@atlasauth/pca-explain 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,55 @@
-# Temporary Holding Version
+# @atlasauth/pca-explain
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Plain-language proof traces for Proof-Carrying Authority decisions. Given a PCActn and the result of the verifier, it explains why the action was allowed or denied: which checks passed, the first failing check with a concrete fix, which capability granted the action, which caveat narrowed or failed, and the risk, threshold and budget path. It also renders an attenuation trace for a delegation chain.
+
+Everything is pure and read-only: it never re-authorizes anything and never throws, so malformed input degrades to a best-effort explanation.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-explain
+```
+
+Depends on `@atlasauth/pca`.
+
+## Usage
+
+```ts
+import { explainVerification, explainChain } from '@atlasauth/pca-explain';
+import { verifyPCActnCore } from '@atlasauth/pca';
+
+// `pcactn` and `grant` come from your PCA flow.
+const result = await verifyPCActnCore(pcactn, { grant, audience: 'ins_acme' });
+const ex = explainVerification(pcactn, result);
+
+console.log(ex.toText());
+// PCA verification - DENY
+// Denied at the "audience binding" check: aud does not match this resource server / instance
+//   ...
+//   x audience   aud does not match this resource server / instance  <- DECISIVE
+//       fix: build the action with aud = this verifier's instance id ...
+
+ex.verdict;           // 'allow' | 'deny'
+ex.decisive?.name;    // the first failing check, e.g. 'audience'
+ex.decisive?.remedy;  // what to change
+ex.passed;            // names of the checks that held
+
+console.log(explainChain([grant]).toText()); // per-hop attenuation trace
+```
+
+For the policy decision (admit, step-up or deny), pass the PCActn and the `PolicyDecision` to `explainDecision(pcactn, decision, { envelope, context })`. Supplying the envelope and the action and caveat context lets it name the granting predicate and each caveat's individual outcome; without them it falls back to the decision's own reasons. The result exposes `disposition`, `grant`, `caveats`, `risk`, `admission`, `decisive` and `summary`.
+
+## API
+
+- `explainVerification(pcactn, verifyResult, { now? })` returns a `VerificationExplanation` with `checks`, `passed`, `failed`, `notEnforced`, `decisive`, `summary` and `toText()`.
+- `explainDecision(pcactn, decision, { envelope?, context? })` returns a `DecisionExplanation`.
+- `explainChain(chain)` returns a `ChainExplanation` with per-hop `hops` and `toText()`.
+- `VERIFY_CHECK_ORDER`: the normative check order used for the trace.
+
+## Status
+
+Experimental. The explanation is derived from the verifier's own result and describes it; it is not an authorization decision, and a check shown as "not enforced" means the verifier you ran did not enforce it.
+
+## License
+
+MIT - see LICENSE

package/dist/index.d.ts

@@ -0,0 +1,202 @@
+/**
+ * `@atlasauth/pca-explain` — make PCA decisions self-explaining.
+ *
+ * A proof-carrying action is a cryptographic object: when it is allowed you want to know WHICH
+ * capability granted it and under what bound; when it is denied you want the ONE decisive reason and a
+ * concrete fix — not a boolean. This package turns the core verifier's {@link VerifyResult} (the eight
+ * normative checks) and the Policy VM's {@link PolicyDecision} (predicate / caveat / risk / budget) into
+ * a precise, human-readable proof-trace, plus an ordered attenuation trace for a delegation chain.
+ *
+ * Everything here is PURE and READ-ONLY: it consumes the REAL shapes from `@atlasauth/pca`, never
+ * re-authorizes anything, and never throws (a malformed input degrades to a best-effort explanation).
+ */
+import { type PCActn, type VerifyResult, type CheckStatus, type PolicyDecision, type Envelope, type Predicate, type Caveat, type CapabilityChain, type ActionContext, type CaveatContext, type RequiredThreshold, type TrustBudget, type BudgetAllocNode } from '@atlasauth/pca';
+export type Verdict = 'allow' | 'deny';
+/** The nine checks the offline verifier (`verifyPCActnCore`) evaluates, in NORMATIVE order. */
+export declare const VERIFY_CHECK_ORDER: readonly ["wire", "version", "audience", "validity", "cap_chain", "grant_ref_bound", "plan_inclusion", "leaf_signature", "counter"];
+export type VerifyCheckName = (typeof VERIFY_CHECK_ORDER)[number];
+/** Status of a check as presented: the core statuses plus `skipped` (a terminal earlier failure stopped evaluation). */
+export type PresentedStatus = CheckStatus | 'skipped';
+export interface CheckExplanation {
+    name: string;
+    status: PresentedStatus;
+    title: string;
+    /** What held (pass) or precisely what failed (fail), with concrete values from the PCActn. */
+    detail: string;
+    /** Present on the decisive failing check: a concrete fix. */
+    remedy?: string;
+    /** The hop index a hop-specific failure (chain / leaf signature) points at. */
+    hop?: number;
+    /** True for the FIRST failing check (the one that determined the verdict). */
+    decisive?: boolean;
+}
+export declare class VerificationExplanation {
+    readonly kind: "verification";
+    readonly verdict: Verdict;
+    readonly allow: boolean;
+    readonly checks: CheckExplanation[];
+    readonly passed: string[];
+    readonly failed: string[];
+    readonly notEnforced: string[];
+    readonly decisive: CheckExplanation | undefined;
+    readonly summary: string;
+    constructor(fields: {
+        verdict: Verdict;
+        allow: boolean;
+        checks: CheckExplanation[];
+        decisive: CheckExplanation | undefined;
+        summary: string;
+    });
+    toText(): string;
+}
+/**
+ * Explain the offline verification of a PCActn: walk the eight normative checks in order; for each PASS
+ * summarize what held, and for the FIRST failing check pinpoint it precisely (which hop's signature,
+ * which audience mismatch, which validity sub-case, counter replay, …) with a concrete remedy.
+ *
+ * `opts.now` (epoch ms) lets the `validity` pinpoint distinguish "expired" from "clock-skew" precisely;
+ * omit it and the authoritative `verifyResult.reason` is used instead.
