approval-md 0.1.0 → 0.3.0

package/dist/src/core/payload-store.d.ts

@@ -0,0 +1,175 @@
+/**
+ * The payload store: one source of bytes for the gate, the render, and every
+ * channel (SPEC.md §6.2, §9, §10.4; APRV-28).
+ *
+ * SPEC.md §6.2 already asks for this in one clause — "The payload itself is
+ * stored or referenced by the request so channels can display it; the hash is
+ * what approval binds to" — and until now nothing implemented it. The bytes a
+ * human had to see before deciding were carried around the runtime by hand:
+ * `--payload-dir` for the CLI and web channels, `--payloads` for Telegram, and
+ * nothing at all for `approval render`, which is why QUEUE.md's pending count
+ * disagreed with the queue every channel showed (the APRV-27 friction case).
+ *
+ * ## What this is
+ *
+ * A content-addressed directory, `.approval/payloads/` beside the log, holding
+ * one file per bound payload: `<payload_hash>.json`, whose contents are the
+ * exact material whose RFC 8785 canonical serialization hashes to the filename.
+ * The name *is* the checksum, so the store needs no index, no manifest and no
+ * lock: two writers writing the same payload write the same bytes to the same
+ * path, and a file either verifies or it is refused.
+ *
+ * ## Verified on every read, without exception
+ *
+ * {@link loadPayload} re-canonicalizes and re-hashes what it read and compares
+ * that against the filename before returning anything. A file whose contents
+ * were edited after it was written refuses `hash-mismatch` and its value is
+ * **never returned**, so tampering with the store cannot put different bytes in
+ * front of an approver than the ones the request bound to. The recorded binding
+ * on `approval.requested` stays authoritative in both directions: the store is a
+ * cache of bytes that the log already committed to, and when the two disagree
+ * the log is right and the store is refused.
+ *
+ * This is the same rule the rest of the codebase keeps — files are the
+ * interface, the log is the truth, the database (and now the store) is a cache.
+ *
+ * ## External references
+ *
+ * A request may name material this runtime cannot hold: a message body in a
+ * vault, an object in a bucket. The store records that as `{"$ref": "<uri>"}` in
+ * the same `<hash>.json` file, and {@link loadPayload} reports it as a
+ * `reference` — deliberately **not** resolved. Resolving a URI would mean
+ * fetching bytes at render time from a source this module cannot verify, and a
+ * channel that displayed them would be showing an approver something no hash
+ * ever bound. So a reference renders as a reference: the channel says where the
+ * payload lives and refuses to pretend it has seen it.
+ *
+ * ## Writes never touch the log
+ *
+ * Nothing here opens `events.jsonl`. {@link storePayload} writes exactly one
+ * file, atomically (temp + rename in the destination directory), and the store
+ * directory is a sibling of the log directory rather than a child, so no
+ * conceivable store path collides with the log's.
+ */
+/** The directory name, beside the log's home: `.approval/payloads/`. */
+export declare const PAYLOAD_STORE_DIRNAME = "payloads";
+/**
+ * The store directory for a given log path — the convention every caller uses
+ * when no explicit directory is supplied.
+ *
+ * SPEC.md §9 fixes the log at `<home>/log/events.jsonl`, so the store is
+ * `<home>/payloads/`: a sibling of the log directory, never inside it. When a
+ * caller points `--log` at some other layout the store lands beside that file
+ * instead, which keeps the two together for the ad-hoc case without ever
+ * placing payload files in the directory the log is walked from.
+ */
+export declare function payloadStoreDirFor(logPath: string): string;
+/** The file one payload hash addresses. */
+export declare function payloadPath(storeDir: string, hash: string): string;
+export type StorePayloadResult = {
+    ok: true;
+    hash: string;
+    path: string;
+} | {
+    ok: false;
+    code: "unserializable" | "write-failed";
+    message: string;
+};
+/**
+ * Store payload material and return the hash it is addressed by.
+ *
+ * The bytes written are the RFC 8785 canonical serialization itself — not
+ * `JSON.stringify` of the value — so the file's own bytes hash to its own name
+ * and the store is verifiable byte for byte as well as semantically.
+ *
+ * **Idempotent.** Writing the same value twice writes the same bytes to the same
+ * path and reports the same hash. The write is unconditional rather than
+ * skipped-if-present, which also means a corrupted file is repaired by the next
+ * store of the same payload: content addressing makes "overwrite" and "leave
+ * alone" the same operation for anything that was ever valid.
