 'budget_warning') {
+            result.agent_id = event.agentId;
+            result.percent_used = event.percentUsed;
+            result.current_spend = event.currentSpend;
+            result.limit = event.limit;
+            result.resets_at = event.resetsAt;
+            result.limit_period = event.limitPeriod;
+        }
+        else if (event.type === 'budget_exceeded') {
+            result.agent_id = event.agentId;
+            result.code = event.code;
+            result.limit_amount = event.limitAmount;
+            result.current_spend = event.currentSpend;
+            result.reset_time = event.resetTime;
+        }
+        else if (event.type === 'policy_denied') {
+            result.agent_id = event.agentId;
+            result.provider = event.provider;
+            result.path = event.path;
+            result.policy_name = event.policyName;
+            result.policy_type = event.policyType;
+            result.reason = event.reason;
+            result.evaluation_time_ms = event.evaluationTimeMs;
+            result.allowed = event.allowed;
+        }
+        else {
+            // For other event types, spread all fields
+            Object.assign(result, event);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=alert-manager.js.map

package/dist/alert-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-manager.js","sourceRoot":"","sources":["../src/alert-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAOzE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKnD,MAAM,OAAO,YAAY;IACN,KAAK,CAAa;IAC3B,KAAK,GAAgB,EAAE,CAAC;IACxB,aAAa,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC7C,YAAY,GAAyC,IAAI,CAAC;IAElE,YAAY,UAAqC;QAC/C,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAEzB,IAAI,CAAC,YAAY,GAAG,CAAC,KAAiB,EAAE,EAAE;YACxC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACpC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAE1C,4CAA4C;QAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAiB;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAC5B,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAe,EAAE,KAAiB;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAe;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,IAAe,EAAE,KAAiB;QAChD,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,YAAY,GAAkB,IAAI,CAAC;QAEvC,wBAAwB;QACxB,MAAM,OAAO,GAAG;YACd,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,SAAS,EAAE,IAAI,CAAC,IAAI;aACrB;YACD,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YACjC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,OAAO;SAChB,CAAC;QAEF,eAAe;QACf,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACzE,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;gBAClC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBACxC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa;gBACb,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAE5C,yBAAyB;QACzB,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE;YACxB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAOhB;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAOhB;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,MAAsB;QACrE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,4BAA4B;IAEpB,uBAAuB,CAAC,IAAe,EAAE,KAAiB;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAA+B,CAAC;QAEpD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,oBAAoB;YACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC/E,mCAAmC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YACtD,kBAAkB;YAClB,OAAO,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,iBAAiB,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACrC,oBAAoB;YACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC/E,+CAA+C;YAC/C,4CAA4C;YAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACxD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO;gBAAE,OAAO,KAAK,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,qBAAqB,CAAC,IAAe,EAAE,KAAiB;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;YAAE,OAAO,KAAK,CAAC;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6B,CAAC;QAElD,oBAAoB;QACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC/E,0BAA0B;QAC1B,IAAI,MAAM,CAAC,WAAW,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAExF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,KAAiB;QACtC,MAAM,MAAM,GAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAE7D,iDAAiD;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;YAChC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;YACxC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;YAC1C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC3B,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;YAClC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;YAChC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACzB,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;YACxC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;YAC1C,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC1C,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;YAChC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YACjC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACzB,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;YACtC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;YACtC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC7B,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC,gBAAgB,CAAC;YACnD,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/approval-api.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Approval list API handler for the Govyn proxy.
+ *
+ * Handles GET /api/approvals — returns a paginated, filtered list of
+ * approval requests from the database. Complements the existing
+ * per-request approve/deny/poll endpoints in server.ts.
+ */
+import type http from 'node:http';
+import type { ApprovalManager } from './approval.js';
+/**
+ * Handle GET /api/approvals with status filtering and pagination.
+ *
+ * Query parameters:
+ * - status: 'pending' | 'approved' | 'denied' | 'denied_timeout' | 'all' (default 'all'), supports comma-separated
+ * - limit: 1-200 (default 50)
+ * - offset: >= 0 (default 0)
+ * - agent_id: optional exact match filter
+ */
+export declare function handleApprovalApi(req: http.IncomingMessage, res: http.ServerResponse, approvalManager: ApprovalManager): void;

