approval-md 0.0.1 → 0.2.0

package/dist/src/core/policy-diff.js

@@ -0,0 +1,588 @@
+/**
+ * Semantic policy diff (APRV-30) — what an edit to `APPROVAL.md` actually
+ * *changes about the runtime's answers*, computed by the real engine on both
+ * versions of the file.
+ *
+ * ## Why this module exists: two live incidents
+ *
+ * **seq 2 of this repository's own log.** An amendment was attested and then
+ * superseded eleven minutes later, because the operator attested a policy edit
+ * that broke a pinned dogfood assertion — a fact nobody learned until the test
+ * suite ran, well after the bytes had been signed for. Nothing in the ceremony
+ * had asked "what does this edit change?" before recording "a human saw these
+ * bytes".
+ *
+ * **The unsigned interregnum.** Commit `f829e6c` edited the policy file; its
+ * attestation landed in a later commit. In between, the repository was carrying
+ * an *inoperative* policy: `checkAttestation` reported `hash-mismatch`, and
+ * every gate operation refused. The edit and the attestation were two acts when
+ * they should have been one.
+ *
+ * Both incidents share a shape: the policy edit was treated as a text change
+ * rather than as an amendment with consequences. This module supplies the
+ * missing half of the ceremony — the consequences — and `cli/amend.ts` supplies
+ * the ceremony itself.
+ *
+ * ## What is compared, and how
+ *
+ * Nothing here re-implements matching, specificity, the irreversibility floor,
+ * or defaulting. {@link diffPolicies} calls `resolve()` from
+ * `core/policy-match.ts` on **both** loads for the same probe class, and reports
+ * the pairs that differ. A diff that computed the answer a second way could
+ * disagree with the engine, and the diff would be the more convincing lie.
+ *
+ * Five sections:
+ *
+ * - **classes** — resolution changes (autonomy, provenance, matched pattern)
+ *   over a probe set: every key of either version's `classes` map, plus the
+ *   caller's `sampleClasses` (the CLI passes SPEC.md §7's top-level namespaces).
+ * - **approvers** — approvers added, removed, or whose channel reachability
+ *   changed, plus the class rules left naming an approver the policy no longer
+ *   defines. Losing the only human who can be reached for a class is an
+ *   availability change disguised as a config tweak.
+ * - **defaults** — `autonomy`, `channel`, `approval_ttl`, `on_expiry`.
+ * - **budgets** — every `(scope, limit)` pair, old -> new. Scopes are the
+ *   `budgets` map's keys plus `classes.<pattern>` for a rule's `limits`.
+ * - **vocabulary** — every other key of the policy document, by dotted path,
+ *   before -> after. See below.
+ *
+ * ## The vocabulary section, and the incident that added it (APRV-111)
+ *
+ * On 2026-08-20 a real amendment added `protected_paths: [SPEC.md]` — a key
+ * that decides which file edits are `policy.edit`, which is to say which edits
+ * a human has to approve — and this module reported **"no semantic change"**.
+ * The four sections above were the whole diff, and none of them can see a
+ * top-level key outside `classes` / `approvers` / `defaults` / `budgets`. A
+ * human was shown "nothing changed" while signing bytes that moved the gate.
+ *
+ * The fix is not a fifth hand-written list, because a hand-written list is
+ * exactly what went stale: `protected_paths` was added to the vocabulary by
+ * APRV-107 and nothing here changed. {@link diffPolicies} now walks **both
+ * documents' actual keys**, flattens them to dotted paths, and reports every
+ * pair that differs. New spec keys are covered the day they parse, with no edit
+ * to this file. Paths the dedicated sections already report are dropped, so
+ * nothing is said twice.
+ *
+ * Two consequences worth stating:
+ *
+ * - **Unknown top-level keys are named, never dropped.** `policy.schema.json`
+ *   is closed, so an unrecognised key means the load FAILED and the policy is
+ *   all-manual. That key is reported (marked `recognised: false`) whether or
+ *   not its value changed: the display side fails closed too, and an edit this
+ *   module cannot describe must be called out rather than summarised as no
+ *   change. Which keys are known is READ FROM THAT SCHEMA since APRV-296 (see
+ *   {@link policyTopLevelKeys}), because the hand-written copy that stood here
+ *   fell behind it and warned an operator about three `daemon.*` keys the
+ *   schema had admitted for a month.