+ *
+ * Refuses `unserializable` for material RFC 8785 cannot serialize (a cycle, a
+ * NaN, a function). A payload that cannot be canonicalized cannot be bound to,
+ * so it must not be stored under a hash that would then name something else.
+ */
+export declare function storePayload(storeDir: string, value: unknown): StorePayloadResult;
+/**
+ * Record an external reference for a payload this runtime does not hold.
+ *
+ * The hash is supplied by the caller because a reference does not determine one:
+ * the binding is a fact about the *payload*, which lives elsewhere, and the
+ * reference is only a pointer to it. {@link loadPayload} reports the pointer and
+ * resolves nothing — see the module header.
+ */
+export declare function storeReference(storeDir: string, hash: string, reference: string): StorePayloadResult;
+/**
+ * Every payload hash the store currently holds, sorted.
+ *
+ * Only `<hash>.json` names whose stem is a well-formed `payload_hash` are
+ * reported. A directory, a dotfile (the temp name an interrupted
+ * {@link writeAtomic} leaves behind), and anything else a human dropped in the
+ * directory are not payloads the store addresses, so no caller — the daemon's
+ * pruner least of all — is ever handed one as if it were.
+ *
+ * An unreadable or absent directory yields the empty list rather than throwing:
+ * a store that cannot be listed holds nothing this process can act on, which is
+ * the fail-closed reading for every caller here (reporting counts, deciding what
+ * to prune).
+ */
+export declare function listStoredPayloadHashes(storeDir: string): string[];
+/** Why a removal did not happen. `absent` is a success for every caller here. */
+export type RemovePayloadResult = {
+    ok: true;
+    path: string;
+    existed: boolean;
+} | {
+    ok: false;
+    code: "unlink-failed";
+    message: string;
+    path: string;
+};
+/**
+ * Delete the bytes stored under `hash`.
+ *
+ * **Daemon-only.** SPEC.md §5.2: "Pruning is performed by the daemon and by
+ * nothing else." Nothing in the CLI calls this, and the retention rule that
+ * decides *which* hash reaches it lives in `daemon/prune.ts`, which appends the
+ * `payload.pruned` event before the file goes. This function is the unlink and
+ * nothing more: it judges no retention, reads no policy, and touches no log.
+ *
+ * A file that is already gone reports `existed: false` and `ok`. The caller's
+ * intent is that the bytes not be there, and a removal that raced another
+ * removal (or completed a crash-interrupted one) achieved exactly that.
+ */
+export declare function removeStoredPayload(storeDir: string, hash: string): RemovePayloadResult;
+/** Why a read did not produce material. */
+export type LoadPayloadRefusalCode = 
+/** No file is stored under this hash. */
+"absent"
+/** A file exists but its contents do not hash to its name. */
+ | "hash-mismatch"
+/** The file could not be read, or is not JSON. */
+ | "unreadable"
+/** The file holds a `{"$ref": …}` pointer, which is not resolved here. */
+ | "reference";
+export type LoadPayloadResult = {
+    ok: true;
+    value: unknown;
+    path: string;
+} | {
+    ok: false;
+    code: LoadPayloadRefusalCode;
+    message: string;
+    path: string;
+    /** The pointer, when `code` is `reference`. */
+    reference?: string;
+};
+/**
+ * Load the material stored under `hash`, verifying it against `hash`.
+ *
+ * The verification is unconditional and the value is withheld when it fails:
+ * `hash-mismatch` says the file on disk is not the payload the request bound to,
+ * and returning it "so the caller can decide" would hand a channel exactly the
+ * bytes the binding exists to keep away from an approver.
+ */
+export declare function loadPayload(storeDir: string, hash: string): LoadPayloadResult;

package/dist/src/core/payload.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Content binding: the hash an approval is bound to (amended SPEC.md §6.2, §10,
+ * APRV-20 pass two / amendment A1).
+ *
+ * ## What this buys
+ *
+ * Before content binding, a grant approved an *action key*. The bytes that key
+ * would ultimately execute were whatever the executor happened to hold at
+ * execution time, which is to say: whatever the agent decided after the human
+ * said yes. The amended §10 closes that:
+ *
+ * > An execution token is bound to the request, its `idempotency_key`, AND its
+ * > `payload_hash`. Adapters and `approval run` MUST recompute the hash of the
+ * > payload they are about to execute and MUST refuse, with a distinct
+ * > machine-readable reason (`payload-mismatch`), when it differs from the hash
+ * > the grant recorded. A grant therefore approves specific bytes.
