approval-md 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (266) hide show
  1. package/README.md +584 -553
  2. package/SPEC.md +42 -13
  3. package/dist/src/adapters/agentmail.d.ts +426 -0
  4. package/dist/src/adapters/agentmail.js +2 -2
  5. package/dist/src/adapters/conformance.d.ts +149 -0
  6. package/dist/src/adapters/contract.d.ts +628 -0
  7. package/dist/src/adapters/contract.js +110 -16
  8. package/dist/src/adapters/contract.js.map +1 -1
  9. package/dist/src/adapters/email.d.ts +324 -0
  10. package/dist/src/adapters/env-passphrase.d.ts +93 -0
  11. package/dist/src/adapters/public.d.ts +11 -0
  12. package/dist/src/adapters/public.js +11 -0
  13. package/dist/src/adapters/public.js.map +1 -0
  14. package/dist/src/adapters/registry.d.ts +59 -0
  15. package/dist/src/adapters/registry.js +2 -1
  16. package/dist/src/adapters/registry.js.map +1 -1
  17. package/dist/src/adapters/smtp.d.ts +213 -0
  18. package/dist/src/adapters/vault-provider.d.ts +114 -0
  19. package/dist/src/adapters/vault-provider.js +3 -3
  20. package/dist/src/adapters/zzz.d.ts +66 -0
  21. package/dist/src/adapters/zzz.js +299 -0
  22. package/dist/src/adapters/zzz.js.map +1 -0
  23. package/dist/src/channels/batch.d.ts +109 -0
  24. package/dist/src/channels/cli.d.ts +193 -0
  25. package/dist/src/channels/conformance.d.ts +92 -0
  26. package/dist/src/channels/contract.d.ts +623 -0
  27. package/dist/src/channels/payload-view.d.ts +35 -0
  28. package/dist/src/channels/render-queue.d.ts +149 -0
  29. package/dist/src/channels/tagging.d.ts +196 -0
  30. package/dist/src/channels/telegram.d.ts +1832 -0
  31. package/dist/src/channels/web.d.ts +341 -0
  32. package/dist/src/cli/adapter.d.ts +90 -0
  33. package/dist/src/cli/adapter.js +25 -15
  34. package/dist/src/cli/adapter.js.map +1 -1
  35. package/dist/src/cli/amend.d.ts +59 -0
  36. package/dist/src/cli/args.d.ts +43 -0
  37. package/dist/src/cli/attest.d.ts +41 -0
  38. package/dist/src/cli/audit-card.d.ts +62 -0
  39. package/dist/src/cli/audit.d.ts +59 -0
  40. package/dist/src/cli/channel-telegram.d.ts +806 -0
  41. package/dist/src/cli/channel-web.d.ts +131 -0
  42. package/dist/src/cli/channel.d.ts +71 -0
  43. package/dist/src/cli/checkpoint-tap.d.ts +169 -0
  44. package/dist/src/cli/codex.d.ts +2 -0
  45. package/dist/src/cli/codex.js +172 -0
  46. package/dist/src/cli/codex.js.map +1 -0
  47. package/dist/src/cli/coverage.d.ts +61 -0
  48. package/dist/src/cli/daemon.d.ts +120 -0
  49. package/dist/src/cli/doctor.d.ts +129 -0
  50. package/dist/src/cli/doctor.js +119 -5
  51. package/dist/src/cli/doctor.js.map +1 -1
  52. package/dist/src/cli/env.d.ts +65 -0
  53. package/dist/src/cli/execute.d.ts +202 -0
  54. package/dist/src/cli/exit-codes.d.ts +73 -0
  55. package/dist/src/cli/feedback.d.ts +60 -0
  56. package/dist/src/cli/gate-window.d.ts +40 -0
  57. package/dist/src/cli/gate.d.ts +68 -0
  58. package/dist/src/cli/git-scope.d.ts +190 -0
  59. package/dist/src/cli/gloss-attach.d.ts +85 -0
  60. package/dist/src/cli/gloss-codex-child.d.ts +9 -0
  61. package/dist/src/cli/gloss-codex.d.ts +24 -0
  62. package/dist/src/cli/gloss-options.d.ts +42 -0
  63. package/dist/src/cli/gloss.d.ts +265 -0
  64. package/dist/src/cli/help.d.ts +103 -0
  65. package/dist/src/cli/help.js +173 -51
  66. package/dist/src/cli/help.js.map +1 -1
  67. package/dist/src/cli/hook-codex.d.ts +78 -0
  68. package/dist/src/cli/hook-codex.js +167 -0
  69. package/dist/src/cli/hook-codex.js.map +1 -0
  70. package/dist/src/cli/hook.d.ts +331 -0
  71. package/dist/src/cli/hook.js +186 -80
  72. package/dist/src/cli/hook.js.map +1 -1
  73. package/dist/src/cli/import.d.ts +35 -0
  74. package/dist/src/cli/init.d.ts +84 -0
  75. package/dist/src/cli/init.js +2 -2
  76. package/dist/src/cli/init.js.map +1 -1
  77. package/dist/src/cli/instructions.d.ts +23 -0
  78. package/dist/src/cli/journal.d.ts +41 -0
  79. package/dist/src/cli/log-advance.d.ts +287 -0
  80. package/dist/src/cli/log-advance.js +102 -11
  81. package/dist/src/cli/log-advance.js.map +1 -1
  82. package/dist/src/cli/log-anchor.d.ts +176 -0
  83. package/dist/src/cli/log-checkpoint.d.ts +22 -0
  84. package/dist/src/cli/log-sync.d.ts +243 -0
  85. package/dist/src/cli/log-verbs.d.ts +16 -0
  86. package/dist/src/cli/log-verbs.js +7 -1
  87. package/dist/src/cli/log-verbs.js.map +1 -1
  88. package/dist/src/cli/long-help.d.ts +70 -0
  89. package/dist/src/cli/main.d.ts +77 -0
  90. package/dist/src/cli/main.js +155 -5
  91. package/dist/src/cli/main.js.map +1 -1
  92. package/dist/src/cli/mcp.d.ts +52 -0
  93. package/dist/src/cli/paths.d.ts +56 -0
  94. package/dist/src/cli/payload.d.ts +58 -0
  95. package/dist/src/cli/policy.d.ts +43 -0
  96. package/dist/src/cli/preflight.d.ts +363 -0