+ * - **A side whose YAML never parsed has no vocabulary to read.** Then
+ *   {@link PolicyDiff.vocabularyComparable} is `false` and the renderer says the
+ *   rest of the document was not compared, instead of printing "no semantic
+ *   change" over an unexamined document.
+ *
+ * ## Probes are a report, not a proof
+ *
+ * The class space is infinite; a diff over it cannot be exhaustive. The probe
+ * set is stated in the output ({@link PolicyDiff.probes}) precisely so a reader
+ * knows what was *not* examined. Wildcard keys (`read.*`) are probed as the
+ * literal strings they are, which is the honest thing to do without inventing
+ * action classes that nobody declared: both versions are asked the same
+ * question, so a difference in the answers is a real difference, and a class
+ * outside the probe set may still have changed.
+ *
+ * ## Fail-closed sides are rendered honestly
+ *
+ * A side that fails to load is not "an empty policy". It resolves **every**
+ * class to `manual` with provenance `fail-closed`, and `resolve()` already says
+ * so, so the class section stays truthful with no special case. The structural
+ * sections are different: a failed load has no `approvers`, `defaults` or
+ * `budgets` to read, and reporting them as removed would assert a change the
+ * file never made. So when either side failed, those three sections are empty
+ * and {@link PolicyDiff.structuralComparable} is `false`, with
+ * {@link PolicyDiff.beforeFailure} / {@link PolicyDiff.afterFailure} carrying
+ * the codes a renderer prints as "everything manual (fail-closed: <code>)".
+ *
+ * Deterministic: no clock, no randomness, and probe order is sorted, so the
+ * same two loads always produce a byte-identical diff. The one read of the
+ * filesystem is the policy SCHEMA, once per process, for the key vocabulary
+ * described above; nothing here reads a policy file, and no answer depends on
+ * anything but the two loads it was handed.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { resolve } from "./policy-match.js";
+/**
+ * SPEC.md §7's reserved top-level namespaces, in table order.
+ *
+ * Exported here rather than in the CLI because they are a fact about the spec's
+ * taxonomy, not about a command's flags, and because a diff that only probed
+ * the classes a policy happens to name would go quiet on exactly the edit that
+ * matters most: one that *stops* naming a dangerous namespace and lets it fall
+ * through to `defaults.autonomy`.
+ */
+export const SPEC_NAMESPACES = [
+    "read.*",
+    "files.write.*",
+    "communicate.*",
+    "calendar.write.*",
+    "financial.*",
+    "public.*",
+    "data.delete",
+    "account.*",
+    "physical.*",
+    "record.*",
+];
+const DEFAULT_FIELDS = [
+    "autonomy",
+    "channel",
+    "approval_ttl",
+    "on_expiry",
+];
+/**
+ * The policy schema on disk, the file `core/validate.ts` validates against.
+ *
+ * Derived here rather than imported from `DEFAULT_SCHEMA_DIR` so this module
+ * keeps its empty runtime dependency graph: importing `validate.ts` would pull
+ * Ajv into every process that renders a diff, the Telegram channel included.
+ * The two derivations are the same walk from the same directory, and
+ * `tests/policy-vocabulary.test.ts` asserts they name one file, so a schema
+ * directory that ever moves fails there rather than drifting quietly.
+ */
+export const POLICY_SCHEMA_PATH = fileURLToPath(new URL("../../../schema/policy.schema.json", import.meta.url));
+/**
+ * The vocabulary as it stood when it was written by hand, kept as the FALLBACK
+ * for a schema that cannot be read or parsed.
+ *
+ * It is deliberately the stale list rather than an empty one or a wildcard: an
+ * unreadable schema must leave the renderer erring loud (an unrecognised key is
+ * NAMED as unknown), and a list that is missing keys over-reports rather than
+ * under-reports. An empty list would name every key unknown, which is louder
+ * still but tells a reader nothing; a permissive one would silence the warning
+ * the APRV-111 incident added.
+ */
+const FALLBACK_TOP_LEVEL_KEYS = [
+    "approvers",
+    "audit",
+    "budgets",
+    "channels",
+    "classes",
+    "defaults",
+    "payload_retention",
+    "protected_paths",
+    "vault",
+    "version",
+];
+/** Memoised across a process; see {@link policyTopLevelKeys}. */
+let topLevelKeys = null;
+/**
+ * SPEC.md §5.2's top-level policy keys, READ FROM `policy.schema.json`
+ * (APRV-296).