+ *
+ * So the hash is the *whole* mechanism: `core/gate.ts` refuses to admit a manual
+ * action whose declaration carries none (`payload-hash-required`), copies it
+ * onto `approval.requested` and then onto `approval.granted`, and
+ * `core/token.ts` refuses to spend a token against different bytes
+ * (`payload-mismatch`).
+ *
+ * ## Why JCS, and why not "just hash the string"
+ *
+ * §6.2 says "SHA-256 over the RFC 8785 canonical serialization of the action's
+ * concrete payload". Canonicalization is what makes the hash reproducible across
+ * two implementations that agree about the *payload* but not about key order,
+ * whitespace, or number formatting — which is exactly the situation an adapter
+ * written in another language is in. The same canonicalizer the log's hash chain
+ * uses (`core/jcs.ts`) is used here, so there is one serialization rule in this
+ * codebase and not two.
+ *
+ * ## The `approval run` payload
+ *
+ * §6.2 names it: "for `approval run`, the argv array and cwd". {@link
+ * runPayloadHash} is that definition made executable — the hash of
+ * `{"argv": [...], "cwd": "..."}` — and `approval run` computes it
+ * automatically from the command it is about to spawn. An adapter whose payload
+ * is something else (a message body and its recipients, a proposed record)
+ * hashes that with {@link payloadHash} and presents the result explicitly.
+ *
+ * The cwd is inside the hash on purpose: `rm -rf build` means two different
+ * things in two different directories, and a binding that ignored the working
+ * directory would approve one of them and execute the other.
+ *
+ * Pure: no I/O, no clock, no randomness.
+ */
+/** The form a `payload_hash` takes everywhere: SHA-256, lowercase hex. */
+export declare const PAYLOAD_HASH_PATTERN: RegExp;
+/** Is this a well-formed `payload_hash`? The schema says the same thing. */
+export declare function isPayloadHash(value: unknown): value is string;
+/**
+ * SHA-256 (lowercase hex) over the RFC 8785 canonical serialization of a
+ * payload — the definition amended SPEC.md §6.2 gives for `payload_hash`.
+ *
+ * Throws `JcsError` for a value RFC 8785 cannot serialize (a cycle, a NaN, a
+ * function). That is deliberate: a payload that cannot be canonicalized cannot
+ * be bound to, and returning a plausible-looking digest for it would be worse
+ * than failing.
+ */
+export declare function payloadHash(value: unknown): string;
+/**
+ * The `payload_hash` of an `approval run` invocation: the argv array and cwd.
+ *
+ * `argv` is the child's argv as it will actually be spawned — the command name
+ * first, then its arguments — not the `approval` wrapper's own flags, which
+ * have no side effect to bind. `cwd` is the absolute directory the child will
+ * run in.
+ */
+export declare function runPayloadHash(argv: readonly string[], cwd: string): string;

package/dist/src/core/policy-diff.d.ts

@@ -0,0 +1,292 @@
+/**
+ * Semantic policy diff (APRV-30) — what an edit to `APPROVAL.md` actually
+ * *changes about the runtime's answers*, computed by the real engine on both
+ * versions of the file.
+ *
+ * ## Why this module exists: two live incidents
+ *
+ * **seq 2 of this repository's own log.** An amendment was attested and then
+ * superseded eleven minutes later, because the operator attested a policy edit
+ * that broke a pinned dogfood assertion — a fact nobody learned until the test
+ * suite ran, well after the bytes had been signed for. Nothing in the ceremony
+ * had asked "what does this edit change?" before recording "a human saw these
+ * bytes".
+ *
+ * **The unsigned interregnum.** Commit `f829e6c` edited the policy file; its
+ * attestation landed in a later commit. In between, the repository was carrying
+ * an *inoperative* policy: `checkAttestation` reported `hash-mismatch`, and
+ * every gate operation refused. The edit and the attestation were two acts when
+ * they should have been one.
+ *
+ * Both incidents share a shape: the policy edit was treated as a text change
+ * rather than as an amendment with consequences. This module supplies the
+ * missing half of the ceremony — the consequences — and `cli/amend.ts` supplies
+ * the ceremony itself.
+ *
+ * ## What is compared, and how
+ *
+ * Nothing here re-implements matching, specificity, the irreversibility floor,
+ * or defaulting. {@link diffPolicies} calls `resolve()` from
+ * `core/policy-match.ts` on **both** loads for the same probe class, and reports
+ * the pairs that differ. A diff that computed the answer a second way could
+ * disagree with the engine, and the diff would be the more convincing lie.
