approval-md 0.0.1 → 0.2.0

package/dist/src/core/policy-explain.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Policy explanation: the decision trace behind an autonomy resolution
+ * (SPEC.md §5.2, §7, and the `approval policy check|test` command of §10.1).
+ *
+ * `resolve()` in `policy-match.ts` answers *what* policy does with a class.
+ * This module answers *why*, in two registers at once: a frozen machine-readable
+ * {@link Explanation} for agents, and an ordered list of human sentences
+ * (`decisionPath`) that the CLI prints verbatim. Both are derived from the same
+ * `Resolution`; nothing here re-implements matching, specificity, tie-breaking
+ * or the floor, because a trace that computed the answer a second time could
+ * disagree with the answer — and the trace would be the more convincing lie.
+ *
+ * ## The three reasons an outcome is `manual` (SPEC.md §5.2, §7)
+ *
+ * `manual` is the system's resting state, and "why manual" is the question a
+ * human actually asks. {@link Explanation.manualBecause} names exactly one of:
+ *
+ * - `"matched-rule"` — a `classes` rule (or `defaults.autonomy`) says `manual`.
+ *   The policy was read, understood, and it says ask.
+ * - `"irreversibility-floor"` — the policy granted `autonomous`/`supervised`,
+ *   and §7's floor overrode it because the action declared `reversible: false`.
+ *   The policy is *not* what produced this answer, and {@link
+ *   Explanation.overridden} records what it did say.
+ * - `"load-failure"` — the policy could not be loaded, so every class is
+ *   `manual`. {@link Explanation.loadFailure} carries the code and message.
+ *
+ * The distinction is operational, not cosmetic: the first is working as
+ * intended, the second means the caller under-declared or over-reached, and the
+ * third means someone must go fix a file. Collapsing them into "manual" hides
+ * a broken policy behind an answer that looks deliberate.
+ *
+ * ## Determinism
+ *
+ * Pure: no I/O, no clock, no randomness, no caching. `explain(load, class, opts)`
+ * is deeply equal across calls, including `decisionPath` strings, because
+ * `resolve()` already imposes a total order on candidates.
+ */
+import type { Autonomy, DeclaredAutonomy, PolicyClassRule, PolicyLoadErrorCode, PolicyLoadResult, SupervisionMode } from "./policy-load.js";
+import { type Provenance, type Specificity } from "./policy-match.js";
+/**
+ * Action-class grammar for a *concrete* class (not a pattern).
+ *
+ * `schema/policy.schema.json`'s `classPattern` admits `*` because a policy key
+ * is a pattern. The thing being explained is an action, and an action's class is
+ * never a wildcard: asking "what does policy do with `read.*`" is a category
+ * error — `read.*` is not something an agent can do. Uppercase, whitespace,
+ * empty segments and leading/trailing dots are rejected for the same reason the
+ * schema rejects them in keys: they can never name a real action.
+ */
+export declare const ACTION_CLASS_PATTERN: RegExp;
+/** Does `value` name a concrete action class? See {@link ACTION_CLASS_PATTERN}. */
+export declare function isActionClass(value: string): boolean;
+/** Why a `manual` outcome is `manual`. `null` when the outcome is not manual. */
+export type ManualBecause = "matched-rule" | "irreversibility-floor" | "load-failure";
+/** How a candidate won, or that it merely tied. */
+export type TieBreak = 
+/** Strictly the most specific match; no tie to break. */
+"specificity"
+/** Tied on specificity; won because it is the strictest autonomy. */
+ | "strictest-autonomy"
+/** Tied on specificity and strictness; won on lexicographic pattern order. */
+ | "lexicographic"
+/** Tied with the winner on specificity, and lost the tie-break. */
+ | "tied-specificity";
+/** The resolved grant, flattened for consumers that only want the answer. */
+export interface ExplanationOutcome {
+    autonomy: Autonomy;
+    /**
+     * Amended SPEC.md §5.2 (APRV-127): the level the winning rule actually wrote.