+ *
+ * Used for ONE decision: whether a key the document carries is part of the
+ * vocabulary at all. It is not used to decide what to walk — the documents' own
+ * keys decide that — so this list only ever changes what a key is CALLED in the
+ * report.
+ *
+ * It used to be a second, hand-written copy of the schema's top-level
+ * `properties`, and the 2026-09-07 ceremony is what a hand-written copy costs:
+ * the amend diff printed `daemon.full_reproof_after: 60s -> 60s (UNKNOWN KEY:
+ * … the policy FAILS CLOSED to all-manual until it is removed)` for three
+ * `daemon.*` keys the schema had admitted since APRV-217, which the same
+ * ceremony then loaded cleanly and resolved every pin against. A false
+ * fail-closed warning in a ceremony's output is worse than no warning: it
+ * teaches the operator reading it that the warnings are noise.
+ *
+ * Reading the schema is the fix that cannot go stale, because the schema is
+ * what actually decides whether the key loads. The read is memoised for the
+ * life of the process, which `core/validate.ts` deliberately does not do for
+ * validation: this is DISPLAY vocabulary over a file shipped with the package,
+ * not a verdict, and a schema edited under a running process changes what the
+ * next diff CALLS a key rather than whether that key was validated.
+ */
+export function policyTopLevelKeys() {
+    if (topLevelKeys !== null)
+        return topLevelKeys;
+    topLevelKeys = readTopLevelKeys();
+    return topLevelKeys;
+}
+function readTopLevelKeys() {
+    try {
+        const parsed = JSON.parse(readFileSync(POLICY_SCHEMA_PATH, "utf8"));
+        if (!isRecord(parsed))
+            return FALLBACK_TOP_LEVEL_KEYS;
+        const properties = parsed["properties"];
+        if (!isRecord(properties))
+            return FALLBACK_TOP_LEVEL_KEYS;
+        const keys = Object.keys(properties).sort();
+        return keys.length === 0 ? FALLBACK_TOP_LEVEL_KEYS : keys;
+    }
+    catch {
+        return FALLBACK_TOP_LEVEL_KEYS;
+    }
+}
+/**
+ * The one key the vocabulary walk skips: the classes map is the classes
+ * section's subject, and printing its raw text beside the resolution changes
+ * would say the same thing twice, less usefully.
+ */
+const VOCABULARY_SKIP_TOP_LEVEL = "classes";
+function policyOf(load) {
+    return load.ok ? load.policy : null;
+}
+/**
+ * The document as parsed, for the vocabulary walk: the loaded policy when the
+ * load succeeded, the rejected-but-parsed value when the schema said no, and
+ * `undefined` when there was never a value (missing file, no block, bad YAML).
+ *
+ * DISPLAY ONLY. Nothing in this module resolves an action against it.
+ */
+function rawOf(load) {
+    return load.ok ? load.policy : load.raw;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A value rendered for a human to read: scalars as themselves, the rest JSON. */
+function renderValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return JSON.stringify(value) ?? String(value);
+}
+/** Flatten nested mappings to dotted paths; sequences and scalars are leaves. */
+function flatten(value, prefix, out) {
+    if (isRecord(value)) {
+        const keys = Object.keys(value).sort();
+        if (keys.length === 0) {
+            out.set(prefix, "{}");
+            return;
+        }
+        for (const key of keys) {
+            flatten(value[key], prefix === "" ? key : `${prefix}.${key}`, out);
+        }
+        return;
+    }
+    out.set(prefix, renderValue(value));
+}
+/** Every dotted path of a policy document, or `null` when there is no document. */
+function vocabularyTable(raw) {
+    if (!isRecord(raw))
+        return null;
+    const table = new Map();
+    for (const key of Object.keys(raw).sort()) {
+        if (key === VOCABULARY_SKIP_TOP_LEVEL)
+            continue;
+        flatten(raw[key], key, table);
+    }
+    return table;
+}
+/**
+ * Is this path already reported by one of the four dedicated sections?
+ *
+ * Only asked when those sections actually ran (`structuralComparable`): a side
+ * that failed to load leaves them empty, and dropping the path then would hide
+ * the change entirely rather than avoid repeating it.