  97. package/dist/src/cli/preflight.js +294 -7
  98. package/dist/src/cli/preflight.js.map +1 -1
  99. package/dist/src/cli/progress.d.ts +78 -0
  100. package/dist/src/cli/prompt.d.ts +209 -0
  101. package/dist/src/cli/quickstart.d.ts +46 -0
  102. package/dist/src/cli/quickstart.js +297 -0
  103. package/dist/src/cli/quickstart.js.map +1 -0
  104. package/dist/src/cli/records.d.ts +34 -0
  105. package/dist/src/cli/render.d.ts +22 -0
  106. package/dist/src/cli/sandbox.d.ts +51 -0
  107. package/dist/src/cli/scaffold.d.ts +79 -0
  108. package/dist/src/cli/setup-adapter.d.ts +137 -0
  109. package/dist/src/cli/setup-adapter.js +38 -4
  110. package/dist/src/cli/setup-adapter.js.map +1 -1
  111. package/dist/src/cli/setup-channel.d.ts +117 -0
  112. package/dist/src/cli/setup-checkpoint.d.ts +57 -0
  113. package/dist/src/cli/setup-common.d.ts +275 -0
  114. package/dist/src/cli/setup-flow.d.ts +287 -0
  115. package/dist/src/cli/setup-service.d.ts +96 -0
  116. package/dist/src/cli/setup.d.ts +202 -0
  117. package/dist/src/cli/style.d.ts +320 -0
  118. package/dist/src/cli/token.d.ts +39 -0
  119. package/dist/src/cli/up.d.ts +155 -0
  120. package/dist/src/cli/up.js +4 -2
  121. package/dist/src/cli/up.js.map +1 -1
  122. package/dist/src/cli/usage.d.ts +37 -0
  123. package/dist/src/cli/values.d.ts +40 -0
  124. package/dist/src/cli/vault.d.ts +59 -0
  125. package/dist/src/cli/vault.js +2 -2
  126. package/dist/src/cli/vault.js.map +1 -1
  127. package/dist/src/cli/verb-registry.d.ts +76 -0
  128. package/dist/src/cli/verb-registry.js +176 -8
  129. package/dist/src/cli/verb-registry.js.map +1 -1
  130. package/dist/src/cli/wordmark.d.ts +31 -0
  131. package/dist/src/cli/wordmark.js +2 -2
  132. package/dist/src/codex/doctor.d.ts +13 -0
  133. package/dist/src/codex/doctor.js +41 -0
  134. package/dist/src/codex/doctor.js.map +1 -0
  135. package/dist/src/codex/manifest.d.ts +49 -0
  136. package/dist/src/codex/manifest.js +103 -0
  137. package/dist/src/codex/manifest.js.map +1 -0
  138. package/dist/src/codex/templates.d.ts +41 -0
  139. package/dist/src/codex/templates.js +319 -0
  140. package/dist/src/codex/templates.js.map +1 -0
  141. package/dist/src/codex/trust.d.ts +19 -0
  142. package/dist/src/codex/trust.js +183 -0
  143. package/dist/src/codex/trust.js.map +1 -0
  144. package/dist/src/codex/workspace-plan.d.ts +131 -0
  145. package/dist/src/codex/workspace-plan.js +561 -0
  146. package/dist/src/codex/workspace-plan.js.map +1 -0
  147. package/dist/src/core/actor.d.ts +2 -0
  148. package/dist/src/core/actor.js +5 -0
  149. package/dist/src/core/actor.js.map +1 -0
  150. package/dist/src/core/advance-cycle.d.ts +170 -0
  151. package/dist/src/core/agents-md.d.ts +276 -0
  152. package/dist/src/core/apply-patch.d.ts +49 -0
  153. package/dist/src/core/apply-patch.js +266 -0
  154. package/dist/src/core/apply-patch.js.map +1 -0
  155. package/dist/src/core/attest.d.ts +420 -0
  156. package/dist/src/core/attest.js +13 -1
  157. package/dist/src/core/attest.js.map +1 -1
  158. package/dist/src/core/audit.d.ts +492 -0
  159. package/dist/src/core/budgets.d.ts +238 -0
  160. package/dist/src/core/checkpoint.d.ts +500 -0
  161. package/dist/src/core/child-env.d.ts +88 -0
  162. package/dist/src/core/clock.d.ts +52 -0
  163. package/dist/src/core/command-class.d.ts +543 -0
  164. package/dist/src/core/command-class.js +43 -8
  165. package/dist/src/core/command-class.js.map +1 -1
  166. package/dist/src/core/coverage-sources/adapter.d.ts +40 -0
  167. package/dist/src/core/coverage-sources/gh.d.ts +48 -0
  168. package/dist/src/core/coverage-sources/git.d.ts +101 -0
  169. package/dist/src/core/coverage.d.ts +217 -0
  170. package/dist/src/core/credential-spec.d.ts +72 -0
  171. package/dist/src/core/dark-session.d.ts +331 -0
  172. package/dist/src/core/decision-refusal.d.ts +185 -0
  173. package/dist/src/core/env-file.d.ts +450 -0
  174. package/dist/src/core/execute.d.ts +858 -0
  175. package/dist/src/core/execute.js +44 -6
  176. package/dist/src/core/execute.js.map +1 -1
  177. package/dist/src/core/frontmatter.d.ts +78 -0
  178. package/dist/src/core/gate-window.d.ts +312 -0
  179. package/dist/src/core/gate.d.ts +1364 -0
  180. package/dist/src/core/gate.js +68 -13
  181. package/dist/src/core/gate.js.map +1 -1
  182. package/dist/src/core/git-run.d.ts +73 -0
  183. package/dist/src/core/harness-version.d.ts +157 -0
  184. package/dist/src/core/harness-version.js +2 -1
  185. package/dist/src/core/harness-version.js.map +1 -1
  186. package/dist/src/core/harness-wait.d.ts +55 -0
  187. package/dist/src/core/head-retry.d.ts +107 -0
  188. package/dist/src/core/instance.d.ts +253 -0
  189. package/dist/src/core/intake-limits.d.ts +247 -0