+     * Equals `autonomy` except for the two supervised spellings, where it is the
+     * word the policy uses and `autonomy` is what is enforced.
+     */
+    declaredAutonomy: DeclaredAutonomy;
+    /** `"live"` / `"retro"` for a supervised outcome, `null` otherwise. */
+    supervision: SupervisionMode | null;
+    /** The live fraction, for a `supervised-live` outcome only. */
+    liveRate: number | null;
+    /** Approvers carried from the matched rule; `null` when unset or unmatched. */
+    approvers: string[] | null;
+    /** Limits carried from the matched rule; `null` when unset or unmatched. */
+    limits: Record<string, number> | null;
+    /** Explicit permission supplied by the governing max-specificity rule group. */
+    allowIrreversible: boolean;
+}
+export type IrreversibilityDecision = "not-applicable" | "policy-allowed" | "floor-applied" | "already-manual" | "human-only";
+/** One rule that matched the class, with why it did or did not win. */
+export interface ExplanationCandidate {
+    pattern: string;
+    /** `[literalSegments, wildcardSegments, totalSegments]` (SPEC.md §5.2). */
+    specificity: Specificity;
+    /** The level the rule WROTE (APRV-127): `supervised-live` stays itself here. */
+    autonomy: DeclaredAutonomy;
+    winner: boolean;
+    /** Present only for the winner and for candidates tied with it. */
+    tieBreak?: TieBreak;
+}
+/**
+ * The frozen machine-readable trace. `approval policy check --json` prints this
+ * object verbatim, so field names and value domains are public API.
+ */
+export interface Explanation {
+    /** The class that was asked about, echoed back. */
+    class: string;
+    /** `reversible` as supplied; `null` when the caller did not state it. */
+    reversible: boolean | null;
+    outcome: ExplanationOutcome;
+    provenance: Provenance;
+    manualBecause: ManualBecause | null;
+    /** Set only when the policy failed to load (`provenance: "fail-closed"`). */
+    loadFailure: {
+        code: PolicyLoadErrorCode;
+        message: string;
+    } | null;
+    /** The winning rule, or `null` for a default / fail-closed outcome. */
+    matched: {
+        pattern: string;
+        rule: PolicyClassRule;
+    } | null;
+    /**
+     * What the floor overrode: the pre-floor autonomy and the rule that granted
+     * it. `pattern` is `null` when the grant came from `defaults.autonomy` rather
+     * than a rule. `null` overall when the floor did not apply.
+     */
+    overridden: {
+        pattern: string | null;
+        autonomy: DeclaredAutonomy;
+    } | null;
+    /** How a truthful `reversible: false` declaration affected this answer. */
+    irreversibility: IrreversibilityDecision;
+    /** The equally most-specific rules whose unanimous opt-in governs permission. */
+    irreversiblePatterns: string[];
+    /** Every matching rule, most specific first (order from `resolve()`). */
+    candidates: ExplanationCandidate[];
+    /** Ordered human sentences narrating the decision; what the CLI prints. */
+    decisionPath: string[];
+}
+/** Options for {@link explain}. */
+export interface ExplainOptions {
+    /** `false` engages the SPEC.md §7 irreversibility floor. */
+    reversible?: boolean;
+}
+/**
+ * Explain what `load`'s policy does with `actionClass`.
+ *
+ * Matching is delegated wholly to {@link resolve}: it is called twice, once
+ * without options to observe the pre-floor autonomy and once with them for the
+ * final answer. Two calls of a pure function are cheaper than a second
+ * implementation of the floor.
+ */
+export declare function explain(load: PolicyLoadResult, actionClass: string, options?: ExplainOptions): Explanation;

package/dist/src/core/policy-explain.js

@@ -0,0 +1,258 @@
+/**
+ * Policy explanation: the decision trace behind an autonomy resolution
+ * (SPEC.md §5.2, §7, and the `approval policy check|test` command of §10.1).
+ *
+ * `resolve()` in `policy-match.ts` answers *what* policy does with a class.