+ */
+function coveredByDedicatedSection(path) {
+    const parts = path.split(".");
+    if (parts[0] === "defaults") {
+        return parts.length === 2 && DEFAULT_FIELDS.includes(parts[1]);
+    }
+    if (parts[0] === "approvers")
+        return parts.length === 3 && parts[2] === "channels";
+    if (parts[0] === "budgets")
+        return parts.length === 3;
+    return false;
+}
+function diffVocabulary(before, after, structuralComparable) {
+    const beforeTable = vocabularyTable(before);
+    const afterTable = vocabularyTable(after);
+    if (beforeTable === null || afterTable === null)
+        return { comparable: false, changes: [] };
+    const vocabulary = policyTopLevelKeys();
+    const changes = [];
+    for (const key of union([...beforeTable.keys()], [...afterTable.keys()])) {
+        const recognised = vocabulary.includes(key.split(".")[0] ?? key);
+        const previous = beforeTable.get(key) ?? null;
+        const next = afterTable.get(key) ?? null;
+        // An unrecognised key is reported whether or not it moved: it is why the
+        // policy fails closed, and a reader shown "no change" would never learn it.
+        if (recognised && previous === next)
+            continue;
+        if (recognised && structuralComparable && coveredByDedicatedSection(key))
+            continue;
+        changes.push({ key, recognised, before: previous, after: next });
+    }
+    return { comparable: true, changes };
+}
+function failureOf(load) {
+    return load.ok ? null : { code: load.code, message: load.message };
+}
+function snapshot(load, probe) {
+    return snapshotFor(load, probe, false);
+}
+function irreversibleSnapshot(load, probe) {
+    return snapshotFor(load, probe, true);
+}
+function snapshotFor(load, probe, irreversible) {
+    const resolution = resolve(load, probe, irreversible ? { reversible: false } : {});
+    return {
+        autonomy: resolution.autonomy,
+        provenance: resolution.provenance,
+        pattern: resolution.matched?.pattern ?? null,
+    };
+}
+function sameSnapshot(a, b) {
+    return a.autonomy === b.autonomy && a.provenance === b.provenance && a.pattern === b.pattern;
+}
+/** Sorted, de-duplicated union of the given string lists. */
+function union(...lists) {
+    const seen = new Set();
+    for (const list of lists)
+        for (const item of list)
+            seen.add(item);
+    return [...seen].sort();
+}
+function classKeys(policy) {
+    return policy?.classes === undefined ? [] : Object.keys(policy.classes);
+}
+function channelsOf(policy, approver) {
+    const entry = policy?.approvers?.[approver];
+    return entry === undefined ? null : [...entry.channels];
+}
+function sameChannels(a, b) {
+    if (a === null || b === null)
+        return a === b;
+    if (a.length !== b.length)
+        return false;
+    return a.every((value, index) => value === b[index]);
+}
+function defaultValue(policy, field) {
+    const defaults = policy?.defaults;
+    if (defaults === undefined)
+        return null;
+    const value = defaults[field];
+    return value === undefined ? null : String(value);
+}
+/**
+ * Key separator for the `(scope, limit)` table below. A control character, not
+ * a dot or a space: scope names come from a policy file and limit names are
+ * open-ended (SPEC.md §7's taxonomy grows), so any printable separator could
+ * one day appear inside a key and split it in the wrong place.
+ */
+const SEPARATOR = "\u0000";
+/**
+ * Every `(scope, limit)` pair a policy declares: `budgets.<scope>.<limit>`
+ * flattened to `(scope, limit)`, and each class rule's `limits` flattened to
+ * `(classes.<pattern>, limit)`.