+ *
+ * Five sections:
+ *
+ * - **classes** — resolution changes (autonomy, provenance, matched pattern)
+ *   over a probe set: every key of either version's `classes` map, plus the
+ *   caller's `sampleClasses` (the CLI passes SPEC.md §7's top-level namespaces).
+ * - **approvers** — approvers added, removed, or whose channel reachability
+ *   changed, plus the class rules left naming an approver the policy no longer
+ *   defines. Losing the only human who can be reached for a class is an
+ *   availability change disguised as a config tweak.
+ * - **defaults** — `autonomy`, `channel`, `approval_ttl`, `on_expiry`.
+ * - **budgets** — every `(scope, limit)` pair, old -> new. Scopes are the
+ *   `budgets` map's keys plus `classes.<pattern>` for a rule's `limits`.
+ * - **vocabulary** — every other key of the policy document, by dotted path,
+ *   before -> after. See below.
+ *
+ * ## The vocabulary section, and the incident that added it (APRV-111)
+ *
+ * On 2026-08-20 a real amendment added `protected_paths: [SPEC.md]` — a key
+ * that decides which file edits are `policy.edit`, which is to say which edits
+ * a human has to approve — and this module reported **"no semantic change"**.
+ * The four sections above were the whole diff, and none of them can see a
+ * top-level key outside `classes` / `approvers` / `defaults` / `budgets`. A
+ * human was shown "nothing changed" while signing bytes that moved the gate.
+ *
+ * The fix is not a fifth hand-written list, because a hand-written list is
+ * exactly what went stale: `protected_paths` was added to the vocabulary by
+ * APRV-107 and nothing here changed. {@link diffPolicies} now walks **both
+ * documents' actual keys**, flattens them to dotted paths, and reports every
+ * pair that differs. New spec keys are covered the day they parse, with no edit
+ * to this file. Paths the dedicated sections already report are dropped, so
+ * nothing is said twice.
+ *
+ * Two consequences worth stating:
+ *
+ * - **Unknown top-level keys are named, never dropped.** `policy.schema.json`
+ *   is closed, so an unrecognised key means the load FAILED and the policy is
+ *   all-manual. That key is reported (marked `recognised: false`) whether or
+ *   not its value changed: the display side fails closed too, and an edit this
+ *   module cannot describe must be called out rather than summarised as no
+ *   change. Which keys are known is READ FROM THAT SCHEMA since APRV-296 (see
+ *   {@link policyTopLevelKeys}), because the hand-written copy that stood here
+ *   fell behind it and warned an operator about three `daemon.*` keys the
+ *   schema had admitted for a month.
+ * - **A side whose YAML never parsed has no vocabulary to read.** Then
+ *   {@link PolicyDiff.vocabularyComparable} is `false` and the renderer says the
+ *   rest of the document was not compared, instead of printing "no semantic
+ *   change" over an unexamined document.
+ *
+ * ## Probes are a report, not a proof
+ *
+ * The class space is infinite; a diff over it cannot be exhaustive. The probe
+ * set is stated in the output ({@link PolicyDiff.probes}) precisely so a reader
+ * knows what was *not* examined. Wildcard keys (`read.*`) are probed as the
+ * literal strings they are, which is the honest thing to do without inventing
+ * action classes that nobody declared: both versions are asked the same
+ * question, so a difference in the answers is a real difference, and a class
+ * outside the probe set may still have changed.
+ *
+ * ## Fail-closed sides are rendered honestly
+ *
+ * A side that fails to load is not "an empty policy". It resolves **every**
+ * class to `manual` with provenance `fail-closed`, and `resolve()` already says
+ * so, so the class section stays truthful with no special case. The structural
+ * sections are different: a failed load has no `approvers`, `defaults` or
+ * `budgets` to read, and reporting them as removed would assert a change the
+ * file never made. So when either side failed, those three sections are empty
+ * and {@link PolicyDiff.structuralComparable} is `false`, with
+ * {@link PolicyDiff.beforeFailure} / {@link PolicyDiff.afterFailure} carrying
+ * the codes a renderer prints as "everything manual (fail-closed: <code>)".
+ *
+ * Deterministic: no clock, no randomness, and probe order is sorted, so the
+ * same two loads always produce a byte-identical diff. The one read of the
+ * filesystem is the policy SCHEMA, once per process, for the key vocabulary
+ * described above; nothing here reads a policy file, and no answer depends on
+ * anything but the two loads it was handed.
+ */
+import type { Autonomy, PolicyLoadErrorCode, PolicyLoadResult } from "./policy-load.js";
+import { type Provenance } from "./policy-match.js";
+/**
+ * SPEC.md §7's reserved top-level namespaces, in table order.