  190. package/dist/src/core/jcs.d.ts +52 -0
  191. package/dist/src/core/journal.d.ts +144 -0
  192. package/dist/src/core/live-draw.d.ts +436 -0
  193. package/dist/src/core/log-reconcile.d.ts +89 -0
  194. package/dist/src/core/log-subscribe.d.ts +36 -0
  195. package/dist/src/core/log-subscribe.js +162 -0
  196. package/dist/src/core/log-subscribe.js.map +1 -0
  197. package/dist/src/core/log.d.ts +278 -0
  198. package/dist/src/core/loop.d.ts +274 -0
  199. package/dist/src/core/loop.js +11 -0
  200. package/dist/src/core/loop.js.map +1 -1
  201. package/dist/src/core/md-fence.d.ts +41 -0
  202. package/dist/src/core/money.d.ts +147 -0
  203. package/dist/src/core/payload-census.d.ts +74 -0
  204. package/dist/src/core/payload-store.d.ts +175 -0
  205. package/dist/src/core/payload.d.ts +71 -0
  206. package/dist/src/core/policy-diff.d.ts +292 -0
  207. package/dist/src/core/policy-diff.js +27 -4
  208. package/dist/src/core/policy-diff.js.map +1 -1
  209. package/dist/src/core/policy-expectations.d.ts +199 -0
  210. package/dist/src/core/policy-explain.d.ts +150 -0
  211. package/dist/src/core/policy-explain.js +31 -3
  212. package/dist/src/core/policy-explain.js.map +1 -1
  213. package/dist/src/core/policy-load.d.ts +527 -0
  214. package/dist/src/core/policy-load.js +15 -3
  215. package/dist/src/core/policy-load.js.map +1 -1
  216. package/dist/src/core/policy-match.d.ts +281 -0
  217. package/dist/src/core/policy-match.js +20 -9
  218. package/dist/src/core/policy-match.js.map +1 -1
  219. package/dist/src/core/policy-proposal.d.ts +265 -0
  220. package/dist/src/core/prompt-layout.d.ts +221 -0
  221. package/dist/src/core/protected-path-guard.d.ts +453 -0
  222. package/dist/src/core/protected-path-guard.js +514 -35
  223. package/dist/src/core/protected-path-guard.js.map +1 -1
  224. package/dist/src/core/registration.d.ts +25 -0
  225. package/dist/src/core/reindex.d.ts +99 -0
  226. package/dist/src/core/sampler.d.ts +313 -0
  227. package/dist/src/core/sandbox.d.ts +290 -0
  228. package/dist/src/core/seal.d.ts +165 -0
  229. package/dist/src/core/state.d.ts +505 -0
  230. package/dist/src/core/task-file.d.ts +185 -0
  231. package/dist/src/core/telegram-config.d.ts +93 -0
  232. package/dist/src/core/token.d.ts +409 -0
  233. package/dist/src/core/token.js +21 -38
  234. package/dist/src/core/token.js.map +1 -1
  235. package/dist/src/core/validate.d.ts +138 -0
  236. package/dist/src/core/values.d.ts +137 -0
  237. package/dist/src/core/vault.d.ts +291 -0
  238. package/dist/src/core/verified-snapshot.d.ts +204 -0
  239. package/dist/src/core/verify.d.ts +336 -0
  240. package/dist/src/core/version.d.ts +8 -0
  241. package/dist/src/core/wysiwys.d.ts +370 -0
  242. package/dist/src/daemon/advance-child.d.ts +39 -0
  243. package/dist/src/daemon/advance.d.ts +466 -0
  244. package/dist/src/daemon/audit.d.ts +87 -0
  245. package/dist/src/daemon/daemon.d.ts +1180 -0
  246. package/dist/src/daemon/dark-session.d.ts +64 -0
  247. package/dist/src/daemon/draw-child.d.ts +36 -0
  248. package/dist/src/daemon/draw.d.ts +154 -0
  249. package/dist/src/daemon/git-evidence.d.ts +173 -0
  250. package/dist/src/daemon/git-evidence.js +1 -1
  251. package/dist/src/daemon/projection.d.ts +180 -0
  252. package/dist/src/daemon/prune.d.ts +207 -0
  253. package/dist/src/mcp/http.d.ts +113 -0
  254. package/dist/src/mcp/server.d.ts +265 -0
  255. package/dist/src/mcp/server.js +9 -1
  256. package/dist/src/mcp/server.js.map +1 -1
  257. package/docs/adapter-api.md +106 -0
  258. package/docs/cli-reference.md +389 -36
  259. package/docs/codex-enforced-session.md +30 -0
  260. package/package.json +12 -2
  261. package/schema/codex-instance.schema.json +82 -0
  262. package/schema/event.schema.json +2 -1
  263. package/schema/fixtures/codex-instance/invalid/unpinned-codex-version.json +40 -0
  264. package/schema/fixtures/codex-instance/valid/canonical.json +40 -0
  265. package/schema/policy.schema.json +21 -1
  266. package/templates/codex/README.md +9 -0
@@ -0,0 +1,199 @@
1
+ /**
2
+ * Policy PINS: what a policy file is expected to resolve to, as data (APRV-203).
3
+ *
4
+ * The repository's own policy file has always been pinned: the dogfood suite in
5
+ * `tests/` asserts the autonomy and provenance the matcher resolves for every class
6
+ * the policy declares, so an edit that changes what the gate does fails `npm test`
7
+ * rather than being discovered by an agent doing something it should not have been
8
+ * allowed to do. The pins lived inside that test file, which meant the amendment
9
+ * ceremony could not read them: `approval policy amend` would attest, commit and
10
+ * push a policy edit whose pins nobody had updated, and CI found out afterwards.