+ */
+export declare function explainVerification(pcActn: PCActn, verifyResult: VerifyResult, opts?: {
+    now?: number;
+}): VerificationExplanation;
+export interface GrantExplanation {
+    granted: boolean;
+    /** The capability that carries the granting predicate (the root grant). */
+    capabilityId?: string;
+    /** The predicate (in the grant's envelope) that permitted (verb, resource). */
+    predicate?: Predicate;
+    predicateIndex?: number;
+    /** A readable rendering of that predicate's `where` bound. */
+    where?: string;
+    reason?: string;
+}
+export interface CaveatOutcome {
+    type: string;
+    satisfied: boolean;
+    /** The caveat's non-`type` fields — the bound it imposes / the offending value. */
+    value: Record<string, unknown>;
+    detail: string;
+    /** Present on a FAILED caveat: a concrete fix. */
+    remedy?: string;
+    /** True when this caveat came from a delegation hop, not the root grant. */
+    delegated: boolean;
+}
+export interface RiskExplanation {
+    r: number;
+    tier: 1 | 2 | 3;
+    proof: RequiredThreshold['proof'];
+    optimisticAllowed: boolean;
+    theta1?: number;
+    theta2?: number;
+    /** Which threshold band r landed in, with the boundary values. */
+    band: string;
+}
+export interface AdmissionExplanation {
+    admit: boolean;
+    needStepUp: boolean;
+    releaseGuardianShare: boolean;
+    /** c(A) = κ·r — what a metered action costs against the trust budget (when the risk policy is known). */
+    cost?: number;
+    kappa?: number;
+    /** The trust budget as returned by decide() (post-leak, post-debit if metered + released). */
+    budget: TrustBudget;
+    /** Human rendering of the admission path taken. */
+    path: string;
+}
+/** The composite context decide() was given, supplied so the explanation can pinpoint precisely. */
+export interface DecisionContext {
+    /** The action context (lets `explainDecision` name the granting predicate + evaluate `where`). */
+    action?: ActionContext;
+    /** The caveat context (now, blastRadius, reversibilityClass, delegationDepth, recentActionTimes). */
+    caveat?: CaveatContext;
+    /** The delegation chain decide() evaluated — for delegated (post-grant) caveats. */
+    chain?: CapabilityChain;
+}
+export declare class DecisionExplanation {
+    readonly kind: "decision";
+    readonly verdict: Verdict;
+    /** auto-admit (no human), step-up (guardian/human co-sign needed), or denied (guardian share withheld). */
+    readonly disposition: 'auto-admit' | 'step-up' | 'denied';
+    readonly grant: GrantExplanation;
+    readonly caveats: CaveatOutcome[];
+    readonly risk: RiskExplanation;
+    readonly admission: AdmissionExplanation;
+    /** The single decisive reason (and remedy) when not auto-admitted. */
+    readonly decisive: {
+        reason: string;
+        remedy?: string;
+    } | undefined;
+    readonly reasons: string[];
+    readonly summary: string;
+    constructor(fields: {
+        verdict: Verdict;
+        disposition: 'auto-admit' | 'step-up' | 'denied';
+        grant: GrantExplanation;
+        caveats: CaveatOutcome[];
+        risk: RiskExplanation;
+        admission: AdmissionExplanation;
+        decisive: {
+            reason: string;
+            remedy?: string;
+        } | undefined;
+        reasons: string[];
+        summary: string;
+    });
+    toText(): string;
+}
+/**
+ * Explain a Policy-VM decision: which capability/predicate granted the (verb, resource) and under what
+ * `where` bound; which caveats were evaluated and which one (with its type + offending value) narrowed
+ * or DENIED; the risk value r, the threshold band/tier it landed in, and the budget/admission path
+ * (cost vs budget). For anything short of auto-admit it names the single decisive reason + remedy.
+ *
+ * Supply `opts.envelope` and `opts.context` to pinpoint precisely (the granting predicate and each
+ * caveat's individual outcome are re-derived from the REAL evaluators); without them it falls back to
+ * the decision's own `reasons`.
+ */
+export declare function explainDecision(pcActn: PCActn, decision: PolicyDecision, opts?: {
+    envelope?: Envelope;
+    context?: DecisionContext;
+}): DecisionExplanation;
+export interface HopExplanation {
+    index: number;
+    isRoot: boolean;
+    issuer: string;
+    holder: string;
+    issuerShort: string;
+    holderShort: string;
+    alg: string;
+    /** Caveats introduced AT this hop (the diff against the parent's caveat prefix). */
+    addedCaveats: Caveat[];
+    addedCaveatTypes: string[];
+    /** B_sub carried by a `budget_alloc` added at this hop, if any. */
+    budgetAlloc?: number;
+    /** Human summary of what this hop granted / narrowed. */
+    narrowed: string;
+}
+export declare class ChainExplanation {
+    readonly kind: "chain";
+    readonly depth: number;
+    readonly hops: HopExplanation[];
+    readonly rootIssuer: string | undefined;
+    readonly leafHolder: string | undefined;
+    readonly budgetNodes: BudgetAllocNode[];
+    readonly summary: string;
+    constructor(fields: {
+        depth: number;
+        hops: HopExplanation[];
+        rootIssuer: string | undefined;
+        leafHolder: string | undefined;
+        budgetNodes: BudgetAllocNode[];
+        summary: string;
+    });
+    toText(): string;
+}
+/**
+ * Render a capability delegation chain as an ordered attenuation trace: issuer→holder per hop and what
+ * each hop narrowed (caveats added, budget sub-allocation), so a developer can see how authority flowed
+ * from the principal's root grant down to the acting leaf and shrank at every hop. Read-only; does not
+ * verify signatures (run `verifyChain` for that).
+ */
+export declare function explainChain(chain: CapabilityChain): ChainExplanation;

package/dist/index.js

@@ -0,0 +1,714 @@
+"use strict";
+/**
+ * `@atlasauth/pca-explain` — make PCA decisions self-explaining.
+ *
+ * A proof-carrying action is a cryptographic object: when it is allowed you want to know WHICH
+ * capability granted it and under what bound; when it is denied you want the ONE decisive reason and a
+ * concrete fix — not a boolean. This package turns the core verifier's {@link VerifyResult} (the eight
+ * normative checks) and the Policy VM's {@link PolicyDecision} (predicate / caveat / risk / budget) into
+ * a precise, human-readable proof-trace, plus an ordered attenuation trace for a delegation chain.
+ *
+ * Everything here is PURE and READ-ONLY: it consumes the REAL shapes from `@atlasauth/pca`, never
+ * re-authorizes anything, and never throws (a malformed input degrades to a best-effort explanation).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChainExplanation = exports.DecisionExplanation = exports.VerificationExplanation = exports.VERIFY_CHECK_ORDER = void 0;
+exports.explainVerification = explainVerification;
+exports.explainDecision = explainDecision;
+exports.explainChain = explainChain;
+const pca_1 = require("@atlasauth/pca");
+// ---- shared helpers -------------------------------------------------------------------------------
+/** Abbreviate a long b64u key for display: first `n` chars + an ellipsis. */
+function short(key, n = 10) {
+    if (typeof key !== 'string' || key.length === 0)
+        return '<none>';
+    return key.length <= n + 1 ? key : `${key.slice(0, n)}…`;
+}
+/** Compact number: integers stay integers, fractions round to 4 dp (trailing zeros trimmed). */
+function num(x) {
+    if (typeof x !== 'number' || !Number.isFinite(x))
+        return String(x);
+    if (Number.isInteger(x))
+        return String(x);
+    return String(Math.round(x * 1e4) / 1e4);
+}
+/** A one-line, bounded rendering of a caveat's non-`type` fields (the "offending value"). */