package/dist/approval-api.js

@@ -0,0 +1,82 @@
+/**
+ * Approval list API handler for the Govyn proxy.
+ *
+ * Handles GET /api/approvals — returns a paginated, filtered list of
+ * approval requests from the database. Complements the existing
+ * per-request approve/deny/poll endpoints in server.ts.
+ */
+const VALID_STATUSES = new Set(['pending', 'approved', 'denied', 'denied_timeout']);
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 200;
+/**
+ * Handle GET /api/approvals with status filtering and pagination.
+ *
+ * Query parameters:
+ * - status: 'pending' | 'approved' | 'denied' | 'denied_timeout' | 'all' (default 'all'), supports comma-separated
+ * - limit: 1-200 (default 50)
+ * - offset: >= 0 (default 0)
+ * - agent_id: optional exact match filter
+ */
+export function handleApprovalApi(req, res, approvalManager) {
+    const parsed = new URL(req.url, 'http://localhost');
+    const params = parsed.searchParams;
+    // Parse and validate status filter
+    const statusParam = params.get('status') ?? 'all';
+    let statusFilters = [];
+    if (statusParam !== 'all') {
+        const parts = statusParam.split(',').map((s) => s.trim()).filter(Boolean);
+        for (const part of parts) {
+            if (!VALID_STATUSES.has(part)) {
+                sendError(res, 400, `Invalid status value: "${part}". Valid values: pending, approved, denied, denied_timeout, all`);
+                return;
+            }
+        }
+        statusFilters = parts;
+    }
+    // Parse and validate limit
+    const limitStr = params.get('limit');
+    let limit = DEFAULT_LIMIT;
+    if (limitStr !== null) {
+        limit = parseInt(limitStr, 10);
+        if (isNaN(limit) || limit < 1 || limit > MAX_LIMIT) {
+            sendError(res, 400, `Invalid limit: must be between 1 and ${MAX_LIMIT}`);
+            return;
+        }
+    }
+    // Parse and validate offset
+    const offsetStr = params.get('offset');
+    let offset = 0;
+    if (offsetStr !== null) {
+        offset = parseInt(offsetStr, 10);
+        if (isNaN(offset) || offset < 0) {
+            sendError(res, 400, 'Invalid offset: must be >= 0');
+            return;
+        }
+    }
+    // Optional agent_id filter
+    const agentId = params.get('agent_id');
+    // Build and execute query
+    approvalManager.listApprovals(statusFilters, limit, offset, agentId)
+        .then((result) => {
+        const body = JSON.stringify(result);
+        res.writeHead(200, {
+            'content-type': 'application/json',
+            'content-length': Buffer.byteLength(body).toString(),
+        });
+        res.end(body);
+    })
+        .catch((err) => {
+        const message = err instanceof Error ? err.message : 'Unknown error';
+        console.error('[approval-api] Database error:', message);
+        sendError(res, 500, 'Failed to fetch approvals');
+    });
+}
+function sendError(res, statusCode, message) {
+    const body = JSON.stringify({ error: { message, code: statusCode === 400 ? 'invalid_request' : 'internal_error' } });
+    res.writeHead(statusCode, {
+        'content-type': 'application/json',
+        'content-length': Buffer.byteLength(body).toString(),
+    });
+    res.end(body);
+}
+//# sourceMappingURL=approval-api.js.map

package/dist/approval-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-api.js","sourceRoot":"","sources":["../src/approval-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACpF,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,GAAwB,EACxB,eAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,kBAAkB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IAEnC,mCAAmC;IACnC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;IAClD,IAAI,aAAa,GAAa,EAAE,CAAC;IAEjC,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,IAAI,iEAAiE,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;QACH,CAAC;QACD,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,GAAG,aAAa,CAAC;IAC1B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YACnD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,wCAAwC,SAAS,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,0BAA0B;IAC1B,eAAe,CAAC,aAAa,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;SACjE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SACrD,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACrE,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;QACzD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS,CAChB,GAAwB,EACxB,UAAkB,EAClB,OAAe;IAEf,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACrH,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE;QACxB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/approval-timeout.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Background job that auto-denies expired approval requests.
+ *
+ * Runs on a configurable interval (default 30 seconds) to mark pending
+ * approval requests that have passed their expires_at timestamp as
+ * 'denied_timeout'. This is distinct from 'denied' — agents can
+ * programmatically differentiate between human denial and timeout expiry.
+ */
+import type postgres from 'postgres';
+import type { ApprovalStore } from './persistence-types.js';
+export declare class ApprovalTimeoutChecker {
+    private interval;
+    private readonly store;
+    constructor(storeOrSql: ApprovalStore | postgres.Sql);
+    /**
+     * Start checking for expired approvals every 30 seconds.
+     * The interval is unref'd so it doesn't keep the process alive.
+     */
+    start(): void;
+    /**
+     * Mark all expired pending approvals as denied_timeout.
+     * Returns the number of records updated.
+     */
+    expireTimedOut(): Promise<number>;
+    /**
+     * Stop the interval checker.
+     */
+    stop(): void;
+}