+ * This module answers *why*, in two registers at once: a frozen machine-readable
+ * {@link Explanation} for agents, and an ordered list of human sentences
+ * (`decisionPath`) that the CLI prints verbatim. Both are derived from the same
+ * `Resolution`; nothing here re-implements matching, specificity, tie-breaking
+ * or the floor, because a trace that computed the answer a second time could
+ * disagree with the answer — and the trace would be the more convincing lie.
+ *
+ * ## The three reasons an outcome is `manual` (SPEC.md §5.2, §7)
+ *
+ * `manual` is the system's resting state, and "why manual" is the question a
+ * human actually asks. {@link Explanation.manualBecause} names exactly one of:
+ *
+ * - `"matched-rule"` — a `classes` rule (or `defaults.autonomy`) says `manual`.
+ *   The policy was read, understood, and it says ask.
+ * - `"irreversibility-floor"` — the policy granted `autonomous`/`supervised`,
+ *   and §7's floor overrode it because the action declared `reversible: false`.
+ *   The policy is *not* what produced this answer, and {@link
+ *   Explanation.overridden} records what it did say.
+ * - `"load-failure"` — the policy could not be loaded, so every class is
+ *   `manual`. {@link Explanation.loadFailure} carries the code and message.
+ *
+ * The distinction is operational, not cosmetic: the first is working as
+ * intended, the second means the caller under-declared or over-reached, and the
+ * third means someone must go fix a file. Collapsing them into "manual" hides
+ * a broken policy behind an answer that looks deliberate.
+ *
+ * ## Determinism
+ *
+ * Pure: no I/O, no clock, no randomness, no caching. `explain(load, class, opts)`
+ * is deeply equal across calls, including `decisionPath` strings, because
+ * `resolve()` already imposes a total order on candidates.
+ */
+import { resolve, STRICTNESS, } from "./policy-match.js";
+/**
+ * Action-class grammar for a *concrete* class (not a pattern).
+ *
+ * `schema/policy.schema.json`'s `classPattern` admits `*` because a policy key
+ * is a pattern. The thing being explained is an action, and an action's class is
+ * never a wildcard: asking "what does policy do with `read.*`" is a category
+ * error — `read.*` is not something an agent can do. Uppercase, whitespace,
+ * empty segments and leading/trailing dots are rejected for the same reason the
+ * schema rejects them in keys: they can never name a real action.
+ */
+export const ACTION_CLASS_PATTERN = /^[a-z0-9][a-z0-9_-]*(?:\.[a-z0-9][a-z0-9_-]*)*$/u;
+/** Does `value` name a concrete action class? See {@link ACTION_CLASS_PATTERN}. */
+export function isActionClass(value) {
+    return ACTION_CLASS_PATTERN.test(value);
+}
+function quote(text) {
+    return JSON.stringify(text);
+}
+function specificityText(specificity) {
+    return `literals=${specificity[0]} wildcards=${specificity[1]} segments=${specificity[2]}`;
+}
+/**
+ * Explain what `load`'s policy does with `actionClass`.
+ *
+ * Matching is delegated wholly to {@link resolve}: it is called twice, once
+ * without options to observe the pre-floor autonomy and once with them for the
+ * final answer. Two calls of a pure function are cheaper than a second
+ * implementation of the floor.