11
+ *
12
+ * So the pins moved here, to a module the test and the ceremony both import, and
13
+ * `policy amend` runs {@link checkPolicyExpectations} against the AMENDED file
14
+ * before it pushes anything. One home for the pins; two readers.
15
+ *
16
+ * ## Why this module knows about one particular repository
17
+ *
18
+ * These pins are facts about approval.md's own policy, and no other repository's
19
+ * policy has anything to do with them. {@link expectationsFor} therefore answers
20
+ * them only when the policy being amended belongs to the `approval-md` package
21
+ * itself, and answers `null` everywhere else, where the ceremony simply says it
22
+ * has no expectation set to check. A shipped CLI that applied this repository's
23
+ * pins to a user's policy would refuse every amendment they ever made.
24
+ */
25
+ import type { Autonomy, PolicyLoadResult } from "./policy-load.js";
26
+ import { type Provenance } from "./policy-match.js";
27
+ /** One pinned class resolution. */
28
+ export interface PolicyExpectation {
29
+ actionClass: string;
30
+ autonomy: Autonomy;
31
+ provenance: Provenance;
32
+ /** Why this pin reads the way it does. Printed with a failure. */
33
+ note?: string;
34
+ }
35
+ /**
36
+ * The pins for this repository's `APPROVAL.md`.
37
+ *
38
+ * ## What earns a pin (APRV-296)
39
+ *
40
+ * A pin is a class whose LOOSENING is a security regression, so the ceremony
41
+ * refuses before the bytes are attested rather than after CI reads them. Three
42
+ * families qualify and nothing else does: the `human-only` classes, where a
43
+ * looser level would mint agent authority over the gate's own organs; the
44
+ * `manual` classes whose looser level puts an irreversible or third-party
45
+ * effect behind no human; and the fail-closed DEFAULT itself, pinned through
46
+ * classes the policy deliberately does not declare, so a policy that stopped
47
+ * defaulting to `manual` fails here even though every declared class still
48
+ * resolves as written. Each pin's note says which of those it is and what the
49
+ * loosening would cost.
50
+ *
51
+ * Until APRV-296 the list also pinned every OTHER class the policy declared,
52
+ * in both directions, and the 2026-09-07 ceremony is what that cost: a one-line
53
+ * TTL change plus one newly declared class turned into three failed runs,
54
+ * because tuning `vcs.pr.create` or `log.advance` was also a code change to be
55
+ * built before the ceremony would accept it. Those pins protected nothing —
56
+ * loosening a class that is already `autonomous` is not a direction, and the
57
+ * dangerous direction for `vcs.push.main` is held by the irreversibility floor
58
+ * (SPEC.md §7), which `tests/dogfood.test.ts` pins on its own. Every
59
+ * resolution change, pinned or not, still prints in the ceremony's semantic
60
+ * diff and is still attested by a human who read it.
61
+ *
62
+ * A class this list does NOT name is accepted, in the ceremony and in the
63
+ * dogfood suite alike: declaring a new `supervised` or `autonomous` class is a
64
+ * policy amendment and needs no code change. The other direction still fails —
65
+ * a pin naming a class the policy no longer resolves that way is a refusal,
66
+ * which is the whole point of the list.
67
+ */
68
+ export declare const REPO_POLICY_EXPECTATIONS: readonly PolicyExpectation[];
69
+ /**
70
+ * One way the amended policy failed its pins. Machine-readable by `kind`.
71
+ *
72
+ * `unpinned` was a fourth kind until APRV-296, raised when the policy declared
73
+ * a class this list did not name. It is gone with the rule that produced it: a
74
+ * declared class carrying no pin is now accepted, so declaring a `supervised`
75
+ * or `autonomous` class is a policy amendment and not also a code change.
76
+ */
77
+ export interface ExpectationFailure {
78
+ kind: "resolution" | "floor" | "unreachable";
79
+ actionClass: string;
80
+ expected: string;
81
+ actual: string;
82
+ note?: string;
83
+ }
84
+ /**
85
+ * One pin, as the source line a human pastes into {@link REPO_POLICY_EXPECTATIONS}.
86
+ *
87
+ * The single-line form the list already uses for a pin with no note. A pin
88
+ * worth a note gets one from the person who knows why it reads that way, which
89
+ * is not something a resolution can supply — and since APRV-296 every pin in
90
+ * that list is worth a note, because a pin exists only where loosening the
91
+ * class would be a regression and the note is where that argument is written.
92
+ *
93
+ * No refusal prints this line any more. The ceremony used to hand it to an
94
+ * operator whose policy declared an unpinned class; nothing is unpinned now, so
95
+ * this is the spelling a human uses when they decide a NEW class belongs in the
96
+ * safety set. Printed, never applied: no verb in this repository writes the
97
+ * pins file.
98
+ */
99
+ export declare function pinLine(actionClass: string, autonomy: string, provenance: string): string;
100
+ /** One line per failure, in the shape a terminal and a `--json` array share. */
101
+ export declare function describeFailure(failure: ExpectationFailure): string;
102
+ /**
103
+ * Check a loaded policy against its pins.
104
+ *
105
+ * Three ways to fail. A pinned class that no longer resolves as pinned is the
106
+ * one the list exists for: the pins name only classes whose loosening is a
107
+ * regression (APRV-296), so a failure here is a policy that moved one of them.
108
+ * A pinned resolution the irreversibility floor decided is a pin that stopped
109
+ * measuring the rule. And a class the command classifier cannot emit is a
110
+ * policy line that will never fire.
111
+ *
112
+ * What is NOT a failure, since APRV-296: a class the policy declares and this
113
+ * list does not pin. The pins are a safety floor rather than an inventory, and
114
+ * a policy declaring a new `supervised` or `autonomous` class needs no code
115
+ * change to be accepted. The resolution still prints in the ceremony's semantic
116
+ * diff, where a human reads it before attesting.