+ *
+ * Exported here rather than in the CLI because they are a fact about the spec's
+ * taxonomy, not about a command's flags, and because a diff that only probed
+ * the classes a policy happens to name would go quiet on exactly the edit that
+ * matters most: one that *stops* naming a dangerous namespace and lets it fall
+ * through to `defaults.autonomy`.
+ */
+export declare const SPEC_NAMESPACES: readonly string[];
+/** One version's answer for one probe class. */
+export interface ResolutionSnapshot {
+    autonomy: Autonomy;
+    provenance: Provenance;
+    /** The pattern that matched, or `null` for a default / fail-closed answer. */
+    pattern: string | null;
+}
+/** A probe class whose resolution differs between the two versions. */
+export interface ClassResolutionChange {
+    /** The probe string that was resolved under both versions. */
+    class: string;
+    before: ResolutionSnapshot;
+    after: ResolutionSnapshot;
+    /** Present whenever the truthful irreversible outcome changed. */
+    irreversible?: {
+        before: ResolutionSnapshot;
+        after: ResolutionSnapshot;
+    };
+}
+/** How an approver entry changed. */
+export type ApproverChangeKind = "added" | "removed" | "channels-changed";
+/** An approver added, removed, or re-channelled. */
+export interface ApproverChange {
+    approver: string;
+    change: ApproverChangeKind;
+    /** Channels before; `null` when the approver did not exist. */
+    beforeChannels: string[] | null;
+    /** Channels after; `null` when the approver no longer exists. */
+    afterChannels: string[] | null;
+    /**
+     * Class patterns in the AFTER policy that still name this approver although
+     * the AFTER `approvers` map no longer defines them — a rule whose decider is
+     * reachable on nothing.
+     *
+     * `policy.schema.json` already forbids an approver with an empty `channels`
+     * list ("an approver reachable nowhere can never grant"), so the only
+     * reachability hole a *loadable* policy can have is this dangling reference:
+     * the schema says explicitly that the rule-to-approver cross-reference is a
+     * runtime check, not a schema constraint. Empty for every other change.
+     */
+    danglingRules: string[];
+}
+/** A `defaults` field whose value changed. `null` means "absent". */
+export interface DefaultsChange {
+    field: "autonomy" | "channel" | "approval_ttl" | "on_expiry";
+    before: string | null;
+    after: string | null;
+}
+/**
+ * A policy key outside the four dedicated sections, before -> after (APRV-111).
+ *
+ * `key` is a dotted path into the policy document (`protected_paths`,
+ * `audit.skew_tolerance`, `channels.telegram.token_env`). Values are rendered
+ * for reading, not for parsing: scalars as themselves, sequences and anything
+ * else as JSON. `null` means the key was absent on that side.
+ */
+export interface VocabularyChange {
+    key: string;
+    /**
+     * Is this path's TOP-LEVEL key part of SPEC.md §5.2's policy vocabulary?
+     *
+     * `false` means the schema does not know the key, which means the policy does
+     * not load, which means every class is `manual`. Reported even when the value
+     * did not change — see the module header.
+     */
+    recognised: boolean;
+    before: string | null;
+    after: string | null;
+}
+/** A budget or class limit whose value changed. `null` means "absent". */
+export interface BudgetChange {
+    /** `budgets` key (e.g. `global`) or `classes.<pattern>` for a rule limit. */
+    scope: string;
+    /** The limit's name, e.g. `daily_usd`, `daily_actions`, `max_usd`. */
+    limit: string;
+    before: number | null;
+    after: number | null;
+}
+/** The result of {@link diffPolicies}. Frozen shape: the CLI prints it as JSON. */
+export interface PolicyDiff {
+    /** Non-null when the BEFORE side failed to load: everything was manual. */
+    beforeFailure: {
+        code: PolicyLoadErrorCode;
+        message: string;
+    } | null;
+    /** Non-null when the AFTER side failed to load: everything becomes manual. */
+    afterFailure: {
+        code: PolicyLoadErrorCode;
+        message: string;
+    } | null;
+    /**
+     * False when either side failed to load, in which case `approvers`,
+     * `defaults` and `budgets` are empty because a failed load has no structure
+     * to compare — not because nothing changed.
+     */
+    structuralComparable: boolean;
+    /** Every probe class that was resolved, sorted; the stated scope of the diff. */
+    probes: string[];
+    classes: ClassResolutionChange[];
+    approvers: ApproverChange[];
+    defaults: DefaultsChange[];
+    budgets: BudgetChange[];
+    /**
+     * Every other key of the document, changed or unrecognised (APRV-111).