+ */
+export function explain(load, actionClass, options = {}) {
+    const reversible = options.reversible ?? null;
+    const base = resolve(load, actionClass);
+    const final = resolve(load, actionClass, options);
+    const decisionPath = [
+        `class ${quote(actionClass)}; reversible: ${reversible === null ? "not stated" : String(reversible)}`,
+    ];
+    if (!load.ok) {
+        decisionPath.push(`policy could not be loaded (${load.code}): ${load.message}`, "fail-closed (SPEC §5.2): an unreadable policy grants nothing, so every class is manual", "final: manual");
+        return {
+            class: actionClass,
+            reversible,
+            outcome: {
+                autonomy: "manual",
+                declaredAutonomy: "manual",
+                supervision: null,
+                liveRate: null,
+                approvers: null,
+                limits: null,
+                allowIrreversible: false,
+            },
+            provenance: "fail-closed",
+            manualBecause: "load-failure",
+            loadFailure: { code: load.code, message: load.message },
+            matched: null,
+            overridden: null,
+            irreversibility: reversible === false ? "already-manual" : "not-applicable",
+            irreversiblePatterns: [],
+            candidates: [],
+            decisionPath,
+        };
+    }
+    decisionPath.push(`policy loaded from ${load.source.path}`);
+    const candidates = annotate(final.candidates, final.matched?.pattern ?? null);
+    describeCandidates(decisionPath, actionClass, candidates);
+    describeWinner(decisionPath, load, base.provenance, base.autonomy, candidates);
+    const overridden = final.floorApplied
+        ? { pattern: final.matched?.pattern ?? null, autonomy: base.declaredAutonomy }
+        : null;
+    describeFloor(decisionPath, reversible, final.autonomy, final.floorApplied, final.allowIrreversible, final.irreversiblePatterns, overridden);
+    // APRV-127: name the mode, because "supervised" no longer says enough. A
+    // reader deciding whether to expect a prompt needs to know whether a fraction
+    // of this class stops first, and at what rate.
+    decisionPath.push(final.supervision === "live"
+        ? `final: supervised-live at rate ${String(final.liveRate ?? 1)} — that fraction of this class STOPS at the human gate before executing (selected by HMAC over the payload hash under the operator's secret); the rest proceed and are still eligible for retrospective review`
+        : final.supervision === "retro"
+            ? `final: supervised-retro — executes immediately, sampled for review AFTERWARDS at audit.supervised_sample_rate`
+            : `final: ${final.autonomy}`);
+    return {
+        class: actionClass,
+        reversible,
+        outcome: {
+            autonomy: final.autonomy,
+            declaredAutonomy: final.declaredAutonomy,
+            supervision: final.supervision,
+            liveRate: final.liveRate,
+            approvers: final.approvers,
+            limits: final.limits,
+            allowIrreversible: final.allowIrreversible,
+        },
+        provenance: final.provenance,
+        manualBecause: manualBecauseOf(final.autonomy, final.floorApplied),
+        loadFailure: null,
+        matched: final.matched,
+        overridden,
+        irreversibility: irreversibilityDecision(reversible, final),
+        irreversiblePatterns: final.irreversiblePatterns,
+        candidates,
+        decisionPath,
+    };
+}
+function irreversibilityDecision(reversible, resolution) {
+    if (reversible !== false)
+        return "not-applicable";
+    if (resolution.autonomy === "human-only")
+        return "human-only";
+    if (resolution.floorApplied)
+        return "floor-applied";
+    if (resolution.allowIrreversible)
+        return "policy-allowed";
+    return "already-manual";
+}
+/**
+ * A non-manual outcome has no "because": the question only arises for `manual`.
+ * The floor is checked before the rule, because when both are true it is the
+ * floor that decided — the rule said something more permissive.
+ */
+function manualBecauseOf(autonomy, floorApplied) {
+    if (autonomy !== "manual")
+        return null;
+    return floorApplied ? "irreversibility-floor" : "matched-rule";
+}
+/**
+ * Copy `resolve()`'s candidates into the explanation shape, marking the winner
+ * and annotating the specificity tie it did or did not have to win.
+ *
+ * The tie group is every candidate whose specificity equals the head's — the
+ * exact set `resolve()` runs "deny beats allow" over.