117
+ */
118
+ export declare function checkPolicyExpectations(load: PolicyLoadResult, expectations: readonly PolicyExpectation[]): {
119
+ ok: boolean;
120
+ failures: ExpectationFailure[];
121
+ };
122
+ /** The name of the module a human edits when a pin has to move. */
123
+ export declare const EXPECTATIONS_MODULE = "src/core/policy-expectations.ts";
124
+ /**
125
+ * The dogfood suite, in source and as the build output that actually runs
126
+ * (APRV-274). Repo-relative, so a caller joins them onto the repository root.
127
+ *
128
+ * Both spellings are needed and they answer different questions. The SOURCE
129
+ * says whether this repository has a dogfood suite at all, which is what keeps
130
+ * the ceremony inert in somebody else's checkout. The BUILT file is what a
131
+ * ceremony runs, and its absence beside a present source is a stale build: the
132
+ * pins the suite would read are the ones in `dist/`, so a ceremony that ran the
133
+ * suite there would be checking the previous edit's pins.
134
+ */
135
+ export declare const DOGFOOD_SUITE_SOURCE = "tests/dogfood.test.ts";
136
+ export declare const DOGFOOD_SUITE_BUILT = "dist/tests/dogfood.test.js";
137
+ /** One pin as the source text spells it: what class, resolving to what. */
138
+ export interface PinSourceEntry {
139
+ actionClass: string;
140
+ /** `autonomy/provenance` as written, or `null` where the text is unreadable. */
141
+ resolution: string | null;
142
+ }
143
+ /**
144
+ * How one class's pin moved between two versions of the pins module.
145
+ *
146
+ * `null` on a side means the class was NOT PINNED in that version, and it is
147
+ * the only thing it means: an entry whose resolution the reader could not make
148
+ * out reads `"unreadable"` there, so "nobody pinned this" and "the pin is
149
+ * written in a shape this reader does not know" never arrive as the same fact.
150
+ */
151
+ export interface PinChange {
152
+ actionClass: string;
153
+ before: string | null;
154
+ after: string | null;
155
+ }
156
+ /**
157
+ * The pins a version of the module TEXT declares (APRV-274).
158
+ *
159
+ * A DISPLAY reader and nothing else. It exists so the amendment ceremony can
160
+ * show what the pins file did between the commit it is built on and the working
161
+ * tree, and the committed side of that comparison is a git blob: TypeScript
162
+ * source, with no build output to import. Nothing here gates anything. The pin
163
+ * check that can refuse a ceremony resolves the COMPILED
164
+ * {@link REPO_POLICY_EXPECTATIONS} against a loaded policy, exactly as it did
165
+ * before this function existed, so a text this reader misreads costs a report
166
+ * line and never a wrong verdict.
167
+ *
168
+ * The read is lexical and SCOPED to the named array literal, which matters:
169
+ * this very module mentions `actionClass` outside the pins (in the failure it
170
+ * builds for a policy that does not parse), and a reader that swept the whole
171
+ * file would report that mention as a pin. Inside the array, entries are split
172
+ * on `actionClass:`, and within one entry the first `autonomy:` and
173
+ * `provenance:` string literals are its resolution. That holds for a list
174
+ * written in the shape this module's own list is written in, where both fields
175
+ * precede the free-text `note`. An entry it cannot read is reported with a
176
+ * `null` resolution rather than dropped, so a pin that moved is never silently
177
+ * absent from the report.
178
+ */
179
+ export declare function readPinSource(text: string, constant?: string): PinSourceEntry[];
180
+ /**
181
+ * How the pins moved from one version of the module text to another, sorted by
182
+ * class so two runs of the same ceremony print the same report.
183
+ *
184
+ * A class pinned twice in one version keeps the FIRST reading, which is what
185
+ * the compiled list resolves to as well: {@link checkPolicyExpectations} walks
186
+ * the array in order and a duplicate cannot change an earlier entry's verdict.
187
+ */
188
+ export declare function diffPinSources(before: string, after: string): PinChange[];
189
+ /** One pin change on one line, for a terminal and for a `--json` array. */
190
+ export declare function describePinChange(change: PinChange): string;
191
+ /**
192
+ * The pins that govern `policyPath`, or `null` when none do.
193
+ *
194
+ * The test is package identity and nothing looser: the nearest `package.json`
195
+ * above the policy file names `approval-md`. A copy of the policy carried into
196
+ * some other repository is not this repository's policy, and a user's own
197
+ * `APPROVAL.md` is nobody's business but theirs.
198
+ */
199
+ export declare function expectationsFor(policyPath: string): readonly PolicyExpectation[] | null;
@@ -0,0 +1,150 @@
1
+ /**
2
+ * Policy explanation: the decision trace behind an autonomy resolution
3
+ * (SPEC.md §5.2, §7, and the `approval policy check|test` command of §10.1).
4
+ *
5
+ * `resolve()` in `policy-match.ts` answers *what* policy does with a class.
6
+ * This module answers *why*, in two registers at once: a frozen machine-readable
7
+ * {@link Explanation} for agents, and an ordered list of human sentences
8
+ * (`decisionPath`) that the CLI prints verbatim. Both are derived from the same
9
+ * `Resolution`; nothing here re-implements matching, specificity, tie-breaking
10
+ * or the floor, because a trace that computed the answer a second time could
11
+ * disagree with the answer — and the trace would be the more convincing lie.
12
+ *
13
+ * ## The three reasons an outcome is `manual` (SPEC.md §5.2, §7)
14
+ *
15
+ * `manual` is the system's resting state, and "why manual" is the question a
16
+ * human actually asks. {@link Explanation.manualBecause} names exactly one of:
17
+ *
18
+ * - `"matched-rule"` — a `classes` rule (or `defaults.autonomy`) says `manual`.
19
+ * The policy was read, understood, and it says ask.
20
+ * - `"irreversibility-floor"` — the policy granted `autonomous`/`supervised`,
21
+ * and §7's floor overrode it because the action declared `reversible: false`.
22
+ * The policy is *not* what produced this answer, and {@link
23
+ * Explanation.overridden} records what it did say.