package/dist/approval-timeout.js

@@ -0,0 +1,45 @@
+/**
+ * Background job that auto-denies expired approval requests.
+ *
+ * Runs on a configurable interval (default 30 seconds) to mark pending
+ * approval requests that have passed their expires_at timestamp as
+ * 'denied_timeout'. This is distinct from 'denied' — agents can
+ * programmatically differentiate between human denial and timeout expiry.
+ */
+import { adaptApprovalStore } from './persistence.js';
+export class ApprovalTimeoutChecker {
+    interval = null;
+    store;
+    constructor(storeOrSql) {
+        this.store = adaptApprovalStore(storeOrSql);
+    }
+    /**
+     * Start checking for expired approvals every 30 seconds.
+     * The interval is unref'd so it doesn't keep the process alive.
+     */
+    start() {
+        this.interval = setInterval(() => this.expireTimedOut(), 30_000);
+        this.interval.unref();
+    }
+    /**
+     * Mark all expired pending approvals as denied_timeout.
+     * Returns the number of records updated.
+     */
+    async expireTimedOut() {
+        const count = await this.store.expireTimedOutApprovals();
+        if (count > 0) {
+            console.log(`[govyn] Auto-denied ${count} expired approval request(s)`);
+        }
+        return count;
+    }
+    /**
+     * Stop the interval checker.
+     */
+    stop() {
+        if (this.interval) {
+            clearInterval(this.interval);
+            this.interval = null;
+        }
+    }
+}
+//# sourceMappingURL=approval-timeout.js.map

package/dist/approval-timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-timeout.js","sourceRoot":"","sources":["../src/approval-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,OAAO,sBAAsB;IACzB,QAAQ,GAA0C,IAAI,CAAC;IAC9C,KAAK,CAAgB;IAEtC,YAAY,UAAwC;QAClD,IAAI,CAAC,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC;QACzD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,8BAA8B,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/approval.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Approval queue manager for the Govyn proxy.
+ *
+ * When a require_approval policy flags a request, the proxy creates an
+ * approval request in the database. Agents poll for the decision status.
+ * Once approved, the agent re-sends with a single-use approval token.
+ *
+ * Phase 14 (Approval Queue UI) will build a dashboard on top of these APIs.
+ * Until then, approvals can be resolved via direct DB updates or API calls.
+ */
+import type postgres from 'postgres';
+import type { ApprovalStore } from './persistence-types.js';
+export declare function hashApprovalRequest(body: string | Buffer | undefined): string;
+/**
+ * Generate a truncated summary of a request body for approval metadata.
+ * Extracts the first user message content or body content, truncated to maxLength chars.
+ */
+export declare function generateRequestSummary(body: string | undefined, maxLength?: number): string;
+export declare class ApprovalManager {
+    private readonly store;
+    constructor(storeOrSql: ApprovalStore | postgres.Sql);
+    /**
+     * Create a new approval request in the database.
+     * Returns the approval request ID, polling URL, and expiration time.
+     */
+    createApprovalRequest(params: {
+        agentId: string;
+        provider: string;
+        model?: string;
+        targetPath: string;
+        policyName: string;
+        policyRule?: string;
+        estimatedCost?: number;
+        requestSummary: string;
+        requestHash: string;
+        requestPayload?: unknown;
+        timeoutSeconds: number;
+    }): Promise<{
+        id: string;
+        pollingUrl: string;
+        expiresAt: string;
+    }>;
+    /**
+     * Get approval status for polling.
+     * Returns status and approval token (if approved), or null if not found.
+     */
+    getApprovalStatus(id: string): Promise<{
+        id: string;
+        status: 'pending' | 'approved' | 'denied' | 'denied_timeout';
+        approvalToken?: string;
+        decidedAt?: string;
+        expiresAt: string;
+    } | null>;
+    /**
+     * Validate an approval token for re-send flow.
+     * Atomically finds the token and marks it as used in one query.
+     * Returns the original request context if valid, null if invalid/expired/used.
+     */
+    validateAndConsumeToken(token: string, expected: {
+        agentId: string;
+        targetPath: string;
+        requestHash: string;
+    }): Promise<{
+        policyName: string;
+    } | null>;
+    /**
+     * Approve a request. Generates a single-use UUID approval token.
+     * Returns true if the request was pending and is now approved.
+     */
+    approveRequest(id: string, decidedBy: string, notes?: string): Promise<boolean>;
+    /**
+     * Deny a request. No token is generated.
+     * Returns true if the request was pending and is now denied.
+     */
+    denyRequest(id: string, decidedBy: string, notes?: string): Promise<boolean>;
+    listApprovals(statusFilters: string[], limit: number, offset: number, agentId: string | null): Promise<import("./persistence-types.js").ApprovalListResult>;
+    expireTimedOutApprovals(now?: Date): Promise<number>;
+}