+     * Sorted by `key`, so the same two policies always diff byte-identically.
+     */
+    vocabulary: VocabularyChange[];
+    /**
+     * False when a side's document could not be read as a mapping at all (its
+     * YAML did not parse, or the file was missing), in which case `vocabulary` is
+     * empty because there were no keys to walk — not because none changed.
+     */
+    vocabularyComparable: boolean;
+    /** True when no section reported a change. */
+    unchanged: boolean;
+}
+/**
+ * The policy schema on disk, the file `core/validate.ts` validates against.
+ *
+ * Derived here rather than imported from `DEFAULT_SCHEMA_DIR` so this module
+ * keeps its empty runtime dependency graph: importing `validate.ts` would pull
+ * Ajv into every process that renders a diff, the Telegram channel included.
+ * The two derivations are the same walk from the same directory, and
+ * `tests/policy-vocabulary.test.ts` asserts they name one file, so a schema
+ * directory that ever moves fails there rather than drifting quietly.
+ */
+export declare const POLICY_SCHEMA_PATH: string;
+/**
+ * SPEC.md §5.2's top-level policy keys, READ FROM `policy.schema.json`
+ * (APRV-296).
+ *
+ * Used for ONE decision: whether a key the document carries is part of the
+ * vocabulary at all. It is not used to decide what to walk — the documents' own
+ * keys decide that — so this list only ever changes what a key is CALLED in the
+ * report.
+ *
+ * It used to be a second, hand-written copy of the schema's top-level
+ * `properties`, and the 2026-09-07 ceremony is what a hand-written copy costs:
+ * the amend diff printed `daemon.full_reproof_after: 60s -> 60s (UNKNOWN KEY:
+ * … the policy FAILS CLOSED to all-manual until it is removed)` for three
+ * `daemon.*` keys the schema had admitted since APRV-217, which the same
+ * ceremony then loaded cleanly and resolved every pin against. A false
+ * fail-closed warning in a ceremony's output is worse than no warning: it
+ * teaches the operator reading it that the warnings are noise.
+ *
+ * Reading the schema is the fix that cannot go stale, because the schema is
+ * what actually decides whether the key loads. The read is memoised for the
+ * life of the process, which `core/validate.ts` deliberately does not do for
+ * validation: this is DISPLAY vocabulary over a file shipped with the package,
+ * not a verdict, and a schema edited under a running process changes what the
+ * next diff CALLS a key rather than whether that key was validated.
+ */
+export declare function policyTopLevelKeys(): readonly string[];
+/**
+ * Diff two loaded policies by what the engine answers under each.
+ *
+ * `before` and `after` are whole {@link PolicyLoadResult}s, failures included —
+ * see the module header for why a failed side is reported rather than treated
+ * as empty. `sampleClasses` widens the probe set beyond the two policies' own
+ * class keys; the CLI supplies {@link SPEC_NAMESPACES}.
+ */
+export declare function diffPolicies(before: PolicyLoadResult, after: PolicyLoadResult, sampleClasses?: readonly string[]): PolicyDiff;
+/**
+ * Render a {@link PolicyDiff} as the lines the CLI prints.
+ *
+ * Lives beside the diff rather than in the CLI for the same reason
+ * `decisionPath` lives in `policy-explain.ts`: the human rendering and the
+ * machine shape must be derived from one value, or they will eventually
+ * disagree about what changed.