+ */
+function annotate(candidates, winnerPattern) {
+    const head = candidates[0];
+    const tied = head === undefined
+        ? []
+        : candidates.filter((candidate) => sameSpecificity(candidate.specificity, head.specificity));
+    let strictest = Number.POSITIVE_INFINITY;
+    for (const candidate of tied) {
+        strictest = Math.min(strictest, STRICTNESS[candidate.rule.autonomy]);
+    }
+    const strictestCount = tied.filter((candidate) => STRICTNESS[candidate.rule.autonomy] === strictest).length;
+    const winnerTieBreak = tied.length <= 1 ? "specificity" : strictestCount === 1 ? "strictest-autonomy" : "lexicographic";
+    return candidates.map((candidate) => {
+        const winner = candidate.pattern === winnerPattern;
+        const inTie = head !== undefined && sameSpecificity(candidate.specificity, head.specificity);
+        const base = {
+            pattern: candidate.pattern,
+            specificity: candidate.specificity,
+            autonomy: candidate.rule.autonomy,
+            winner,
+        };
+        if (winner)
+            return { ...base, tieBreak: winnerTieBreak };
+        if (inTie)
+            return { ...base, tieBreak: "tied-specificity" };
+        return base;
+    });
+}
+function sameSpecificity(a, b) {
+    return a[0] === b[0] && a[1] === b[1] && a[2] === b[2];
+}
+function describeCandidates(decisionPath, actionClass, candidates) {
+    if (candidates.length === 0) {
+        decisionPath.push(`no class rule matched ${quote(actionClass)}`);
+        return;
+    }
+    decisionPath.push(`${candidates.length} rule(s) matched ${quote(actionClass)}, most specific first:`);
+    for (const candidate of candidates) {
+        const marks = [
+            candidate.winner ? "winner" : null,
+            candidate.tieBreak === undefined ? null : `tie-break: ${candidate.tieBreak}`,
+        ].filter((mark) => mark !== null);
+        decisionPath.push(`  ${candidate.pattern} [${specificityText(candidate.specificity)}] -> ${candidate.autonomy}` +
+            (marks.length === 0 ? "" : ` (${marks.join("; ")})`));
+    }
+}
+function describeWinner(decisionPath, load, provenance, autonomy, candidates) {
+    if (provenance === "rule") {
+        const winner = candidates.find((candidate) => candidate.winner);
+        const reason = winner?.tieBreak === "strictest-autonomy"
+            ? "tied on specificity; strictest autonomy wins (deny beats allow)"
+            : winner?.tieBreak === "lexicographic"
+                ? "tied on specificity and on strictness; smallest pattern wins, for determinism"
+                : "strictly the most specific match";
+        decisionPath.push(`winner: ${winner?.pattern ?? "?"} -> ${autonomy} (${reason})`);
+        return;
+    }
+    // APRV-266: a `policy.edit` sub-class nothing matched, decided by the
+    // `policy.edit` line. The trace says so in as many words, because the winning
+    // pattern does not match the class being explained and a reader who assumed
+    // it did would go looking for a rule that is not there.
+    if (provenance === "inherited") {
+        decisionPath.push(`no rule matched this policy.edit sub-class; it inherits the policy.edit line (SPEC §5.2, APRV-266) -> ${autonomy}`);
+        return;
+    }
+    if (load.policy.defaults?.autonomy === undefined) {
+        decisionPath.push("no rule matched and defaults.autonomy is absent; the absence of a grant is not a grant -> manual");
+        return;
+    }
+    decisionPath.push(`no rule matched; defaults.autonomy -> ${autonomy}`);
+}
+function describeFloor(decisionPath, reversible, autonomy, floorApplied, allowIrreversible, governingPatterns, overridden) {
+    if (reversible !== false)
+        return;
+    if (autonomy === "human-only") {
+        decisionPath.push("irreversibility floor (SPEC §7): outcome is human-only; neither the floor nor an override can enable agent execution");
+        return;
+    }
+    if (!floorApplied && allowIrreversible) {
+        decisionPath.push(`irreversibility policy (SPEC §5.2/§7): every equally most-specific rule explicitly allows irreversible execution (${governingPatterns.join(", ")}); the resolved autonomy remains in force`);
+        return;
+    }
+    if (!floorApplied || overridden === null) {
+        decisionPath.push("irreversibility floor (SPEC §7): outcome was already manual; the floor changed nothing");
+        return;
+    }
+    const source = overridden.pattern === null ? "defaults.autonomy" : overridden.pattern;
+    const governing = governingPatterns.length === 0
+        ? "defaults cannot opt in"
+        : `the governing rule group did not unanimously opt in (${governingPatterns.join(", ")})`;
+    decisionPath.push(`irreversibility floor (SPEC §7): ${governing}; reversible: false overrides ${source} (${overridden.autonomy}) -> manual`);
+}
+//# sourceMappingURL=policy-explain.js.map