package/dist/approval.js

@@ -0,0 +1,101 @@
+/**
+ * Approval queue manager for the Govyn proxy.
+ *
+ * When a require_approval policy flags a request, the proxy creates an
+ * approval request in the database. Agents poll for the decision status.
+ * Once approved, the agent re-sends with a single-use approval token.
+ *
+ * Phase 14 (Approval Queue UI) will build a dashboard on top of these APIs.
+ * Until then, approvals can be resolved via direct DB updates or API calls.
+ */
+import * as crypto from 'node:crypto';
+import { adaptApprovalStore } from './persistence.js';
+export function hashApprovalRequest(body) {
+    const data = Buffer.isBuffer(body)
+        ? body
+        : Buffer.from(body ?? '', 'utf8');
+    return crypto.createHash('sha256').update(data).digest('hex');
+}
+/**
+ * Generate a truncated summary of a request body for approval metadata.
+ * Extracts the first user message content or body content, truncated to maxLength chars.
+ */
+export function generateRequestSummary(body, maxLength = 500) {
+    if (!body)
+        return '(empty request)';
+    try {
+        const parsed = JSON.parse(body);
+        // Try to extract user message content (OpenAI/Anthropic format)
+        if (Array.isArray(parsed.messages)) {
+            for (let i = parsed.messages.length - 1; i >= 0; i--) {
+                const msg = parsed.messages[i];
+                if (msg?.role === 'user' && typeof msg.content === 'string') {
+                    const content = msg.content;
+                    if (content.length <= maxLength)
+                        return content;
+                    return content.slice(0, maxLength) + '...';
+                }
+            }
+        }
+        // Fall back to stringified body
+        const str = JSON.stringify(parsed);
+        if (str.length <= maxLength)
+            return str;
+        return str.slice(0, maxLength) + '...';
+    }
+    catch {
+        // Non-JSON body — truncate raw text
+        if (body.length <= maxLength)
+            return body;
+        return body.slice(0, maxLength) + '...';
+    }
+}
+export class ApprovalManager {
+    store;
+    constructor(storeOrSql) {
+        this.store = adaptApprovalStore(storeOrSql);
+    }
+    /**
+     * Create a new approval request in the database.
+     * Returns the approval request ID, polling URL, and expiration time.
+     */
+    async createApprovalRequest(params) {
+        return this.store.createApprovalRequest(params);
+    }
+    /**
+     * Get approval status for polling.
+     * Returns status and approval token (if approved), or null if not found.
+     */
+    async getApprovalStatus(id) {
+        return this.store.getApprovalStatus(id);
+    }
+    /**
+     * Validate an approval token for re-send flow.
+     * Atomically finds the token and marks it as used in one query.
+     * Returns the original request context if valid, null if invalid/expired/used.
+     */
+    async validateAndConsumeToken(token, expected) {
+        return this.store.validateAndConsumeToken(token, expected);
+    }
+    /**
+     * Approve a request. Generates a single-use UUID approval token.
+     * Returns true if the request was pending and is now approved.
+     */
+    async approveRequest(id, decidedBy, notes) {
+        return this.store.approveRequest(id, decidedBy, notes);
+    }
+    /**
+     * Deny a request. No token is generated.
+     * Returns true if the request was pending and is now denied.
+     */
+    async denyRequest(id, decidedBy, notes) {
+        return this.store.denyRequest(id, decidedBy, notes);
+    }
+    async listApprovals(statusFilters, limit, offset, agentId) {
+        return this.store.listApprovals(statusFilters, limit, offset, agentId);
+    }
+    async expireTimedOutApprovals(now) {
+        return this.store.expireTimedOutApprovals(now);
+    }
+}
+//# sourceMappingURL=approval.js.map

package/dist/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,UAAU,mBAAmB,CAAC,IAAiC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAEpC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB,EAAE,SAAS,GAAG,GAAG;IAC9E,IAAI,CAAC,IAAI;QAAE,OAAO,iBAAiB,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhC,gEAAgE;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,GAAG,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;oBAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS;wBAAE,OAAO,OAAO,CAAC;oBAChD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO,GAAG,CAAC;QACxC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,MAAM,OAAO,eAAe;IACT,KAAK,CAAgB;IAEtC,YAAY,UAAwC;QAClD,IAAI,CAAC,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAY3B;QACC,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAOhC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,QAAsE;QAEtE,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,EAAU,EAAE,SAAiB,EAAE,KAAc;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,SAAiB,EAAE,KAAc;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,aAAuB,EACvB,KAAa,EACb,MAAc,EACd,OAAsB;QAEtB,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,GAAU;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CACF"}