+ */
+export declare function renderDiff(diff: PolicyDiff): string[];

package/dist/src/core/policy-diff.js

@@ -319,7 +319,13 @@ function failureOf(load) {
     return load.ok ? null : { code: load.code, message: load.message };
 }
 function snapshot(load, probe) {
-    const resolution = resolve(load, probe);
+    return snapshotFor(load, probe, false);
+}
+function irreversibleSnapshot(load, probe) {
+    return snapshotFor(load, probe, true);
+}
+function snapshotFor(load, probe, irreversible) {
+    const resolution = resolve(load, probe, irreversible ? { reversible: false } : {});
     return {
         autonomy: resolution.autonomy,
         provenance: resolution.provenance,
@@ -462,9 +468,21 @@ export function diffPolicies(before, after, sampleClasses = []) {
     for (const probe of probes) {
         const previous = snapshot(before, probe);
         const next = snapshot(after, probe);
-        if (sameSnapshot(previous, next))
+        const previousIrreversible = irreversibleSnapshot(before, probe);
+        const nextIrreversible = irreversibleSnapshot(after, probe);
+        const ordinaryChanged = !sameSnapshot(previous, next);
+        const irreversibleChanged = !sameSnapshot(previousIrreversible, nextIrreversible);
+        if (!ordinaryChanged && !irreversibleChanged)
             continue;
-        classes.push({ class: probe, before: previous, after: next });
+        const change = {
+            class: probe,
+            before: previous,
+            after: next,
+        };
+        if (irreversibleChanged) {
+            change.irreversible = { before: previousIrreversible, after: nextIrreversible };
+        }
+        classes.push(change);
     }
     const structuralComparable = before.ok && after.ok;
     const approvers = structuralComparable ? diffApprovers(beforePolicy, afterPolicy) : [];
@@ -518,7 +536,12 @@ export function renderDiff(diff) {
     if (diff.classes.length > 0) {
         lines.push(`class resolutions changed (${diff.classes.length}):`);
         for (const change of diff.classes) {
-            lines.push(`  ${change.class}: ${describeSnapshot(change.before)} -> ${describeSnapshot(change.after)}`);
+            if (!sameSnapshot(change.before, change.after)) {
+                lines.push(`  ${change.class}: ${describeSnapshot(change.before)} -> ${describeSnapshot(change.after)}`);
+            }
+            if (change.irreversible !== undefined) {
+                lines.push(`  ${change.class} (reversible: false): ${describeSnapshot(change.irreversible.before)} -> ${describeSnapshot(change.irreversible.after)}`);
+            }
         }
     }
     if (diff.approvers.length > 0) {

package/dist/src/core/policy-diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-diff.js","sourceRoot":"","sources":["../../../src/core/policy-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAmB,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,QAAQ;IACR,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,aAAa;IACb,UAAU;IACV,aAAa;IACb,WAAW;IACX,YAAY;IACZ,UAAU;CACX,CAAC;AAmHF,MAAM,cAAc,GAA2C;IAC7D,UAAU;IACV,SAAS;IACT,cAAc;IACd,WAAW;CACZ,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAC7C,IAAI,GAAG,CAAC,oCAAoC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAC/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAsB;IACjD,WAAW;IACX,OAAO;IACP,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,iBAAiB;IACjB,OAAO;IACP,SAAS;CACV,CAAC;AAEF,iEAAiE;AACjE,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC/C,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAClC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,uBAAuB,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,uBAAuB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAE5C,SAAS,QAAQ,CAAC,IAAsB;IACtC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,IAAsB;IACnC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,KAAc,EAAE,MAAc,EAAE,GAAwB;IACvE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,KAAK,yBAAyB;YAAE,SAAS;QAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;IACnF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,MAAe,EACf,KAAc,EACd,oBAA6B;IAE7B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE3F,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,UAAU,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAC9C,IAAI,UAAU,IAAI,oBAAoB,IAAI,yBAAyB,CAAC,GAAG,CAAC;YAAE,SAAS;QACnF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAChB,IAAsB;IAEtB,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAsB,EAAE,KAAa;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAqB,EAAE,CAAqB;IAChE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/F,CAAC;AAED,6DAA6D;AAC7D,SAAS,KAAK,CAAC,GAAG,KAAuC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,CAAkB,EAAE,CAAkB;IAC1D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB,EAAE,KAA8B;IACzE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,SAAS,GAAG,QAAQ,CAAC;AAE3B;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,GAAG,CAAC,WAAW,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,WAAW,CAAC,MAAqB,EAAE,QAAgB;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,MAAqB,EAAE,KAAoB;IAChE,MAAM,KAAK,GAAG,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,EACpC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CACpC,CAAC;IACF,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC;YAAE,SAAS;QAC1D,MAAM,MAAM,GACV,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ;YACR,MAAM;YACN,cAAc;YACd,aAAa;YACb,aAAa,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB,EAAE,KAAoB;IAC/D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,KAAoB;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwB,EACxB,KAAuB,EACvB,aAAa,GAAsB,EAAE;IAErC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,SAAS;QAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAErF,OAAO;QACL,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC;QAChC,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC;QAC9B,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,SAAS;QACT,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,UAAU,CAAC,OAAO;QAC9B,oBAAoB,EAAE,UAAU,CAAC,UAAU;QAC3C,SAAS,EACP,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,2CAA2C,IAAI,CAAC,aAAa,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,0CAA0C,IAAI,CAAC,YAAY,