package/dist/src/core/policy-explain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-explain.js","sourceRoot":"","sources":["../../../src/core/policy-explain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,OAAO,EACL,OAAO,EACP,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEvF,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AA+FD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,WAAwB;IAC/C,OAAO,YAAY,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,IAAsB,EACtB,WAAmB,EACnB,OAAO,GAAmB,EAAE;IAE5B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,YAAY,GAAa;QAC7B,SAAS,KAAK,CAAC,WAAW,CAAC,iBACzB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACxD,EAAE;KACH,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CACf,+BAA+B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,EAC5D,wFAAwF,EACxF,eAAe,CAChB,CAAC;QACF,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB,EAAE,QAAQ;gBAC1B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,iBAAiB,EAAE,KAAK;aACzB;YACD,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvD,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YAC3E,oBAAoB,EAAE,EAAE;YACxB,UAAU,EAAE,EAAE;YACd,YAAY;SACb,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC9E,kBAAkB,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE/E,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE;QAC9E,CAAC,CAAC,IAAI,CAAC;IACT,aAAa,CACX,YAAY,EACZ,UAAU,EACV,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,oBAAoB,EAC1B,UAAU,CACX,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,+CAA+C;IAC/C,YAAY,CAAC,IAAI,CACf,KAAK,CAAC,WAAW,KAAK,MAAM;QAC1B,CAAC,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gNAAgN;QAC/Q,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,CAAC,CAAC,+GAA+G;YACjH,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CACjC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,UAAU;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC;QAClE,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU;QACV,eAAe,EAAE,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAA0B,EAC1B,UAAsC;IAEtC,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC;IAClD,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC9D,IAAI,UAAU,CAAC,YAAY;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,UAAU,CAAC,iBAAiB;QAAE,OAAO,gBAAgB,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAkB,EAAE,YAAqB;IAChE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,UAA+F,EAC/F,aAA4B;IAE5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GACR,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjG,IAAI,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,CACjE,CAAC,MAAM,CAAC;IAET,MAAM,cAAc,GAClB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAEnG,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,KAAK,aAAa,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAyB;YACjC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;YACjC,MAAM;SACP,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QACzD,IAAI,KAAK;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAc,EAAE,CAAc;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAsB,EACtB,WAAmB,EACnB,UAAkC;IAElC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CACf,GAAG,UAAU,CAAC,MAAM,oBAAoB,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACnF,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAClC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,QAAQ,EAAE;SAC7E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,CACf,KAAK,SAAS,CAAC,OAAO,KAAK,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,SAAS,CAAC,QAAQ,EAAE;YAC3F,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,YAAsB,EACtB,IAA6C,EAC7C,UAAsB,EACtB,QAAkB,EAClB,UAAkC;IAElC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GACV,MAAM,EAAE,QAAQ,KAAK,oBAAoB;YACvC,CAAC,CAAC,iEAAiE;YACnE,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,eAAe;gBACpC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,kCAAkC,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CACf,yGAAyG,QAAQ,EAAE,CACpH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,YAAY,CAAC,IAAI,CACf,kGAAkG,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CACpB,YAAsB,EACtB,UAA0B,EAC1B,QAAkB,EAClB,YAAqB,EACrB,iBAA0B,EAC1B,iBAA2B,EAC3B,UAAyE;IAEzE,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO;IACjC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,YAAY,CAAC,IAAI,CACf,sHAAsH,CACvH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,iBAAiB,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,CACf,qHAAqH,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAC7L,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CACf,wFAAwF,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IACtF,MAAM,SAAS,GACb,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,wDAAwD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9F,YAAY,CAAC,IAAI,CACf,oCAAoC,SAAS,iCAAiC,MAAM,KAAK,UAAU,CAAC,QAAQ,aAAa,CAC1H,CAAC;AACJ,CAAC"}