+ */
+function limitTable(policy) {
+    const table = new Map();
+    if (policy === null)
+        return table;
+    for (const [scope, entry] of Object.entries(policy.budgets ?? {})) {
+        for (const [limit, value] of Object.entries(entry)) {
+            if (typeof value === "number")
+                table.set(`${scope}${SEPARATOR}${limit}`, value);
+        }
+    }
+    for (const [pattern, rule] of Object.entries(policy.classes ?? {})) {
+        for (const [limit, value] of Object.entries(rule.limits ?? {})) {
+            table.set(`classes.${pattern}${SEPARATOR}${limit}`, value);
+        }
+    }
+    return table;
+}
+/** Class patterns whose rule names `approver`, sorted. */
+function rulesNaming(policy, approver) {
+    const patterns = [];
+    for (const [pattern, rule] of Object.entries(policy?.classes ?? {})) {
+        if ((rule.approvers ?? []).includes(approver))
+            patterns.push(pattern);
+    }
+    return patterns.sort();
+}
+function diffApprovers(before, after) {
+    const names = union(Object.keys(before?.approvers ?? {}), Object.keys(after?.approvers ?? {}));
+    const changes = [];
+    for (const approver of names) {
+        const beforeChannels = channelsOf(before, approver);
+        const afterChannels = channelsOf(after, approver);
+        if (sameChannels(beforeChannels, afterChannels))
+            continue;
+        const change = beforeChannels === null ? "added" : afterChannels === null ? "removed" : "channels-changed";
+        changes.push({
+            approver,
+            change,
+            beforeChannels,
+            afterChannels,
+            danglingRules: afterChannels === null ? rulesNaming(after, approver) : [],
+        });
+    }
+    return changes;
+}
+function diffDefaults(before, after) {
+    const changes = [];
+    for (const field of DEFAULT_FIELDS) {
+        const previous = defaultValue(before, field);
+        const next = defaultValue(after, field);
+        if (previous === next)
+            continue;
+        changes.push({ field, before: previous, after: next });
+    }
+    return changes;
+}
+function diffBudgets(before, after) {
+    const beforeTable = limitTable(before);
+    const afterTable = limitTable(after);
+    const keys = union([...beforeTable.keys()], [...afterTable.keys()]);
+    const changes = [];
+    for (const key of keys) {
+        const previous = beforeTable.get(key) ?? null;
+        const next = afterTable.get(key) ?? null;
+        if (previous === next)
+            continue;
+        const separator = key.indexOf(SEPARATOR);
+        changes.push({
+            scope: key.slice(0, separator),
+            limit: key.slice(separator + 1),
+            before: previous,
+            after: next,
+        });
+    }
+    return changes;
+}
+/**
+ * Diff two loaded policies by what the engine answers under each.
+ *
+ * `before` and `after` are whole {@link PolicyLoadResult}s, failures included —
+ * see the module header for why a failed side is reported rather than treated
+ * as empty. `sampleClasses` widens the probe set beyond the two policies' own
+ * class keys; the CLI supplies {@link SPEC_NAMESPACES}.
+ */
+export function diffPolicies(before, after, sampleClasses = []) {
+    const beforePolicy = policyOf(before);
+    const afterPolicy = policyOf(after);
+    const probes = union(classKeys(beforePolicy), classKeys(afterPolicy), sampleClasses);
+    const classes = [];
+    for (const probe of probes) {
+        const previous = snapshot(before, probe);
+        const next = snapshot(after, probe);
+        const previousIrreversible = irreversibleSnapshot(before, probe);
+        const nextIrreversible = irreversibleSnapshot(after, probe);
+        const ordinaryChanged = !sameSnapshot(previous, next);
+        const irreversibleChanged = !sameSnapshot(previousIrreversible, nextIrreversible);
+        if (!ordinaryChanged && !irreversibleChanged)
+            continue;
+        const change = {
+            class: probe,
+            before: previous,
+            after: next,
+        };
+        if (irreversibleChanged) {
+            change.irreversible = { before: previousIrreversible, after: nextIrreversible };
+        }
+        classes.push(change);
+    }
+    const structuralComparable = before.ok && after.ok;
+    const approvers = structuralComparable ? diffApprovers(beforePolicy, afterPolicy) : [];
+    const defaults = structuralComparable ? diffDefaults(beforePolicy, afterPolicy) : [];
+    const budgets = structuralComparable ? diffBudgets(beforePolicy, afterPolicy) : [];
+    const vocabulary = diffVocabulary(rawOf(before), rawOf(after), structuralComparable);
+    return {
+        beforeFailure: failureOf(before),
+        afterFailure: failureOf(after),
+        structuralComparable,
+        probes,
+        classes,
+        approvers,
+        defaults,
+        budgets,
+        vocabulary: vocabulary.changes,
+        vocabularyComparable: vocabulary.comparable,
+        unchanged: classes.length === 0 &&
+            approvers.length === 0 &&
+            defaults.length === 0 &&
+            budgets.length === 0 &&
+            vocabulary.changes.length === 0,
+    };
+}
+/**
+ * Render a {@link PolicyDiff} as the lines the CLI prints.