+function valueSummary(rest) {
+    const parts = [];
+    for (const k of Object.keys(rest).slice(0, 6)) {
+        const v = rest[k];
+        parts.push(`${k}=${typeof v === 'object' && v !== null ? JSON.stringify(v) : num(v)}`);
+    }
+    return parts.join(', ');
+}
+/** Split a caveat into its type tag and the rest of its fields. */
+function caveatParts(cv) {
+    const type = typeof cv?.type === 'string' ? cv.type : '<malformed>';
+    const rest = {};
+    if (cv !== null && typeof cv === 'object') {
+        for (const k of Object.keys(cv))
+            if (k !== 'type')
+                rest[k] = cv[k];
+    }
+    return { type, rest };
+}
+/** Compact, depth-bounded rendering of a `where` condition (leaf or boolean grouping). */
+function condToText(c, depth = 0) {
+    if (c === null || typeof c !== 'object')
+        return '<malformed>';
+    if (depth > 6)
+        return '…';
+    if ('all_of' in c && Array.isArray(c.all_of))
+        return `(${c.all_of.map((x) => condToText(x, depth + 1)).join(' AND ')})`;
+    if ('any_of' in c && Array.isArray(c.any_of))
+        return `(${c.any_of.map((x) => condToText(x, depth + 1)).join(' OR ')})`;
+    if ('not' in c)
+        return `NOT ${condToText(c.not, depth + 1)}`;
+    const leaf = c;
+    const operand = leaf.ref !== undefined ? `→${String(leaf.ref)}` : 'value' in leaf ? num(leaf.value) : '';
+    return `${String(leaf.field)} ${String(leaf.op)} ${operand}`.trim();
+}
+function whereSummary(where) {
+    if (!Array.isArray(where) || where.length === 0)
+        return 'any (no where-bound)';
+    return where.map((c) => condToText(c)).join(' AND ');
+}
+// =================================================================================================
+// explainVerification — walk the nine normative checks
+// =================================================================================================
+/** The nine checks the offline verifier (`verifyPCActnCore`) evaluates, in NORMATIVE order. */
+exports.VERIFY_CHECK_ORDER = [
+    'wire',
+    'version',
+    'audience',
+    'validity',
+    'cap_chain',
+    'grant_ref_bound',
+    'plan_inclusion',
+    'leaf_signature',
+    'counter',
+];
+const CHECK_TITLE = {
+    wire: 'wire format',
+    version: 'version',
+    audience: 'audience binding',
+    validity: 'freshness window',
+    cap_chain: 'capability chain',
+    grant_ref_bound: 'grant reference binding',
+    plan_inclusion: 'plan inclusion',
+    leaf_signature: 'leaf signature',
+    counter: 'counter',
+    plan_root_authorized: 'plan-root authorization',
+    taint_gate: 'taint gate',
+    attestation: 'agent attestation',
+    threshold: 'threshold signature',
+    revocation: 'revocation',
+    zk_compliance: 'zk compliance',
+    bond: 'bond',
+    malformed: 'structure',
+};
+function reasonTail(name, verifyResult) {
+    const r = verifyResult.reason;
+    if (typeof r !== 'string')
+        return undefined;
+    const pre = `${name}: `;
+    return r.startsWith(pre) ? r.slice(pre.length) : undefined;
+}
+function validityPinpoint(p, now) {
+    const lifetime = p.exp - p.iat;
+    if (!(p.exp > p.iat)) {
+        return { detail: `exp ${p.exp} ≤ iat ${p.iat}: empty validity window`, remedy: 'set exp strictly greater than iat.' };
+    }
+    if (lifetime > pca_1.PCACTN_MAX_LIFETIME_MS) {
+        return {
+            detail: `lifetime ${lifetime}ms exceeds the ${pca_1.PCACTN_MAX_LIFETIME_MS}ms maximum`,
+            remedy: `shorten the window to ≤ ${pca_1.PCACTN_MAX_LIFETIME_MS}ms (buildPCActn ttlMs).`,
+        };
+    }
+    if (now !== undefined) {
+        if (p.iat > now + pca_1.PCACTN_MAX_SKEW_MS) {
+            return {
+                detail: `iat ${p.iat} is ${p.iat - now}ms in the future (> ${pca_1.PCACTN_MAX_SKEW_MS}ms clock-skew allowance)`,
+                remedy: 'fix the signer clock; do not pre-date actions.',
+            };
+        }
+        if (now > p.exp) {
+            return {
+                detail: `expired ${now - p.exp}ms ago (exp ${p.exp}, now ${now})`,
+                remedy: 'build a fresh action — a PCActn lifetime is short by design.',
+            };
+        }
+    }
+    return { detail: 'validity window invalid', remedy: 'build a fresh action with a valid iat/exp window.' };
+}
+function capChainPinpoint(p) {
+    const chain = p.cap_chain;
+    const res = Array.isArray(chain) ? (0, pca_1.verifyChain)(chain) : { ok: false, reason: 'cap_chain is not an array' };
+    const reason = res.ok ? 'chain root is not the grant this verifier expects' : (res.reason ?? 'capability chain invalid');
+    let hop;
+    const m = /hop (\d+)/.exec(reason);
+    if (m && m[1] !== undefined)
+        hop = Number(m[1]);
+    let remedy = 'rebuild the chain: each hop must be signed by the parent’s bound holder and may only APPEND caveats.';
+    if (reason.includes('root issuer') || reason.includes('not the grant')) {
+        remedy = 'root the chain at the principal key that minted the grant.';
+    }
+    else if (reason.includes('widens')) {
+        remedy = 'a child budget_alloc may not exceed its parent’s carried allocation; lower the sub-allocation.';
+    }
+    else if (reason.includes('caveat')) {
+        remedy = 'attenuation is append-only: never drop, reorder or edit a parent caveat.';
+    }
+    else if (reason.includes('signature')) {
+        remedy = 're-sign that hop with the parent holder’s secret key (and matching alg/pq_pk for a PQ suite).';
+    }
+    return hop === undefined ? { detail: reason, remedy } : { detail: reason, remedy, hop };
+}
+function leafSigPinpoint(p) {
+    const chain = p.cap_chain;
+    const idx = Array.isArray(chain) ? chain.length - 1 : -1;
+    const leaf = idx >= 0 ? chain[idx] : undefined;
+    const alg = p.alg ?? 'ed25519';
+    const remedy = 'sign thresholdMessage(body) with the LEAF holder’s secret key; for a PQ/hybrid suite set alg + pq_pk/pq_sig to match the holder.';
+    if (!leaf)
+        return { detail: 'no leaf capability to check the signature against (empty/invalid chain)', remedy };
+    const base = { detail: `leaf hop #${idx} signature (holder ${short(leaf.holder)}, suite ${alg}) does not verify`, remedy };
+    return idx >= 0 ? { ...base, hop: idx } : base;
+}
+/** Pinpoint the decisive (first failing) check with a concrete detail + remedy. */
+function pinpoint(name, p, verifyResult, now) {
+    const tail = reasonTail(name, verifyResult);
+    switch (name) {
+        case 'wire':
+            return { detail: tail ?? 'wire structure / strict-canonical-form check failed', remedy: 'do not hand-edit the wire JSON; re-encode via encodePCActn with the current SDK.' };
+        case 'version':
+            return { detail: tail ?? `unsupported ver ${num(p.ver)} (verifier requires ${pca_1.PCACTN_VERSION})`, remedy: `re-mint the action at wire version ${pca_1.PCACTN_VERSION}.` };
+        case 'audience':
+            return { detail: tail ?? `aud ${JSON.stringify(p.aud)} does not match this resource server / instance`, remedy: 'build the action with aud = this verifier’s instance id (or verify with audience:null to accept any).' };
+        case 'validity': {
+            const v = validityPinpoint(p, now);
+            return { detail: tail ?? v.detail, remedy: v.remedy };
+        }
+        case 'cap_chain': {
+            const c = capChainPinpoint(p);
+            return { detail: tail ?? c.detail, ...(c.hop !== undefined ? { hop: c.hop } : {}), remedy: c.remedy };
+        }
+        case 'grant_ref_bound':
+            return {
+                detail: tail ?? `grant_ref ${short(p.grant_ref)} is not the id of the root capability in cap_chain`,