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,2CAA2C;QAC3C,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,oBAAoB;YACvB,CAAC,CAAC,uBAAuB,IAAI,CAAC,MAAM,CAAC,MAAM,uEAAuE;YAClH,CAAC,CAAC,oCAAoC,IAAI,CAAC,MAAM,CAAC,MAAM,uLAAuL,CAClP,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAC1F,MAAM,CAAC,aAAa,IAAI,EAAE,CAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,IACV,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,iCAAiC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GACtE,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;YACjF,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,UAAU;gBACf,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE;gBAC9B,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,MAAM,iHAAiH,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,qJAAqJ,CACtJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,4KAA4K,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB;IAChD,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;IACjF,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,GAAG,CAAC;AACxC,CAAC"}
+{"version":3,"file":"policy-diff.js","sourceRoot":"","sources":["../../../src/core/policy-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAmB,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,QAAQ;IACR,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,aAAa;IACb,UAAU;IACV,aAAa;IACb,WAAW;IACX,YAAY;IACZ,UAAU;CACX,CAAC;AAqHF,MAAM,cAAc,GAA2C;IAC7D,UAAU;IACV,SAAS;IACT,cAAc;IACd,WAAW;CACZ,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAC7C,IAAI,GAAG,CAAC,oCAAoC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAC/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAsB;IACjD,WAAW;IACX,OAAO;IACP,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,iBAAiB;IACjB,OAAO;IACP,SAAS;CACV,CAAC;AAEF,iEAAiE;AACjE,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC/C,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAClC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,uBAAuB,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,uBAAuB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAE5C,SAAS,QAAQ,CAAC,IAAsB;IACtC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,IAAsB;IACnC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,KAAc,EAAE,MAAc,EAAE,GAAwB;IACvE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,KAAK,yBAAyB;YAAE,SAAS;QAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;IACnF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,MAAe,EACf,KAAc,EACd,oBAA6B;IAE7B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE3F,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,UAAU,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAC9C,IAAI,UAAU,IAAI,oBAAoB,IAAI,yBAAyB,CAAC,GAAG,CAAC;YAAE,SAAS;QACnF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAChB,IAAsB;IAEtB,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAsB,EAAE,KAAa;IACrD,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAsB,EAAE,KAAa;IACjE,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAClB,IAAsB,EACtB,KAAa,EACb,YAAqB;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAqB,EAAE,CAAqB;IAChE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/F,CAAC;AAED,6DAA6D;AAC7D,SAAS,KAAK,CAAC,GAAG,KAAuC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,CAAkB,EAAE,CAAkB;IAC1D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB,EAAE,KAA8B;IACzE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,SAAS,GAAG,QAAQ,CAAC;AAE3B;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,GAAG,CAAC,WAAW,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,WAAW,CAAC,MAAqB,EAAE,QAAgB;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,MAAqB,EAAE,KAAoB;IAChE,MAAM,KAAK,GAAG,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,EACpC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CACpC,CAAC;IACF,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC;YAAE,SAAS;QAC1D,MAAM,MAAM,GACV,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ;YACR,MAAM;YACN,cAAc;YACd,aAAa;YACb,aAAa,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB,EAAE,KAAoB;IAC/D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,KAAoB;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwB,EACxB,KAAuB,EACvB,aAAa,GAAsB,EAAE;IAErC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,mBAAmB,GAAG,CAAC,YAAY,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;QAClF,IAAI,CAAC,eAAe,IAAI,CAAC,mBAAmB;YAAE,SAAS;QACvD,MAAM,MAAM,GAA0B;YACpC,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC;QACF,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,CAAC,YAAY,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAErF,OAAO;QACL,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC;QAChC,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC;QAC9B,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,SAAS;QACT,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,UAAU,CAAC,OAAO;QAC9B,oBAAoB,EAAE,UAAU,CAAC,UAAU;QAC3C,SAAS,EACP,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,2CAA2C,IAAI,CAAC,aAAa,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,0CAA0C,IAAI,CAAC,YAAY,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,2CAA2C;QAC3C,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,oBAAoB;YACvB,CAAC,CAAC,uBAAuB,IAAI,CAAC,MAAM,CAAC,MAAM,uEAAuE;YAClH,CAAC,CAAC,oCAAoC,IAAI,CAAC,MAAM,CAAC,MAAM,uLAAuL,CAClP,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,yBAAyB,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAC3I,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAC1F,MAAM,CAAC,aAAa,IAAI,EAAE,CAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,IACV,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,iCAAiC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GACtE,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,OAAO,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;YACjF,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,UAAU;gBACf,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE;gBAC9B,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,MAAM,iHAAiH,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,qJAAqJ,CACtJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,4KAA4K,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB;IAChD,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;IACjF,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,GAAG,CAAC;AACxC,CAAC"}