+ *
+ * Lives beside the diff rather than in the CLI for the same reason
+ * `decisionPath` lives in `policy-explain.ts`: the human rendering and the
+ * machine shape must be derived from one value, or they will eventually
+ * disagree about what changed.
+ */
+export function renderDiff(diff) {
+    const lines = [];
+    if (diff.beforeFailure !== null) {
+        lines.push(`before: everything manual (fail-closed: ${diff.beforeFailure.code}) — ${diff.beforeFailure.message}`);
+    }
+    if (diff.afterFailure !== null) {
+        lines.push(`after: everything manual (fail-closed: ${diff.afterFailure.code}) — ${diff.afterFailure.message}`);
+    }
+    if (diff.unchanged) {
+        // "no semantic change" is a claim about the WHOLE document, so it is only
+        // made when the whole document was read. When a side's YAML never parsed
+        // there are keys nobody looked at, and saying nothing changed would be the
+        // APRV-111 failure with a different cause.
+        lines.push(diff.vocabularyComparable
+            ? `no semantic change: ${diff.probes.length} probed class(es) resolve the same, and every policy key is unchanged`
+            : `no class resolution changed over ${diff.probes.length} probed class(es), but the rest of the policy could NOT be compared (a side's YAML did not parse), so an edit outside the classes may be invisible here — read the file diff yourself`);
+        return lines;
+    }
+    if (diff.classes.length > 0) {
+        lines.push(`class resolutions changed (${diff.classes.length}):`);
+        for (const change of diff.classes) {
+            if (!sameSnapshot(change.before, change.after)) {
+                lines.push(`  ${change.class}: ${describeSnapshot(change.before)} -> ${describeSnapshot(change.after)}`);
+            }
+            if (change.irreversible !== undefined) {
+                lines.push(`  ${change.class} (reversible: false): ${describeSnapshot(change.irreversible.before)} -> ${describeSnapshot(change.irreversible.after)}`);
+            }
+        }
+    }
+    if (diff.approvers.length > 0) {
+        lines.push(`approvers changed (${diff.approvers.length}):`);
+        for (const change of diff.approvers) {
+            lines.push(`  ${change.approver}: ${change.change} [${(change.beforeChannels ?? []).join(", ")}] -> [${(change.afterChannels ?? []).join(", ")}]${change.danglingRules.length === 0
+                ? ""
+                : ` (UNREACHABLE: still named by ${change.danglingRules.join(", ")})`}`);
+        }
+    }
+    if (diff.defaults.length > 0) {
+        lines.push(`defaults changed (${diff.defaults.length}):`);
+        for (const change of diff.defaults) {
+            lines.push(`  ${change.field}: ${change.before ?? "(absent)"} -> ${change.after ?? "(absent)"}`);
+        }
+    }
+    if (diff.budgets.length > 0) {
+        lines.push(`limits changed (${diff.budgets.length}):`);
+        for (const change of diff.budgets) {
+            lines.push(`  ${change.scope}.${change.limit}: ${change.before ?? "(absent)"} -> ${change.after ?? "(absent)"}`);
+        }
+    }
+    if (diff.vocabulary.length > 0) {
+        lines.push(`policy keys changed (${diff.vocabulary.length}):`);
+        for (const change of diff.vocabulary) {
+            const values = `${change.before ?? "(absent)"} -> ${change.after ?? "(absent)"}`;
+            lines.push(change.recognised
+                ? `  ${change.key}: ${values}`
+                : `  ${change.key}: ${values} (UNKNOWN KEY: not part of the policy vocabulary, so the policy FAILS CLOSED to all-manual until it is removed)`);
+        }
+    }
+    if (!diff.vocabularyComparable) {
+        lines.push("the policy keys were NOT compared: a side's YAML did not parse, so there was no document to walk. A change outside the classes is not visible above");
+    }
+    if (!diff.structuralComparable) {
+        lines.push("approvers, defaults and limits were NOT compared: a policy that fails to load has no structure to read, and reporting it as empty would claim removals that never happened");
+    }
+    return lines;
+}
+function describeSnapshot(snap) {
+    const source = snap.pattern === null ? snap.provenance : `${snap.provenance} ${snap.pattern}`;
+    return `${snap.autonomy} (${source})`;
+}
+//# sourceMappingURL=policy-diff.js.map