+                remedy: 'set grant_ref to the id of the chain root (cap_chain[0].id); buildPCActn does this from the grant.',
+            };
+        case 'plan_inclusion':
+            return {
+                detail: tail ?? `action (verb ${JSON.stringify(p.action?.verb)} on ${JSON.stringify(p.action?.resource)}) is not node ${JSON.stringify(p.plan?.node_id)} of committed plan ${short(p.plan?.root)}`,
+                remedy: 'rebuild the PCActn from a committed plan node whose verb/resource/params match (buildPCActn).',
+            };
+        case 'leaf_signature': {
+            const l = leafSigPinpoint(p);
+            return { detail: tail ?? l.detail, ...(l.hop !== undefined ? { hop: l.hop } : {}), remedy: l.remedy };
+        }
+        case 'counter':
+            return { detail: tail ?? `counter ${num(p.counter)} is missing or not a non-negative safe integer`, remedy: 'use a strictly increasing per-holder counter; a repeated counter is a replay.' };
+        case 'malformed':
+            return { detail: tail ?? 'the PCActn is structurally malformed', remedy: 'rebuild the action with the SDK; do not construct the wire object by hand.' };
+        default:
+            return { detail: tail ?? `${name} check failed`, remedy: `satisfy the ${name} requirement (supply the corresponding verifier hook / proof).` };
+    }
+}
+/** What held, for a PASS (concise, with the concrete value from the PCActn). */
+function passDetail(name, p) {
+    switch (name) {
+        case 'wire':
+            return 'wire structure + strict canonical form valid';
+        case 'version':
+            return `ver ${num(p.ver)} supported`;
+        case 'audience':
+            return `aud ${JSON.stringify(p.aud)} matches this resource server`;
+        case 'validity':
+            return `fresh: iat/exp window valid (lifetime ${num((p.exp - p.iat) / 1000)}s)`;
+        case 'cap_chain': {
+            const chain = p.cap_chain;
+            const len = Array.isArray(chain) ? chain.length : 0;
+            const root = Array.isArray(chain) ? chain[0] : undefined;
+            return `${len}-hop chain verifies; root issuer ${short(root?.issuer)}`;
+        }
+        case 'grant_ref_bound':
+            return `grant_ref ${short(p.grant_ref)} is the id of the chain root`;
+        case 'plan_inclusion':
+            return `action is node ${JSON.stringify(p.plan?.node_id)} of committed plan ${short(p.plan?.root)}`;
+        case 'leaf_signature': {
+            const chain = p.cap_chain;
+            const leaf = Array.isArray(chain) && chain.length > 0 ? chain[chain.length - 1] : undefined;
+            return `leaf holder ${short(leaf?.holder)} signature valid (suite ${p.alg ?? 'ed25519'})`;
+        }
+        case 'counter':
+            return `counter ${num(p.counter)} well-formed`;
+        default:
+            return 'ok';
+    }
+}
+class VerificationExplanation {
+    kind = 'verification';
+    verdict;
+    allow;
+    checks;
+    passed;
+    failed;
+    notEnforced;
+    decisive;
+    summary;
+    constructor(fields) {
+        this.verdict = fields.verdict;
+        this.allow = fields.allow;
+        this.checks = fields.checks;
+        this.passed = fields.checks.filter((c) => c.status === 'pass').map((c) => c.name);
+        this.failed = fields.checks.filter((c) => c.status === 'fail').map((c) => c.name);
+        this.notEnforced = fields.checks.filter((c) => c.status === 'not-enforced').map((c) => c.name);
+        this.decisive = fields.decisive;
+        this.summary = fields.summary;
+    }
+    toText() {
+        const glyph = { pass: '✓', fail: '✗', 'not-enforced': '·', skipped: '–' };
+        const lines = [];
+        lines.push(`PCA verification — ${this.verdict.toUpperCase()}`);
+        lines.push(this.summary);
+        lines.push('');
+        for (const c of this.checks) {
+            const mark = c.decisive ? ' ◀ DECISIVE' : '';
+            lines.push(`  ${glyph[c.status]} ${c.name.padEnd(16)} ${c.detail}${mark}`);
+            if (c.decisive && c.remedy)
+                lines.push(`      ↳ fix: ${c.remedy}`);
+        }
+        return lines.join('\n');
+    }
+}
+exports.VerificationExplanation = VerificationExplanation;
+/**
+ * Explain the offline verification of a PCActn: walk the eight normative checks in order; for each PASS
+ * summarize what held, and for the FIRST failing check pinpoint it precisely (which hop's signature,
+ * which audience mismatch, which validity sub-case, counter replay, …) with a concrete remedy.
+ *
+ * `opts.now` (epoch ms) lets the `validity` pinpoint distinguish "expired" from "clock-skew" precisely;
+ * omit it and the authoritative `verifyResult.reason` is used instead.
+ */
+function explainVerification(pcActn, verifyResult, opts = {}) {
+    const statuses = verifyResult?.checks ?? {};
+    const seen = new Set();
+    const ordered = [];
+    for (const n of exports.VERIFY_CHECK_ORDER) {
+        ordered.push(n);
+        seen.add(n);
+    }
+    // Later-milestone / extra checks (plan_root_authorized, taint_gate, attestation, …, malformed) appended.
+    for (const n of Object.keys(statuses))
+        if (!seen.has(n))
+            ordered.push(n);
+    // The decisive check: the first (in normative order) that FAILED.
+    let decisiveName;
+    for (const n of ordered) {
+        if (statuses[n] === 'fail') {
+            decisiveName = n;
+            break;
+        }
+    }
+    const checks = [];
+    let decisive;
+    for (const name of ordered) {
+        const raw = statuses[name];
+        const status = raw ?? 'skipped';
+        const title = CHECK_TITLE[name] ?? name;
+        let detail;
+        let remedy;
+        let hop;
+        if (status === 'fail') {
+            const pin = pinpoint(name, pcActn, verifyResult, opts.now);
+            detail = pin.detail;
+            remedy = pin.remedy;
+            hop = pin.hop;
+        }
+        else if (status === 'pass') {
+            detail = passDetail(name, pcActn);
+        }
+        else if (status === 'not-enforced') {
+            detail = 'not enforced by this verifier (no hook / opt-out)';
+        }
+        else {
+            detail = 'not reached (a terminal earlier check stopped evaluation)';
+        }
+        const entry = { name, status, title, detail };
+        if (remedy !== undefined)
+            entry.remedy = remedy;
+        if (hop !== undefined)
+            entry.hop = hop;
+        if (name === decisiveName) {
+            entry.decisive = true;
+            decisive = entry;
+        }
+        checks.push(entry);
+    }
+    const verdict = verifyResult?.allow ? 'allow' : 'deny';
+    const summary = verdict === 'allow'
+        ? `All ${checks.filter((c) => c.status === 'pass').length} evaluated checks passed (no check failed).`
+        : decisive
+            ? `Denied at the "${decisive.title}" check: ${decisive.detail}`
+            : `Denied: ${verifyResult?.reason ?? 'a check failed'}`;
+    return new VerificationExplanation({ verdict, allow: !!verifyResult?.allow, checks, decisive, summary });
+}
+function caveatRemedy(type, rest) {
+    switch (type) {
+        case 'expires':
+            return `the grant expired at ${num(rest.at)} (epoch ms); obtain a fresh grant or re-mint with a later 'expires'.`;
+        case 'not_before':
+            return `the grant is not valid until ${num(rest.at)} (epoch ms); retry after that time.`;
+        case 'rate':
+            return `rate limit ${num(rest.max)}/${num(rest.per_secs)}s reached; wait for the window to clear or raise the 'rate' caveat.`;
+        case 'max_blast_radius':
+            return `the action's blast radius exceeds the caveat max ${num(rest.max)}; narrow the action or raise 'max_blast_radius'.`;