24
+ * - `"load-failure"` — the policy could not be loaded, so every class is
25
+ * `manual`. {@link Explanation.loadFailure} carries the code and message.
26
+ *
27
+ * The distinction is operational, not cosmetic: the first is working as
28
+ * intended, the second means the caller under-declared or over-reached, and the
29
+ * third means someone must go fix a file. Collapsing them into "manual" hides
30
+ * a broken policy behind an answer that looks deliberate.
31
+ *
32
+ * ## Determinism
33
+ *
34
+ * Pure: no I/O, no clock, no randomness, no caching. `explain(load, class, opts)`
35
+ * is deeply equal across calls, including `decisionPath` strings, because
36
+ * `resolve()` already imposes a total order on candidates.
37
+ */
38
+ import type { Autonomy, DeclaredAutonomy, PolicyClassRule, PolicyLoadErrorCode, PolicyLoadResult, SupervisionMode } from "./policy-load.js";
39
+ import { type Provenance, type Specificity } from "./policy-match.js";
40
+ /**
41
+ * Action-class grammar for a *concrete* class (not a pattern).
42
+ *
43
+ * `schema/policy.schema.json`'s `classPattern` admits `*` because a policy key
44
+ * is a pattern. The thing being explained is an action, and an action's class is
45
+ * never a wildcard: asking "what does policy do with `read.*`" is a category
46
+ * error — `read.*` is not something an agent can do. Uppercase, whitespace,
47
+ * empty segments and leading/trailing dots are rejected for the same reason the
48
+ * schema rejects them in keys: they can never name a real action.
49
+ */
50
+ export declare const ACTION_CLASS_PATTERN: RegExp;
51
+ /** Does `value` name a concrete action class? See {@link ACTION_CLASS_PATTERN}. */
52
+ export declare function isActionClass(value: string): boolean;
53
+ /** Why a `manual` outcome is `manual`. `null` when the outcome is not manual. */
54
+ export type ManualBecause = "matched-rule" | "irreversibility-floor" | "load-failure";
55
+ /** How a candidate won, or that it merely tied. */
56
+ export type TieBreak =
57
+ /** Strictly the most specific match; no tie to break. */
58
+ "specificity"
59
+ /** Tied on specificity; won because it is the strictest autonomy. */
60
+ | "strictest-autonomy"
61
+ /** Tied on specificity and strictness; won on lexicographic pattern order. */
62
+ | "lexicographic"
63
+ /** Tied with the winner on specificity, and lost the tie-break. */
64
+ | "tied-specificity";
65
+ /** The resolved grant, flattened for consumers that only want the answer. */
66
+ export interface ExplanationOutcome {
67
+ autonomy: Autonomy;
68
+ /**
69
+ * Amended SPEC.md §5.2 (APRV-127): the level the winning rule actually wrote.
70
+ * Equals `autonomy` except for the two supervised spellings, where it is the
71
+ * word the policy uses and `autonomy` is what is enforced.
72
+ */
73
+ declaredAutonomy: DeclaredAutonomy;
74
+ /** `"live"` / `"retro"` for a supervised outcome, `null` otherwise. */
75
+ supervision: SupervisionMode | null;
76
+ /** The live fraction, for a `supervised-live` outcome only. */
77
+ liveRate: number | null;
78
+ /** Approvers carried from the matched rule; `null` when unset or unmatched. */
79
+ approvers: string[] | null;
80
+ /** Limits carried from the matched rule; `null` when unset or unmatched. */
81
+ limits: Record<string, number> | null;
82
+ /** Explicit permission supplied by the governing max-specificity rule group. */
83
+ allowIrreversible: boolean;
84
+ }
85
+ export type IrreversibilityDecision = "not-applicable" | "policy-allowed" | "floor-applied" | "already-manual" | "human-only";
86
+ /** One rule that matched the class, with why it did or did not win. */
87
+ export interface ExplanationCandidate {
88
+ pattern: string;
89
+ /** `[literalSegments, wildcardSegments, totalSegments]` (SPEC.md §5.2). */
90
+ specificity: Specificity;
91
+ /** The level the rule WROTE (APRV-127): `supervised-live` stays itself here. */
92
+ autonomy: DeclaredAutonomy;
93
+ winner: boolean;
94
+ /** Present only for the winner and for candidates tied with it. */
95
+ tieBreak?: TieBreak;
96
+ }
97
+ /**
98
+ * The frozen machine-readable trace. `approval policy check --json` prints this
99
+ * object verbatim, so field names and value domains are public API.
100
+ */
101
+ export interface Explanation {
102
+ /** The class that was asked about, echoed back. */
103
+ class: string;
104
+ /** `reversible` as supplied; `null` when the caller did not state it. */
105
+ reversible: boolean | null;
106
+ outcome: ExplanationOutcome;
107
+ provenance: Provenance;
108
+ manualBecause: ManualBecause | null;
109
+ /** Set only when the policy failed to load (`provenance: "fail-closed"`). */
110
+ loadFailure: {
111
+ code: PolicyLoadErrorCode;
112
+ message: string;
113
+ } | null;
114
+ /** The winning rule, or `null` for a default / fail-closed outcome. */
115
+ matched: {
116
+ pattern: string;
117
+ rule: PolicyClassRule;
118
+ } | null;
119
+ /**
120
+ * What the floor overrode: the pre-floor autonomy and the rule that granted
121
+ * it. `pattern` is `null` when the grant came from `defaults.autonomy` rather
122
+ * than a rule. `null` overall when the floor did not apply.
123
+ */
124
+ overridden: {
125
+ pattern: string | null;
126
+ autonomy: DeclaredAutonomy;
127
+ } | null;
128
+ /** How a truthful `reversible: false` declaration affected this answer. */
129
+ irreversibility: IrreversibilityDecision;
130
+ /** The equally most-specific rules whose unanimous opt-in governs permission. */
131
+ irreversiblePatterns: string[];
132
+ /** Every matching rule, most specific first (order from `resolve()`). */
133
+ candidates: ExplanationCandidate[];
134
+ /** Ordered human sentences narrating the decision; what the CLI prints. */
135
+ decisionPath: string[];
136
+ }
137
+ /** Options for {@link explain}. */
138
+ export interface ExplainOptions {
139
+ /** `false` engages the SPEC.md §7 irreversibility floor. */
140
+ reversible?: boolean;
141
+ }
142
+ /**
143
+ * Explain what `load`'s policy does with `actionClass`.