package/dist/src/core/policy-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-diff.js","sourceRoot":"","sources":["../../../src/core/policy-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAmB,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,QAAQ;IACR,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,aAAa;IACb,UAAU;IACV,aAAa;IACb,WAAW;IACX,YAAY;IACZ,UAAU;CACX,CAAC;AAqHF,MAAM,cAAc,GAA2C;IAC7D,UAAU;IACV,SAAS;IACT,cAAc;IACd,WAAW;CACZ,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAC7C,IAAI,GAAG,CAAC,oCAAoC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAC/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAsB;IACjD,WAAW;IACX,OAAO;IACP,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,iBAAiB;IACjB,OAAO;IACP,SAAS;CACV,CAAC;AAEF,iEAAiE;AACjE,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC/C,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAClC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,uBAAuB,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,uBAAuB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAE5C,SAAS,QAAQ,CAAC,IAAsB;IACtC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,IAAsB;IACnC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,KAAc,EAAE,MAAc,EAAE,GAAwB;IACvE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,KAAK,yBAAyB;YAAE,SAAS;QAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;IACnF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,MAAe,EACf,KAAc,EACd,oBAA6B;IAE7B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE3F,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,UAAU,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAC9C,IAAI,UAAU,IAAI,oBAAoB,IAAI,yBAAyB,CAAC,GAAG,CAAC;YAAE,SAAS;QACnF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAChB,IAAsB;IAEtB,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAsB,EAAE,KAAa;IACrD,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAsB,EAAE,KAAa;IACjE,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAClB,IAAsB,EACtB,KAAa,EACb,YAAqB;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAqB,EAAE,CAAqB;IAChE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/F,CAAC;AAED,6DAA6D;AAC7D,SAAS,KAAK,CAAC,GAAG,KAAuC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,CAAkB,EAAE,CAAkB;IAC1D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB,EAAE,KAA8B;IACzE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,SAAS,GAAG,QAAQ,CAAC;AAE3B;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,GAAG,CAAC,WAAW,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,WAAW,CAAC,MAAqB,EAAE,QAAgB;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,MAAqB,EAAE,KAAoB;IAChE,MAAM,KAAK,GAAG,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,EACpC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CACpC,CAAC;IACF,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC;YAAE,SAAS;QAC1D,MAAM,MAAM,GACV,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ;YACR,MAAM;YACN,cAAc;YACd,aAAa;YACb,aAAa,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB,EAAE,KAAoB;IAC/D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,KAAoB;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwB,EACxB,KAAuB,EACvB,aAAa,GAAsB,EAAE;IAErC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,mBAAmB,GAAG,CAAC,YAAY,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;QAClF,IAAI,CAAC,eAAe,IAAI,CAAC,mBAAmB;YAAE,SAAS;QACvD,MAAM,MAAM,GAA0B;YACpC,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC;QACF,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,CAAC,YAAY,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAErF,OAAO;QACL,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC;QAChC,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC;QAC9B,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,SAAS;QACT,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,UAAU,CAAC,OAAO;QAC9B,oBAAoB,EAAE,UAAU,CAAC,UAAU;QAC3C,SAAS,EACP,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,2CAA2C,IAAI,CAAC,aAAa,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,0CAA0C,IAAI,CAAC,YAAY,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,2CAA2C;QAC3C,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,oBAAoB;YACvB,CAAC,CAAC,uBAAuB,IAAI,CAAC,MAAM,CAAC,MAAM,uEAAuE;YAClH,CAAC,CAAC,oCAAoC,IAAI,CAAC,MAAM,CAAC,MAAM,uLAAuL,CAClP,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,yBAAyB,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAC3I,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAC1F,MAAM,CAAC,aAAa,IAAI,EAAE,CAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,IACV,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,iCAAiC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GACtE,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;YACjF,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,UAAU;gBACf,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE;gBAC9B,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,MAAM,iHAAiH,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,qJAAqJ,CACtJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,4KAA4K,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB;IAChD,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;IACjF,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,GAAG,CAAC;AACxC,CAAC"}