+        case 'reversibility_max':
+            return `the action is more severe than the allowed class '${String(rest.class)}'; only that class or lower is permitted.`;
+        case 'delegation_depth':
+            return `delegation depth exceeds max ${num(rest.max)}; act from a shallower hop or raise 'delegation_depth'.`;
+        default:
+            return `caveat '${type}' is not satisfied; check its parameters against the action/context.`;
+    }
+}
+function caveatDetail(type, rest, satisfied) {
+    const bound = valueSummary(rest);
+    const verb = satisfied ? 'held' : 'NARROWED/DENIED';
+    return bound.length > 0 ? `${type}(${bound}) ${verb}` : `${type} ${verb}`;
+}
+/** Parse the caveat types decide() reported as failed, from its `reasons` (grant + delegated). */
+function failedCaveatTypesFromReasons(reasons) {
+    const out = new Set();
+    for (const r of reasons) {
+        const m = /caveat\(s\) not satisfied: (.+)$/.exec(r);
+        if (m && m[1] !== undefined)
+            for (const t of m[1].split(','))
+                if (t.trim())
+                    out.add(t.trim());
+    }
+    return out;
+}
+function riskBand(r, theta1, theta2, tier) {
+    if (theta1 === undefined || theta2 === undefined)
+        return `effective tier t=${tier}`;
+    if (r <= theta1)
+        return `r ${num(r)} ≤ θ1 ${num(theta1)} → claim band (t=1)`;
+    if (r <= theta2)
+        return `θ1 ${num(theta1)} < r ${num(r)} ≤ θ2 ${num(theta2)} → standard band (t=2)`;
+    return `r ${num(r)} > θ2 ${num(theta2)} → strong band (t=3)`;
+}
+class DecisionExplanation {
+    kind = 'decision';
+    verdict;
+    /** auto-admit (no human), step-up (guardian/human co-sign needed), or denied (guardian share withheld). */
+    disposition;
+    grant;
+    caveats;
+    risk;
+    admission;
+    /** The single decisive reason (and remedy) when not auto-admitted. */
+    decisive;
+    reasons;
+    summary;
+    constructor(fields) {
+        this.verdict = fields.verdict;
+        this.disposition = fields.disposition;
+        this.grant = fields.grant;
+        this.caveats = fields.caveats;
+        this.risk = fields.risk;
+        this.admission = fields.admission;
+        this.decisive = fields.decisive;
+        this.reasons = fields.reasons;
+        this.summary = fields.summary;
+    }
+    toText() {
+        const lines = [];
+        lines.push(`PCA decision — ${this.verdict.toUpperCase()} (${this.disposition})`);
+        lines.push(this.summary);
+        lines.push('');
+        // Authority
+        if (this.grant.granted && this.grant.predicate) {
+            const p = this.grant.predicate;
+            const verbs = Array.isArray(p.verb) ? p.verb.join('|') : String(p.verb);
+            lines.push(`  authority : predicate #${this.grant.predicateIndex} of grant ${short(this.grant.capabilityId)} grants ${verbs} on ${p.resource ?? '*'}`);
+            lines.push(`              where ${this.grant.where}`);
+        }
+        else {
+            lines.push(`  authority : NOT granted — ${this.grant.reason ?? 'no predicate permits this action'}`);
+        }
+        // Caveats
+        if (this.caveats.length === 0) {
+            lines.push('  caveats   : none');
+        }
+        else {
+            for (const c of this.caveats) {
+                const mark = c.satisfied ? '✓' : '✗';
+                const src = c.delegated ? ' [delegated]' : '';
+                lines.push(`  caveat ${mark}  : ${c.detail}${src}`);
+                if (!c.satisfied && c.remedy)
+                    lines.push(`              ↳ fix: ${c.remedy}`);
+            }
+        }
+        // Risk / tier / budget
+        lines.push(`  risk      : ${this.risk.band}; proof=${this.risk.proof}, optimistic=${this.risk.optimisticAllowed}`);
+        const a = this.admission;
+        const costStr = a.cost !== undefined ? `, cost κ·r=${num(a.cost)} (κ=${num(a.kappa)})` : '';
+        lines.push(`  budget    : ${a.path}${costStr}; B after=${num(a.budget.B)}`);
+        if (this.decisive) {
+            lines.push('');
+            lines.push(`  ◀ DECISIVE: ${this.decisive.reason}`);
+            if (this.decisive.remedy)
+                lines.push(`      ↳ fix: ${this.decisive.remedy}`);
+        }
+        return lines.join('\n');
+    }
+}
+exports.DecisionExplanation = DecisionExplanation;
+/**
+ * Explain a Policy-VM decision: which capability/predicate granted the (verb, resource) and under what
+ * `where` bound; which caveats were evaluated and which one (with its type + offending value) narrowed
+ * or DENIED; the risk value r, the threshold band/tier it landed in, and the budget/admission path
+ * (cost vs budget). For anything short of auto-admit it names the single decisive reason + remedy.
+ *
+ * Supply `opts.envelope` and `opts.context` to pinpoint precisely (the granting predicate and each
+ * caveat's individual outcome are re-derived from the REAL evaluators); without them it falls back to
+ * the decision's own `reasons`.
+ */
+function explainDecision(pcActn, decision, opts = {}) {
+    const env = opts.envelope;
+    const ctx = opts.context ?? {};
+    const reasons = Array.isArray(decision?.reasons) ? decision.reasons : [];
+    // Disposition + verdict. `admit` = autonomous allow (no human). Otherwise step-up (guardian share
+    // released but a co-sign is needed) or denied (policy not satisfied, share withheld).
+    const disposition = decision.admit
+        ? 'auto-admit'
+        : decision.releaseGuardianShare
+            ? 'step-up'
+            : 'denied';
+    const verdict = decision.admit ? 'allow' : 'deny';
+    // ---- authority: the granting predicate ----
+    const grant = { granted: decision.releaseGuardianShare };
+    const rootCap = ctx.chain?.[0];
+    if (rootCap)
+        grant.capabilityId = rootCap.id;
+    if (env && ctx.action) {
+        const pr = (0, pca_1.evaluatePredicates)(env.predicates, ctx.action);
+        if (pr.allowed && pr.matched) {
+            grant.granted = true;
+            grant.predicate = pr.matched;
+            grant.predicateIndex = env.predicates.indexOf(pr.matched);
+            grant.where = whereSummary(pr.matched.where);
+        }
+        else {
+            grant.granted = false;
+            grant.reason = pr.reason ?? 'no predicate permits this action';
+        }
+    }
+    else if (!decision.releaseGuardianShare) {
+        grant.reason = reasons.find((r) => r.includes('predicate') || r.includes('not permitted')) ?? undefined;
+    }
+    // ---- caveats: per-caveat outcome ----
+    const caveats = [];
+    const failedFromReasons = failedCaveatTypesFromReasons(reasons);
+    const canEvalIndividually = env !== undefined && ctx.caveat !== undefined && ctx.action !== undefined;
+    const grantCaveats = env?.caveats ?? [];
+    // Delegated caveats mirror decide()'s `extra`: the LEAF capability's top-level caveats beyond the
+    // ROOT capability's count (NOT the envelope's inner caveat count — those are the grant's semantic caveats).
+    const rootCapCaveatCount = ctx.chain?.[0]?.caveats.length ?? 0;
+    const delegatedCaveats = ctx.chain && ctx.chain.length > 1
+        ? (ctx.chain[ctx.chain.length - 1]?.caveats ?? []).slice(rootCapCaveatCount)
+        : [];
+    const classify = (cv, delegated) => {
+        const { type, rest } = caveatParts(cv);
+        let satisfied;
+        if (canEvalIndividually && ctx.caveat && ctx.action) {
+            satisfied = (0, pca_1.evaluateAgentCaveats)([cv], ctx.caveat, ctx.action).ok;
+        }
+        else {
+            // Fall back to the decision's reasons: a type named as failed is unsatisfied; otherwise, if the
+            // decision released the guardian share (policy OK), every caveat held.