144
+ *
145
+ * Matching is delegated wholly to {@link resolve}: it is called twice, once
146
+ * without options to observe the pre-floor autonomy and once with them for the
147
+ * final answer. Two calls of a pure function are cheaper than a second
148
+ * implementation of the floor.
149
+ */
150
+ export declare function explain(load: PolicyLoadResult, actionClass: string, options?: ExplainOptions): Explanation;
@@ -84,12 +84,15 @@ export function explain(load, actionClass, options = {}) {
84
84
  liveRate: null,
85
85
  approvers: null,
86
86
  limits: null,
87
+ allowIrreversible: false,
87
88
  },
88
89
  provenance: "fail-closed",
89
90
  manualBecause: "load-failure",
90
91
  loadFailure: { code: load.code, message: load.message },
91
92
  matched: null,
92
93
  overridden: null,
94
+ irreversibility: reversible === false ? "already-manual" : "not-applicable",
95
+ irreversiblePatterns: [],
93
96
  candidates: [],
94
97
  decisionPath,
95
98
  };
@@ -101,7 +104,7 @@ export function explain(load, actionClass, options = {}) {
101
104
  const overridden = final.floorApplied
102
105
  ? { pattern: final.matched?.pattern ?? null, autonomy: base.declaredAutonomy }
103
106
  : null;
104
- describeFloor(decisionPath, reversible, final.floorApplied, overridden);
107
+ describeFloor(decisionPath, reversible, final.autonomy, final.floorApplied, final.allowIrreversible, final.irreversiblePatterns, overridden);
105
108
  // APRV-127: name the mode, because "supervised" no longer says enough. A
106
109
  // reader deciding whether to expect a prompt needs to know whether a fraction
107
110
  // of this class stops first, and at what rate.
@@ -120,16 +123,30 @@ export function explain(load, actionClass, options = {}) {
120
123
  liveRate: final.liveRate,
121
124
  approvers: final.approvers,
122
125
  limits: final.limits,
126
+ allowIrreversible: final.allowIrreversible,
123
127
  },
124
128
  provenance: final.provenance,
125
129
  manualBecause: manualBecauseOf(final.autonomy, final.floorApplied),
126
130
  loadFailure: null,
127
131
  matched: final.matched,
128
132
  overridden,
133
+ irreversibility: irreversibilityDecision(reversible, final),
134
+ irreversiblePatterns: final.irreversiblePatterns,
129
135
  candidates,
130
136
  decisionPath,
131
137
  };
132
138
  }
139
+ function irreversibilityDecision(reversible, resolution) {
140
+ if (reversible !== false)
141
+ return "not-applicable";
142
+ if (resolution.autonomy === "human-only")
143
+ return "human-only";
144
+ if (resolution.floorApplied)
145
+ return "floor-applied";
146
+ if (resolution.allowIrreversible)
147
+ return "policy-allowed";
148
+ return "already-manual";
149
+ }
133
150
  /**
134
151
  * A non-manual outcome has no "because": the question only arises for `manual`.
135
152
  * The floor is checked before the rule, because when both are true it is the
@@ -217,14 +234,25 @@ function describeWinner(decisionPath, load, provenance, autonomy, candidates) {
217
234
  }
218
235
  decisionPath.push(`no rule matched; defaults.autonomy -> ${autonomy}`);
219
236
  }
220
- function describeFloor(decisionPath, reversible, floorApplied, overridden) {
237
+ function describeFloor(decisionPath, reversible, autonomy, floorApplied, allowIrreversible, governingPatterns, overridden) {
221
238
  if (reversible !== false)
222
239
  return;
240
+ if (autonomy === "human-only") {
241
+ decisionPath.push("irreversibility floor (SPEC §7): outcome is human-only; neither the floor nor an override can enable agent execution");
242
+ return;
243
+ }
244
+ if (!floorApplied && allowIrreversible) {
245
+ decisionPath.push(`irreversibility policy (SPEC §5.2/§7): every equally most-specific rule explicitly allows irreversible execution (${governingPatterns.join(", ")}); the resolved autonomy remains in force`);
246
+ return;
247
+ }
223
248
  if (!floorApplied || overridden === null) {
224
249
  decisionPath.push("irreversibility floor (SPEC §7): outcome was already manual; the floor changed nothing");
225
250
  return;
226
251
  }
227
252
  const source = overridden.pattern === null ? "defaults.autonomy" : overridden.pattern;
228
- decisionPath.push(`irreversibility floor (SPEC §7): reversible: false overrides ${source} (${overridden.autonomy}) -> manual`);
253
+ const governing = governingPatterns.length === 0
254
+ ? "defaults cannot opt in"
255
+ : `the governing rule group did not unanimously opt in (${governingPatterns.join(", ")})`;
256
+ decisionPath.push(`irreversibility floor (SPEC §7): ${governing}; reversible: false overrides ${source} (${overridden.autonomy}) -> manual`);
229
257
  }
230
258
  //# sourceMappingURL=policy-explain.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"policy-explain.js","sourceRoot":"","sources":["../../../src/core/policy-explain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,OAAO,EACL,OAAO,EACP,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEvF,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAkFD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,WAAwB;IAC/C,OAAO,YAAY,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,IAAsB,EACtB,WAAmB,EACnB,OAAO,GAAmB,EAAE;IAE5B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,YAAY,GAAa;QAC7B,SAAS,KAAK,CAAC,WAAW,CAAC,iBACzB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACxD,EAAE;KACH,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CACf,+BAA+B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,EAC5D,wFAAwF,EACxF,eAAe,CAChB,CAAC;QACF,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB,EAAE,QAAQ;gBAC1B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;aACb;YACD,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvD,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,EAAE;YACd,YAAY;SACb,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC9E,kBAAkB,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE/E,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE;QAC9E,CAAC,CAAC,IAAI,CAAC;IACT,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACxE,yEAAyE;IACzE,8EAA8E;IAC9E,+CAA+C;IAC/C,YAAY,CAAC,IAAI,CACf,KAAK,CAAC,WAAW,KAAK,MAAM;QAC1B,CAAC,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gNAAgN;QAC/Q,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,CAAC,CAAC,+GAA+G;YACjH,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CACjC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,UAAU;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC;QAClE,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU;QACV,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAkB,EAAE,YAAqB;IAChE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,UAA+F,EAC/F,aAA4B;IAE5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GACR,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjG,IAAI,