+            satisfied = failedFromReasons.has(type) ? false : decision.releaseGuardianShare;
+        }
+        const outcome = { type, satisfied, value: rest, detail: caveatDetail(type, rest, satisfied), delegated };
+        if (!satisfied)
+            outcome.remedy = caveatRemedy(type, rest);
+        return outcome;
+    };
+    for (const cv of grantCaveats)
+        caveats.push(classify(cv, false));
+    for (const cv of delegatedCaveats)
+        caveats.push(classify(cv, true));
+    // ---- risk / tier ----
+    const rt = decision.requiredThreshold;
+    const risk = {
+        r: decision.r,
+        tier: rt.t,
+        proof: rt.proof,
+        optimisticAllowed: rt.optimisticAllowed,
+        band: riskBand(decision.r, env?.risk_policy.theta1, env?.risk_policy.theta2, rt.t),
+    };
+    if (env) {
+        risk.theta1 = env.risk_policy.theta1;
+        risk.theta2 = env.risk_policy.theta2;
+    }
+    // ---- admission / budget ----
+    const kappa = env?.risk_policy.kappa;
+    const costVal = kappa !== undefined ? (0, pca_1.cost)(decision.r, kappa) : undefined;
+    const budgetDepleted = reasons.some((r) => r.includes('budget depleted'));
+    let path;
+    if (decision.admit) {
+        path = `auto-admitted at t=${rt.t} (${rt.proof}); metered`;
+    }
+    else if (!decision.releaseGuardianShare) {
+        path = 'guardian share withheld — policy not satisfied (no autonomous or guardian path)';
+    }
+    else if (budgetDepleted) {
+        path = `trust budget cannot cover the cost — step-up to t=3 (human recharge) required`;
+    }
+    else {
+        path = `step-up to t=${rt.t} (${rt.proof}) co-signature required`;
+    }
+    const admission = {
+        admit: decision.admit,
+        needStepUp: decision.needStepUp,
+        releaseGuardianShare: decision.releaseGuardianShare,
+        budget: decision.budget,
+        path,
+    };
+    if (costVal !== undefined)
+        admission.cost = costVal;
+    if (kappa !== undefined)
+        admission.kappa = kappa;
+    // ---- the single decisive reason ----
+    let decisive;
+    if (!decision.admit) {
+        if (!grant.granted) {
+            decisive = { reason: grant.reason ?? 'action not permitted by the envelope predicates (default-deny)', remedy: 'grant a predicate that permits this verb+resource (and satisfies its where bound).' };
+        }
+        else {
+            const firstFailed = caveats.find((c) => !c.satisfied);
+            if (firstFailed) {
+                decisive = { reason: `caveat '${firstFailed.type}' narrowed the authority away: ${firstFailed.detail}`, ...(firstFailed.remedy ? { remedy: firstFailed.remedy } : {}) };
+            }
+            else if (budgetDepleted) {
+                decisive = { reason: `risk ${num(decision.r)} is admissible but the trust budget cannot cover cost κ·r${costVal !== undefined ? `=${num(costVal)}` : ''}`, remedy: 'recharge the budget with a human co-sign, or lower the action risk.' };
+            }
+            else {
+                decisive = { reason: `risk ${num(decision.r)} exceeds the auto threshold → step-up to t=${rt.t} (${rt.proof})`, remedy: rt.t === 3 ? 'obtain a human step-up co-signature.' : 'obtain the guardian/principal co-signature for this tier.' };
+            }
+        }
+    }
+    const summary = decision.admit
+        ? `Auto-admitted: ${grant.predicate ? `predicate #${grant.predicateIndex}` : 'policy'} grants it, all caveats held, risk r=${num(decision.r)} is in the t=${rt.t} band and the budget covers it.`
+        : decisive
+            ? `${verdict === 'deny' && disposition === 'denied' ? 'Denied' : 'Needs step-up'}: ${decisive.reason}`
+            : `Not auto-admitted (t=${rt.t}).`;
+    return new DecisionExplanation({ verdict, disposition, grant, caveats, risk, admission, decisive, reasons, summary });
+}
+function hopNarrowedSummary(isRoot, added) {
+    const bits = [];
+    for (const cv of added) {
+        const { type, rest } = caveatParts(cv);
+        if (type === 'envelope') {
+            const predicates = Array.isArray(rest.predicates) ? rest.predicates.length : 0;
+            const innerCaveats = Array.isArray(rest.caveats) ? rest.caveats.length : 0;
+            bits.push(`envelope (${predicates} predicate(s), ${innerCaveats} caveat(s))`);
+        }
+        else if ((0, pca_1.isBudgetAllocCaveat)(cv)) {
+            bits.push(`budget_alloc(B_sub=${num(cv.limit)})`);
+        }
+        else {
+            const bound = valueSummary(rest);
+            bits.push(bound ? `+${type}(${bound})` : `+${type}`);
+        }
+    }
+    if (bits.length === 0)
+        return isRoot ? 'root grant (no caveats)' : 'rebind only (no new caveats)';
+    return (isRoot ? 'grants ' : 'narrows: ') + bits.join(', ');
+}
+class ChainExplanation {
+    kind = 'chain';
+    depth;
+    hops;
+    rootIssuer;
+    leafHolder;
+    budgetNodes;
+    summary;
+    constructor(fields) {
+        this.depth = fields.depth;
+        this.hops = fields.hops;
+        this.rootIssuer = fields.rootIssuer;
+        this.leafHolder = fields.leafHolder;
+        this.budgetNodes = fields.budgetNodes;
+        this.summary = fields.summary;
+    }
+    toText() {
+        const lines = [];
+        lines.push(`PCA delegation chain — ${this.depth} hop(s) (attenuation trace)`);
+        lines.push(this.summary);
+        lines.push('');
+        for (const h of this.hops) {
+            const tag = h.isRoot ? 'root ' : 'deleg';
+            lines.push(`  #${h.index} ${tag} ${h.issuerShort} ──▶ ${h.holderShort}   ${h.narrowed}`);
+        }
+        if (this.budgetNodes.length > 0) {
+            const tree = this.budgetNodes.map((n) => `depth ${n.depth} B_sub=${num(n.limit)}`).join(' → ');
+            lines.push('');
+            lines.push(`  budget subtree: ${tree}`);
+        }
+        return lines.join('\n');
+    }
+}
+exports.ChainExplanation = ChainExplanation;
+/**
+ * Render a capability delegation chain as an ordered attenuation trace: issuer→holder per hop and what
+ * each hop narrowed (caveats added, budget sub-allocation), so a developer can see how authority flowed
+ * from the principal's root grant down to the acting leaf and shrank at every hop. Read-only; does not
+ * verify signatures (run `verifyChain` for that).
+ */
+function explainChain(chain) {
+    const hops = [];
+    const safeChain = Array.isArray(chain) ? chain : [];
+    for (let i = 0; i < safeChain.length; i++) {
+        const cap = safeChain[i];
+        if (!cap)
+            continue;
+        const isRoot = i === 0;
+        const parent = i > 0 ? safeChain[i - 1] : undefined;
+        const parentLen = parent && Array.isArray(parent.caveats) ? parent.caveats.length : 0;
+        const own = Array.isArray(cap.caveats) ? cap.caveats : [];
+        const added = isRoot ? own : own.length >= parentLen ? own.slice(parentLen) : [];
+        const budgetCv = added.find((cv) => (0, pca_1.isBudgetAllocCaveat)(cv));
+        const hop = {
+            index: i,
+            isRoot,
+            issuer: cap.issuer,
+            holder: cap.holder,
+            issuerShort: short(cap.issuer),
+            holderShort: short(cap.holder),
+            alg: cap.alg ?? 'ed25519',
+            addedCaveats: added,
+            addedCaveatTypes: added.map((cv) => caveatParts(cv).type),
+            narrowed: hopNarrowedSummary(isRoot, added),
+        };
+        if (budgetCv && (0, pca_1.isBudgetAllocCaveat)(budgetCv))
+            hop.budgetAlloc = budgetCv.limit;
+        hops.push(hop);
+    }
+    const root = safeChain[0];
+    const leaf = safeChain.length > 0 ? safeChain[safeChain.length - 1] : undefined;
+    const budgetNodes = (0, pca_1.budgetAllocNodes)(safeChain);
+    const summary = safeChain.length === 0
+        ? 'empty chain (no authority)'
+        : `${short(root?.issuer)} (principal) delegated through ${safeChain.length - 1} hop(s) to the acting holder ${short(leaf?.holder)}; ${budgetNodes.length} budget node(s).`;
+    return new ChainExplanation({
+        depth: safeChain.length,
+        hops,
+        rootIssuer: root?.issuer,
+        leafHolder: leaf?.holder,
+        budgetNodes,
+        summary,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AA0UH,kDA2DC;AAmMD,0CAkIC;AA2FD,oCA4CC;AA/0BD,wCAyBwB;AAIxB,sGAAsG;AAEtG,6EAA6E;AAC7E,SAAS,KAAK,CAAC,GAAY,EAAE,CAAC,GAAG,EAAE;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjE,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;AAC3D,CAAC;AAED,gGAAgG;AAChG,SAAS,GAAG,CAAC,CAAU;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,IAA6B;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,IAAI,GAAG,OAAO,EAAE,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;IACpE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,KAAK,MAAM;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAI,EAA8B,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,CAAY,EAAE,KAAK,GAAG,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IAC9D,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IACxH,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACvH,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAsE,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC/E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,oGAAoG;AACpG,uDAAuD;AACvD,oGAAoG;AAEpG,+FAA+F;AAClF,QAAA,kBAAkB,GAAG;IAChC,MAAM;IACN,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,SAAS;CACD,CAAC;AAGX,MAAM,WAAW,GAA2B;IAC1C,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,kBAAkB;IAC5B,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,kBAAkB;IAC7B,eAAe,EAAE,yBAAyB;IAC1C,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,OAAO,EAAE,SAAS;IAClB,oBAAoB,EAAE,yBAAyB;IAC/C,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,qBAAqB;IAChC,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,WAAW;CACvB,CAAC;AAmBF,SAAS,UAAU,CAAC,IAAY,EAAE,YAA0B;IAC1D,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC;IACxB,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS,EAAE,GAAuB;IAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAC/B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,yBAAyB,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACxH,CAAC;IACD,IAAI,QAAQ,GAAG,4BAAsB,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,YAAY,QAAQ,kBAAkB,4BAAsB,YAAY;YAChF,MAAM,EAAE,2BAA2B,4BAAsB,yBAAyB;SACnF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,wBAAkB,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,GAAG,GAAG,uBAAuB,wBAAkB,0BAA0B;gBACzG,MAAM,EAAE,gDAAgD;aACzD,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,SAAS,GAAG,GAAG;gBACjE,MAAM,EAAE,8DAA8D;aACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;AAC5G,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAW,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC3G,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,0BAA0B,CAAC,CAAC;IACzH,IAAI,GAAuB,CAAC;IAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,MAAM,GAAG,sGAAsG,CAAC;IACpH,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvE,MAAM,GAAG,4DAA4D,CAAC;IACxE,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,gGAAgG,CAAC;IAC5G,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,0EAA0E,CAAC;IACtF,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,+FAA+F,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC;IAC/B,MAAM,MAAM,GACV,kIAAkI,CAAC;IACrI,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE,MAAM,EAAE,CAAC;IAChH,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,GAAG,sBAAsB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC3H,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,IAAY,EAAE,CAAS,EAAE,YAA0B,EAAE,GAAuB;IAC5F,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,qDAAqD,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAC;QAC/K,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,mBAAmB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,oBAAc,GAAG,EAAE,MAAM,EAAE,sCAAsC,oBAAc,GAAG,EAAE,CAAC;QACpK,KAAK,UAAU;YACb,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,iDAAiD,EAAE,MAAM,EAAE,uGAAuG,EAAE,CAAC;QAC5N,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACxG,CAAC;QACD,KAAK,iBAAiB;YACpB,OAAO;gBACL,MAAM,EAAE,IAAI,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,oDAAoD;gBACnG,MAAM,EAAE,oGAAoG;aAC7G,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,MAAM,EAAE,IAAI,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,sBAAsB,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;gBAClM,MAAM,EAAE,+FAA+F;aACxG,CAAC;QACJ,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACxG,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,gDAAgD,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC;QAChM,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,sCAAsC,EAAE,MAAM,EAAE,4EAA4E,EAAE,CAAC;QAC1J;YACE,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,GAAG,IAAI,eAAe,EAAE,MAAM,EAAE,eAAe,IAAI,gEAAgE,EAAE,CAAC;IACnJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,IAAY,EAAE,CAAS;IACzC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,8CAA8C,CAAC;QACxD,KAAK,SAAS;YACZ,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACvC,KAAK,UAAU;YACb,OAAO,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QACrE,KAAK,UAAU;YACb,OAAO,yCAAyC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QAClF,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,OAAO,GAAG,GAAG,oCAAoC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,KAAK,iBAAiB;YACpB,OAAO,aAAa,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC;QACvE,KAAK,gBAAgB;YACnB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,sBAAsB,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACtG,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,OAAO,eAAe,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,2BAA2B,CAAC,CAAC,GAAG,IAAI,SAAS,GAAG,CAAC;QAC5F,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACjD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAa,uBAAuB;IACzB,IAAI,GAAG,cAAuB,CAAC;IAC/B,OAAO,CAAU;IACjB,KAAK,CAAU;IACf,MAAM,CAAqB;IAC3B,MAAM,CAAW;IACjB,MAAM,CAAW;IACjB,WAAW,CAAW;IACtB,QAAQ,CAA+B;IACvC,OAAO,CAAS;IAEzB,YAAY,MAMX;QACC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,MAAM;QACJ,MAAM,KAAK,GAAoC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC3G,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AAzCD,0DAyCC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,MAAc,EAAE,YAA0B,EAAE,OAAyB,EAAE;IACzG,MAAM,QAAQ,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,0BAAkB,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,yGAAyG;IACzG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEzE,kEAAkE;IAClE,IAAI,YAAgC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC3B,YAAY,GAAG,CAAC,CAAC;YACjB,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,QAAsC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAoB,GAAG,IAAI,SAAS,CAAC;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACxC,IAAI,MAAc,CAAC;QACnB,IAAI,MAA0B,CAAC;QAC/B,IAAI,GAAuB,CAAC;QAC5B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,mDAAmD,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,2DAA2D,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAChD,IAAI,GAAG,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;QACvC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAY,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO;QACjC,