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,CACjE,CAAC,MAAM,CAAC;IAET,MAAM,cAAc,GAClB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAEnG,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,KAAK,aAAa,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAyB;YACjC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;YACjC,MAAM;SACP,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QACzD,IAAI,KAAK;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAc,EAAE,CAAc;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAsB,EACtB,WAAmB,EACnB,UAAkC;IAElC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CACf,GAAG,UAAU,CAAC,MAAM,oBAAoB,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACnF,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAClC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,QAAQ,EAAE;SAC7E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,CACf,KAAK,SAAS,CAAC,OAAO,KAAK,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,SAAS,CAAC,QAAQ,EAAE;YAC3F,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,YAAsB,EACtB,IAA6C,EAC7C,UAAsB,EACtB,QAAkB,EAClB,UAAkC;IAElC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GACV,MAAM,EAAE,QAAQ,KAAK,oBAAoB;YACvC,CAAC,CAAC,iEAAiE;YACnE,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,eAAe;gBACpC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,kCAAkC,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CACf,yGAAyG,QAAQ,EAAE,CACpH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,YAAY,CAAC,IAAI,CACf,kGAAkG,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CACpB,YAAsB,EACtB,UAA0B,EAC1B,YAAqB,EACrB,UAAyE;IAEzE,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO;IACjC,IAAI,CAAC,YAAY,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CACf,wFAAwF,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IACtF,YAAY,CAAC,IAAI,CACf,gEAAgE,MAAM,KAAK,UAAU,CAAC,QAAQ,aAAa,CAC5G,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"policy-explain.js","sourceRoot":"","sources":["../../../src/core/policy-explain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,OAAO,EACL,OAAO,EACP,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEvF,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AA+FD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,WAAwB;IAC/C,OAAO,YAAY,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,IAAsB,EACtB,WAAmB,EACnB,OAAO,GAAmB,EAAE;IAE5B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,YAAY,GAAa;QAC7B,SAAS,KAAK,CAAC,WAAW,CAAC,iBACzB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACxD,EAAE;KACH,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CACf,+BAA+B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,EAC5D,wFAAwF,EACxF,eAAe,CAChB,CAAC;QACF,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB,EAAE,QAAQ;gBAC1B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,iBAAiB,EAAE,KAAK;aACzB;YACD,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvD,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YAC3E,oBAAoB,EAAE,EAAE;YACxB,UAAU,EAAE,EAAE;YACd,YAAY;SACb,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC9E,kBAAkB,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE/E,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE;QAC9E,CAAC,CAAC,IAAI,CAAC;IACT,aAAa,CACX,YAAY,EACZ,UAAU,EACV,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,oBAAoB,EAC1B,UAAU,CACX,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,+CAA+C;IAC/C,YAAY,CAAC,IAAI,CACf,KAAK,CAAC,WAAW,KAAK,MAAM;QAC1B,CAAC,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gNAAgN;QAC/Q,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,CAAC,CAAC,+GAA+G;YACjH,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CACjC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,UAAU;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC;QAClE,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU;QACV,eAAe,EAAE,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAA0B,EAC1B,UAAsC;IAEtC,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC;IAClD,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC9D,IAAI,UAAU,CAAC,YAAY;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,UAAU,CAAC,iBAAiB;QAAE,OAAO,gBAAgB,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAkB,EAAE,YAAqB;IAChE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,UAA+F,EAC/F,aAA4B;IAE5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GACR,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjG,IAAI,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,CACjE,CAAC,MAAM,CAAC;IAET,MAAM,cAAc,GAClB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAEnG,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,KAAK,aAAa,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAyB;YACjC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;YACjC,MAAM;SACP,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QACzD,IAAI,KAAK;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAc,EAAE,CAAc;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAsB,EACtB,WAAmB,EACnB,UAAkC;IAElC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CACf,GAAG,UAAU,CAAC,MAAM,oBAAoB,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACnF,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAClC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,QAAQ,EAAE;SAC7E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,CACf,KAAK,SAAS,CAAC,OAAO,KAAK,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,SAAS,CAAC,QAAQ,EAAE;YAC3F,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,YAAsB,EACtB,IAA6C,EAC7C,UAAsB,EACtB,QAAkB,EAClB,UAAkC;IAElC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GACV,MAAM,EAAE,QAAQ,KAAK,oBAAoB;YACvC,CAAC,CAAC,iEAAiE;YACnE,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,eAAe;gBACpC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,kCAAkC,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CACf,yGAAyG,QAAQ,EAAE,CACpH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,YAAY,CAAC,IAAI,CACf,kGAAkG,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CACpB,YAAsB,EACtB,UAA0B,EAC1B,QAAkB,EAClB,YAAqB,EACrB,iBAA0B,EAC1B,iBAA2B,EAC3B,UAAyE;IAEzE,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO;IACjC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,YAAY,CAAC,IAAI,CACf,sHAAsH,CACvH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,iBAAiB,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,CACf,qHAAqH,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAC7L,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CACf,wFAAwF,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IACtF,MAAM,SAAS,GACb,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,wDAAwD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9F,YAAY,CAAC,IAAI,CACf,oCAAoC,SAAS,iCAAiC,MAAM,KAAK,UAAU,CAAC,QAAQ,aAAa,CAC1H,CAAC;AACJ,CAAC"}