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,6CAA6C;QACtG,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,kBAAkB,QAAQ,CAAC,KAAK,YAAY,QAAQ,CAAC,MAAM,EAAE;YAC/D,CAAC,CAAC,WAAW,YAAY,EAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAE5D,OAAO,IAAI,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3G,CAAC;AAsDD,SAAS,YAAY,CAAC,IAAY,EAAE,IAA6B;IAC/D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,wBAAwB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,sEAAsE,CAAC;QACpH,KAAK,YAAY;YACf,OAAO,gCAAgC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,qCAAqC,CAAC;QAC3F,KAAK,MAAM;YACT,OAAO,cAAc,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QAChI,KAAK,kBAAkB;YACrB,OAAO,oDAAoD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,kDAAkD,CAAC;QAC7H,KAAK,mBAAmB;YACtB,OAAO,qDAAqD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC;QAC5H,KAAK,kBAAkB;YACrB,OAAO,gCAAgC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,yDAAyD,CAAC;QAChH;YACE,OAAO,WAAW,IAAI,sEAAsE,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAA6B,EAAE,SAAkB;IACnF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACpD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED,kGAAkG;AAClG,SAAS,4BAA4B,CAAC,OAAiB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,CAAC,IAAI,EAAE;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAYD,SAAS,QAAQ,CAAC,CAAS,EAAE,MAA0B,EAAE,MAA0B,EAAE,IAAe;IAClG,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,oBAAoB,IAAI,EAAE,CAAC;IACpF,IAAI,CAAC,IAAI,MAAM;QAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC;IAC7E,IAAI,CAAC,IAAI,MAAM;QAAE,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,wBAAwB,CAAC;IACpG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC;AAC/D,CAAC;AAED,MAAa,mBAAmB;IACrB,IAAI,GAAG,UAAmB,CAAC;IAC3B,OAAO,CAAU;IAC1B,2GAA2G;IAClG,WAAW,CAAsC;IACjD,KAAK,CAAmB;IACxB,OAAO,CAAkB;IACzB,IAAI,CAAkB;IACtB,SAAS,CAAuB;IACzC,sEAAsE;IAC7D,QAAQ,CAAkD;IAC1D,OAAO,CAAW;IAClB,OAAO,CAAS;IAEzB,YAAY,MAUX;QACC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,MAAM;QACJ,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACjF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,YAAY;QACZ,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,KAAK,CAAC,cAAc,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;YACvJ,KAAK,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,kCAAkC,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,UAAU;QACV,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACrC,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,GAAG,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE5E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AA7ED,kDA6EC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAC7B,MAAc,EACd,QAAwB,EACxB,OAA2D,EAAE;IAE7D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,kGAAkG;IAClG,sFAAsF;IACtF,MAAM,WAAW,GAAwC,QAAQ,CAAC,KAAK;QACrE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,QAAQ,CAAC,oBAAoB;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ,CAAC;IACf,MAAM,OAAO,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAE3D,8CAA8C;IAC9C,MAAM,KAAK,GAAqB,EAAE,OAAO,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC;IAC3E,MAAM,OAAO,GAA2B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,OAAO;QAAE,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7C,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,wBAAkB,EAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACrB,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;YAC7B,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YAC1D,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,kCAAkC,CAAC;QACjE,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAC1C,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,SAAS,CAAC;IAC1G,CAAC;IAED,wCAAwC;IACxC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IAEtG,MAAM,YAAY,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;IACxC,kGAAkG;IAClG,4GAA4G;IAC5G,MAAM,kBAAkB,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GACpB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,SAAkB,EAAiB,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,SAAkB,CAAC;QACvB,IAAI,mBAAmB,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACpD,SAAS,GAAG,IAAA,0BAAoB,EAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,gGAAgG;YAChG,uEAAuE;YACvE,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAClF,CAAC;QACD,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;QACxH,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,EAAE,IAAI,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAEpE,wBAAwB;IACxB,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC;IACtC,MAAM,IAAI,GAAoB;QAC5B,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,IAAI,EAAE,EAAE,CAAC,CAAC;QACV,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;QACvC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;KACnF,CAAC;IACF,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;IACvC,CAAC;IAED,+BAA+B;IAC/B,MAAM,KAAK,GAAG,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,UAAU,EAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,GAAG,sBAAsB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,YAAY,CAAC;IAC7D,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAC1C,IAAI,GAAG,iFAAiF,CAAC;IAC3F,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,IAAI,GAAG,+EAA+E,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,yBAAyB,CAAC;IACpE,CAAC;IACD,MAAM,SAAS,GAAyB;QACtC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;KACL,CAAC;IACF,IAAI,OAAO,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;IAEjD,uCAAuC;IACvC,IAAI,QAAyD,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,QAAQ,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,gEAAgE,EAAE,MAAM,EAAE,oFAAoF,EAAE,CAAC;QACxM,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,WAAW,EAAE,CAAC;gBAChB,QAAQ,GAAG,EAAE,MAAM,EAAE,WAAW,WAAW,CAAC,IAAI,kCAAkC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1K,CAAC;iBAAM,IAAI,cAAc,EAAE,CAAC;gBAC1B,QAAQ,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,4DAA4D,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;YAC7O,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,8CAA8C,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,2DAA2D,EAAE,CAAC;YAC9O,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK;QAC5B,CAAC,CAAC,kBAAkB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,QAAQ,wCAAwC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,iCAAiC;QACjM,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,GAAG,OAAO,KAAK,MAAM,IAAI,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,MAAM,EAAE;YACtG,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC;IAEvC,OAAO,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AACxH,CAAC;AAuBD,SAAS,kBAAkB,CAAC,MAAe,EAAE,KAAe;IAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,aAAa,UAAU,kBAAkB,YAAY,aAAa,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,IAAA,yBAAmB,EAAC,EAAE,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,8BAA8B,CAAC;IAClG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,MAAa,gBAAgB;IAClB,IAAI,GAAG,OAAgB,CAAC;IACxB,KAAK,CAAS;IACd,IAAI,CAAmB;IACvB,UAAU,CAAqB;IAC/B,UAAU,CAAqB;IAC/B,WAAW,CAAoB;IAC/B,OAAO,CAAS;IAEzB,YAAY,MAOX;QACC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,MAAM;QACJ,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;QAC9E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,QAAQ,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AAzCD,4CAyCC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAsB;IACjD,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,yBAAmB,EAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAmB;YAC1B,KAAK,EAAE,CAAC;YACR,MAAM;YACN,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,SAAS;YACzB,YAAY,EAAE,KAAK;YACnB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;YACzD,QAAQ,EAAE,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC;SAC5C,CAAC;QACF,IAAI,QAAQ,IAAI,IAAA,yBAAmB,EAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,WAAW,GAAG,IAAA,sBAAgB,EAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GACX,SAAS,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,kCAAkC,SAAS,CAAC,MAAM,GAAG,CAAC,gCAAgC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,WAAW,CAAC,MAAM,kBAAkB,CAAC;IAE/K,OAAO,IAAI,gBAAgB,CAAC;QAC1B,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,IAAI;QACJ,UAAU,EAAE,IAAI,EAAE,MAAM;QACxB,UAAU,EAAE,IAAI,EAAE,MAAM;QACxB,WAAW;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "@atlasauth/pca-explain",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Plain-language proof-trace for PCA decisions: given a PCActn and its verify/decide result, explain exactly why it was allowed or denied — which capability granted it, which caveat narrowed or failed, the risk/threshold/budget path, and the first failing check with a remedy.",
+  "keywords": [
+    "explainability",
+    "decision trace",
+    "audit",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-explain"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@atlasauth/pca": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }