approval-md 0.2.0 → 0.3.0

package/dist/src/core/policy-explain.js

@@ -35,7 +35,9 @@
  * is deeply equal across calls, including `decisionPath` strings, because
  * `resolve()` already imposes a total order on candidates.
  */
+import { dirname } from "node:path";
 import { resolve, STRICTNESS, } from "./policy-match.js";
+import { READ_OUT_OF_SCOPE_CLASS, effectiveReadRoots, renderReadRoots, } from "./read-scope.js";
 /**
  * Action-class grammar for a *concrete* class (not a pattern).
  *
@@ -51,6 +53,18 @@ export const ACTION_CLASS_PATTERN = /^[a-z0-9][a-z0-9_-]*(?:\.[a-z0-9][a-z0-9_-]
 export function isActionClass(value) {
     return ACTION_CLASS_PATTERN.test(value);
 }
+/**
+ * Classes whose explanation should name the read scope in force (APRV-347).
+ *
+ * The FILE readers, and not every `read.*`. `read.web` and `read.vcs.remote`
+ * reach no file, so a scope line under them would be noise on an explanation
+ * that is otherwise exactly as long as it needs to be.
+ */
+function scopesReads(actionClass) {
+    return (actionClass === READ_OUT_OF_SCOPE_CLASS ||
+        actionClass === "read.shell" ||
+        actionClass.startsWith("read.file"));
+}
 function quote(text) {
     return JSON.stringify(text);
 }
@@ -98,6 +112,24 @@ export function explain(load, actionClass, options = {}) {
         };
     }
     decisionPath.push(`policy loaded from ${load.source.path}`);
+    // APRV-347. The read scope is the fact a reader of a read class most needs
+    // and cannot get anywhere else: the autonomy answers "what happens", and this
+    // answers "to which reads". Printed for read classes only, so no other
+    // explanation grows a line about a key it does not turn on.
+    if (scopesReads(actionClass)) {
+        const gateRoot = dirname(load.source.path);
+        const declared = load.policy.read_scope?.roots;
+        const roots = effectiveReadRoots({
+            gateRoot,
+            ...(declared === undefined ? {} : { declared }),
+            ...(options.systemReadRoots === undefined ? {} : { systemRoots: options.systemReadRoots }),
+        });
+        decisionPath.push(`read scope (APRV-347): reads resolving inside ${renderReadRoots(roots)} are ordinary ${declared === undefined
+            ? "reads; the policy declares no `read_scope`, so these are the built-in roots"
+            : `reads; \`read_scope.roots\` widened them with ${renderReadRoots(declared)}`}. A read resolving outside all of them is \`${READ_OUT_OF_SCOPE_CLASS}\`${options.systemReadRoots === undefined
+            ? " (the session scratchpad and the system temp root are resolved by the runtime and are not shown here)"
+            : ""}`);
+    }
     const candidates = annotate(final.candidates, final.matched?.pattern ?? null);
     describeCandidates(decisionPath, actionClass, candidates);
     describeWinner(decisionPath, load, base.provenance, base.autonomy, candidates);

package/dist/src/core/policy-explain.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-explain.js","sourceRoot":"","sources":["../../../src/core/policy-explain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,OAAO,EACL,OAAO,EACP,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEvF,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AA+FD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,WAAwB;IAC/C,OAAO,YAAY,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,IAAsB,EACtB,WAAmB,EACnB,OAAO,GAAmB,EAAE;IAE5B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,YAAY,GAAa;QAC7B,SAAS,KAAK,CAAC,WAAW,CAAC,iBACzB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACxD,EAAE;KACH,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CACf,+BAA+B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,EAC5D,wFAAwF,EACxF,eAAe,CAChB,CAAC;QACF,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB,EAAE,QAAQ;gBAC1B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,iBAAiB,EAAE,KAAK;aACzB;YACD,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvD,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YAC3E,oBAAoB,EAAE,EAAE;YACxB,UAAU,EAAE,EAAE;YACd,YAAY;SACb,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC9E,kBAAkB,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE/E,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE;QAC9E,CAAC,CAAC,IAAI,CAAC;IACT,aAAa,CACX,YAAY,EACZ,UAAU,EACV,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,oBAAoB,EAC1B,UAAU,CACX,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,+CAA+C;IAC/C,YAAY,CAAC,IAAI,CACf,KAAK,CAAC,WAAW,KAAK,MAAM;QAC1B,CAAC,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gNAAgN;QAC/Q,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,CAAC,CAAC,+GAA+G;YACjH,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CACjC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,UAAU;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC;QAClE,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU;QACV,eAAe,EAAE,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAA0B,EAC1B,UAAsC;IAEtC,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC;IAClD,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC9D,IAAI,UAAU,CAAC,YAAY;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,UAAU,CAAC,iBAAiB;QAAE,OAAO,gBAAgB,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAkB,EAAE,YAAqB;IAChE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,UAA+F,EAC/F,aAA4B;IAE5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GACR,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjG,IAAI,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,CACjE,CAAC,MAAM,CAAC;IAET,MAAM,cAAc,GAClB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAEnG,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,KAAK,aAAa,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAyB;YACjC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;YACjC,MAAM;SACP,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QACzD,IAAI,KAAK;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAc,EAAE,CAAc;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAsB,EACtB,WAAmB,EACnB,UAAkC;IAElC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CACf,GAAG,UAAU,CAAC,MAAM,oBAAoB,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACnF,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAClC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,QAAQ,EAAE;SAC7E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,CACf,KAAK,SAAS,CAAC,OAAO,KAAK,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,SAAS,CAAC,QAAQ,EAAE;YAC3F,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,YAAsB,EACtB,IAA6C,EAC7C,UAAsB,EACtB,QAAkB,EAClB,UAAkC;IAElC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GACV,MAAM,EAAE,QAAQ,KAAK,oBAAoB;YACvC,CAAC,CAAC,iEAAiE;YACnE,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,eAAe;gBACpC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,kCAAkC,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CACf,yGAAyG,QAAQ,EAAE,CACpH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,YAAY,CAAC,IAAI,CACf,kGAAkG,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CACpB,YAAsB,EACtB,UAA0B,EAC1B,QAAkB,EAClB,YAAqB,EACrB,iBAA0B,EAC1B,iBAA2B,EAC3B,UAAyE;IAEzE,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO;IACjC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,YAAY,CAAC,IAAI,CACf,sHAAsH,CACvH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,iBAAiB,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,CACf,qHAAqH,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAC7L,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CACf,wFAAwF,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IACtF,MAAM,SAAS,GACb,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,wDAAwD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9F,YAAY,CAAC,IAAI,CACf,oCAAoC,SAAS,iCAAiC,MAAM,KAAK,UAAU,CAAC,QAAQ,aAAa,CAC1H,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy-explain.js","sourceRoot":"","sources":["../../../src/core/policy-explain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,OAAO,EACL,OAAO,EACP,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEvF,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAwGD;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,WAAmB;IACtC,OAAO,CACL,WAAW,KAAK,uBAAuB;QACvC,WAAW,KAAK,YAAY;QAC5B,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CACpC,CAAC;AACJ,CAAC;AAGD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,WAAwB;IAC/C,OAAO,YAAY,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,IAAsB,EACtB,WAAmB,EACnB,OAAO,GAAmB,EAAE;IAE5B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,YAAY,GAAa;QAC7B,SAAS,KAAK,CAAC,WAAW,CAAC,iBACzB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACxD,EAAE;KACH,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CACf,+BAA+B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,EAC5D,wFAAwF,EACxF,eAAe,CAChB,CAAC;QACF,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB,EAAE,QAAQ;gBAC1B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,iBAAiB,EAAE,KAAK;aACzB;YACD,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvD,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YAC3E,oBAAoB,EAAE,EAAE;YACxB,UAAU,EAAE,EAAE;YACd,YAAY;SACb,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;QAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC;YAC/B,QAAQ;YACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;SAC3F,CAAC,CAAC;QACH,YAAY,CAAC,IAAI,CACf,iDAAiD,eAAe,CAAC,KAAK,CAAC,iBACrE,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,6EAA6E;YAC/E,CAAC,CAAC,iDAAiD,eAAe,CAAC,QAAQ,CAAC,EAChF,+CAA+C,uBAAuB,KACpE,OAAO,CAAC,eAAe,KAAK,SAAS;YACnC,CAAC,CAAC,uGAAuG;YACzG,CAAC,CAAC,EACN,EAAE,CACH,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC9E,kBAAkB,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE/E,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE;QAC9E,CAAC,CAAC,IAAI,CAAC;IACT,aAAa,CACX,YAAY,EACZ,UAAU,EACV,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,oBAAoB,EAC1B,UAAU,CACX,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,+CAA+C;IAC/C,YAAY,CAAC,IAAI,CACf,KAAK,CAAC,WAAW,KAAK,MAAM;QAC1B,CAAC,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gNAAgN;QAC/Q,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,CAAC,CAAC,+GAA+G;YACjH,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CACjC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,UAAU;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC;QAClE,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU;QACV,eAAe,EAAE,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAA0B,EAC1B,UAAsC;IAEtC,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC;IAClD,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC9D,IAAI,UAAU,CAAC,YAAY;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,UAAU,CAAC,iBAAiB;QAAE,OAAO,gBAAgB,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAkB,EAAE,YAAqB;IAChE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,UAA+F,EAC/F,aAA4B;IAE5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GACR,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjG,IAAI,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,CACjE,CAAC,MAAM,CAAC;IAET,MAAM,cAAc,GAClB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAEnG,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,KAAK,aAAa,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAyB;YACjC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;YACjC,MAAM;SACP,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QACzD,IAAI,KAAK;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAc,EAAE,CAAc;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAsB,EACtB,WAAmB,EACnB,UAAkC;IAElC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CACf,GAAG,UAAU,CAAC,MAAM,oBAAoB,KAAK,CAAC,WAAW,CAAC,wBAAwB,CACnF,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAClC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,QAAQ,EAAE;SAC7E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,CACf,KAAK,SAAS,CAAC,OAAO,KAAK,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,SAAS,CAAC,QAAQ,EAAE;YAC3F,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,YAAsB,EACtB,IAA6C,EAC7C,UAAsB,EACtB,QAAkB,EAClB,UAAkC;IAElC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GACV,MAAM,EAAE,QAAQ,KAAK,oBAAoB;YACvC,CAAC,CAAC,iEAAiE;YACnE,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,eAAe;gBACpC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,kCAAkC,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CACf,yGAAyG,QAAQ,EAAE,CACpH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,YAAY,CAAC,IAAI,CACf,kGAAkG,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CACpB,YAAsB,EACtB,UAA0B,EAC1B,QAAkB,EAClB,YAAqB,EACrB,iBAA0B,EAC1B,iBAA2B,EAC3B,UAAyE;IAEzE,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO;IACjC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,YAAY,CAAC,IAAI,CACf,sHAAsH,CACvH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,iBAAiB,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,CACf,qHAAqH,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAC7L,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CACf,wFAAwF,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IACtF,MAAM,SAAS,GACb,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,wDAAwD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9F,YAAY,CAAC,IAAI,CACf,oCAAoC,SAAS,iCAAiC,MAAM,KAAK,UAAU,CAAC,QAAQ,aAAa,CAC1H,CAAC;AACJ,CAAC"}

package/dist/src/core/policy-load.d.ts

@@ -57,6 +57,7 @@
  * directory. No clock, no network, no randomness, no cross-call caching.
  */
 import { type ProtectedPathEntry } from "./command-class.js";
+import type { ReadScope } from "./read-scope.js";
 import { type ValidationError } from "./validate.js";
 /**
  * Upper bound on alias expansions in one policy document.
@@ -222,8 +223,37 @@ export interface Policy {
      * inoperative.
      */
     protected_paths?: ProtectedPathEntry[];
+    /**
+     * Amended SPEC.md §5.2 (APRV-347): directories an agent's reads may stay
+     * inside, beyond the built-in roots.
+     *
+     * ADDITIVE, with the same discipline `protected_paths` has and for a sharper
+     * reason: the built-in roots (the gate root, the session scratchpad, the
+     * system temp root) are in scope whatever this says, because a runtime denied
+     * its own policy and log could not run, and a policy that could NARROW its
+     * own read scope would be a policy an agent could edit until nothing was
+     * gated. Absent means the built-ins alone, which is the muse jail with no
+     * grammar at all: the gate root is the directory holding this file.
+     *
+     * Nothing here is resolved by the loader. `core/read-scope.ts` turns these
+     * into effective roots and `src/cli/hook.ts` resolves them on disk, so a
+     * symlink cannot smuggle a read out of one.
+     */
+    read_scope?: ReadScope;
+    /**
+     * The approver roster (SPEC.md §5.1), and since APRV-324 the operator's
+     * attested statement of which transport account each of them decides from.
+     *
+     * `senders` is additive and optional, keyed by a channel whose transport
+     * authenticates a sender (`schema/policy.schema.json`'s `senderChannel`, which
+     * is `telegram` and nothing else today). It is READ by
+     * `channels/contract.ts` through `core/sender-identity.ts`, and by nothing on
+     * a routing, budget or token path: it decides WHO a decision is recorded as,
+     * never what a decision may authorize.
+     */
     approvers?: Record<string, {
         channels: string[];
+        senders?: Record<string, string>;
     }>;
     classes?: Record<string, PolicyClassRule>;
     /**
@@ -354,7 +384,17 @@ export type PolicyLoadErrorCode = "file-missing" | "no-block" | "multiple-blocks
  * line — which no JSON Schema can state. See
  * {@link checkProtectedRouteFloor}.
  */
- | "protected-route-floor";
+ | "protected-route-floor"
+/**
+ * Amended SPEC.md §5.2 (APRV-324): two approvers declare one sender id. Like
+ * `protected-route-floor` it is a relationship between two parts of a file
+ * that is valid against the schema, which no JSON Schema can state. The
+ * consequence is the same and for the same reason: the policy does not load,
+ * so every class resolves `manual`, because a file that says one account is
+ * two people has no reading under which a decision from that account names
+ * anybody. See {@link checkSenderMappings}.
+ */
+ | "sender-ambiguous";
 /**
  * Result of {@link loadPolicy}.
  *

package/dist/src/core/policy-load.js

@@ -69,6 +69,11 @@ import { scanFences } from "./md-fence.js";
 // must never have from the resolution it floors.
 import { resolve, STRICTNESS } from "./policy-match.js";
 import { promptBlockErrors } from "./prompt-layout.js";
+// APRV-324. Same shape as the matcher import above: this module imports a
+// FUNCTION from `sender-identity.ts`, which imports only this module's TYPES,
+// so the cycle is erased at build and the rule the loader enforces and the rule
+// the decision path applies are one implementation.
+import { checkSenderMappings } from "./sender-identity.js";
 import { validate } from "./validate.js";
 /**
  * Upper bound on alias expansions in one policy document.
@@ -392,6 +397,14 @@ export function loadPolicyText(path, text, options = {}) {
         daemon: daemonRead,
         notes: aliasNotes(policy),
     };
+    // APRV-324: one sender id, at most one person. Checked here rather than in
+    // the schema because it is a relationship between two approvers' blocks, and
+    // checked BEFORE the routing floor below because it needs only the parsed
+    // roster, not a resolution.
+    const senders = checkSenderMappings(policy.approvers);
+    if (senders !== null) {
+        return failure("sender-ambiguous", `${resolved.path}: ${senders}`, undefined, parsed.value);
+    }
     // APRV-266: the routing floor is the LAST gate on a load, because it is the
     // only check here that needs the resolved policy rather than the parsed one.
     const floor = checkProtectedRouteFloor(loaded);
@@ -484,8 +497,8 @@ function describeLevel(declared, liveRate) {
     return liveRate === null ? declared : `${declared} at ${String(liveRate)}`;
 }
 /**
- * Amended SPEC.md §5.2 (APRV-127): one note per place a policy still writes the
- * bare `supervised`.
+ * Amended SPEC.md §5.2 (APRV-127, APRV-335): one note per place a policy still
+ * writes the bare `supervised`.
  *
  * The alias keeps every pre-split policy meaning exactly what its author meant:
  * `supervised` was retrospective sampling, and `supervised-retro` is that same
@@ -494,6 +507,11 @@ function describeLevel(declared, liveRate) {
  * now means "supervised somehow, possibly live"; the note says, in the one place
  * a reader is already looking, that it does not.
  *
+ * Since APRV-335 the note leads with the word `deprecated:`, because the alias
+ * is now on a path out: it is still parsed, still admitted by the schema, and a
+ * future schema version drops it. A reader who sees only the first clause of a
+ * long note should still learn the one thing that has a deadline attached.
+ *
  * Pure, total, and ordered: `defaults` first, then class patterns in sorted
  * order, so the notes of one policy are byte-stable across runs.
  */
@@ -502,7 +520,7 @@ function aliasNotes(policy) {
     const say = (where) => ({
         code: "supervised-alias",
         where,
-        message: `${where} declares the bare \`supervised\`, which parses as \`supervised-retro\`: the action executes immediately and is sampled for review AFTERWARDS. Nothing about it changed with the autonomy split — this is the same behaviour under its honest name. Write \`supervised-retro\` to say so explicitly, or \`supervised-live: <rate>\` to have a fraction of the class stop for a human FIRST.`,
+        message: `deprecated: ${where} declares the bare \`supervised\`, which parses as \`supervised-retro\`: the action executes immediately and is sampled for review AFTERWARDS. Nothing about it changed with the autonomy split — this is the same behaviour under its honest name. Write \`supervised-retro\` to say so explicitly, or \`supervised-live: <rate>\` to have a fraction of the class stop for a human FIRST. The bare spelling still parses and a future version of the policy schema removes it (APRV-335).`,
     });
     if (policy.defaults?.autonomy === "supervised")
         notes.push(say("defaults.autonomy"));

package/dist/src/core/policy-load.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-load.js","sourceRoot":"","sources":["../../../src/core/policy-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAkB,MAAM,eAAe,CAAC;AAC3D,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,iDAAiD;AACjD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,cAAc,CAAU,CAAC;AAEzE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD,MAAM,WAAW,GAAqC;IACpD,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,WAAW;CACf,CAAC;AAuEF,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjF,CAAC;AAwMD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAqB,MAAM,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,MAAM;IAC1B,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AAsFH;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CACd,IAAyB,EACzB,OAAe,EACf,MAA0B,EAC1B,GAAa;IAEb,MAAM,IAAI,GAAqB,MAAM,KAAK,SAAS;QACjD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;QAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAA0B;IAE1B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,yBAAyB,QAAQ,CAAC,MAAM;iBACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,6CAA6C,QAAQ,CAAC,QAAQ;iBAC9E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;iBACjC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACvE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,0BAA0B,MAAM,CAAC,SAAS,CAAC,+BAA+B,UAAU,EAAE;SAC1G,CAAC;IACJ,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,mEAAmE;QACnE,iEAAiE;QACjE,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,+BAA+B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACvC,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CACZ,cAAc,EACd,eAAe,OAAO,CAAC,IAAI,uBAAuB,YAAY,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CACZ,cAAc,EACd,2BAA2B,GAAG,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,uBAAuB,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,IAAY,EACZ,OAAO,GAA2B,EAAE;IAEpC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,0EAA0E;QAC1E,mEAAmE;QACnE,yCAAyC;QACzC,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,wBAAwB,kBAAkB,8CAA8C,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,cAAc,kBAAkB,qBAAqB,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CACZ,iBAAiB,EACjB,GAAG,QAAQ,CAAC,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,kBAAkB,+CAA+C,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,UAAU,GAAG,QAAQ,CACzB,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,yCAAyC,EACzD,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAe,CAAC;IAEtC,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,uCAAuC,EACvD,YAAY,EACZ,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,4BAA4B,OAAO,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;IAC9C,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,2BAA2B,QAAQ,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACtD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,iBAAiB,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,6BAA6B,cAAc,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACtD,IAAI,kBAAkB,GAAG,0BAA0B,CAAC,kBAAkB,CAAC;IACvE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,gCAAgC,WAAW,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,MAAM,UAAU,GAAqB;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,0BAA0B,CAAC,SAAS;QAC5E,gBAAgB,EACd,MAAM,CAAC,MAAM,EAAE,kBAAkB,IAAI,0BAA0B,CAAC,gBAAgB;QAClF,kBAAkB;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS;KACtC,CAAC;IAEF,MAAM,MAAM,GAAqB;QAC/B,EAAE,EAAE,IAAI;QACR,MAAM;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAClE,SAAS,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE;QAChE,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;KAC1B,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,uBAAuB,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,4OAA4O,CAAC;QAClV,CAAC;QACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC1D,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,mGAAmG,OAAO,wIAAwI,CAAC;QAC1X,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAE/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACvE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACxE,MAAM,CAAC,QAAQ,KAAK,IAAI;gBACxB,IAAI,CAAC,QAAQ,KAAK,IAAI;gBACtB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;YAC7C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAC/C,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;gBAC9C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,kBAAkB,CAAC,QAAQ,KAAK,IAAI;gBACpC,gBAAgB,CAAC,QAAQ,KAAK,IAAI;gBAClC,kBAAkB,CAAC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,cAAc;gBAC/B,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,iDAAiD,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAClK,CAAC,CAAC,GAAG,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,6EAA6E,aAAa,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvQ,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,oBAAoB,UAAU,qNAAqN,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,iGAAiG,CAAC;QAC/f,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,aAAa,CAAC,QAA0B,EAAE,QAAuB;IACxE,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,OAAO,EAAE,GAAG,KAAK,6XAA6X;KAC/Y,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,KAAK,YAAY,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,cAAc,CACnB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,EACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy-load.js","sourceRoot":"","sources":["../../../src/core/policy-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAkB,MAAM,eAAe,CAAC;AAC3D,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,iDAAiD;AACjD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,0EAA0E;AAC1E,8EAA8E;AAC9E,gFAAgF;AAChF,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,cAAc,CAAU,CAAC;AAEzE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD,MAAM,WAAW,GAAqC;IACpD,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,WAAW;CACf,CAAC;AAuEF,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjF,CAAC;AAoOD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAqB,MAAM,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,MAAM;IAC1B,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AAgGH;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CACd,IAAyB,EACzB,OAAe,EACf,MAA0B,EAC1B,GAAa;IAEb,MAAM,IAAI,GAAqB,MAAM,KAAK,SAAS;QACjD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;QAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAA0B;IAE1B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,yBAAyB,QAAQ,CAAC,MAAM;iBACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,6CAA6C,QAAQ,CAAC,QAAQ;iBAC9E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;iBACjC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACvE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,0BAA0B,MAAM,CAAC,SAAS,CAAC,+BAA+B,UAAU,EAAE;SAC1G,CAAC;IACJ,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,mEAAmE;QACnE,iEAAiE;QACjE,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,+BAA+B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACvC,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CACZ,cAAc,EACd,eAAe,OAAO,CAAC,IAAI,uBAAuB,YAAY,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CACZ,cAAc,EACd,2BAA2B,GAAG,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,uBAAuB,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,IAAY,EACZ,OAAO,GAA2B,EAAE;IAEpC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,0EAA0E;QAC1E,mEAAmE;QACnE,yCAAyC;QACzC,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,wBAAwB,kBAAkB,8CAA8C,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,cAAc,kBAAkB,qBAAqB,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CACZ,iBAAiB,EACjB,GAAG,QAAQ,CAAC,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,kBAAkB,+CAA+C,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,UAAU,GAAG,QAAQ,CACzB,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,yCAAyC,EACzD,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAe,CAAC;IAEtC,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,uCAAuC,EACvD,YAAY,EACZ,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,4BAA4B,OAAO,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;IAC9C,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,2BAA2B,QAAQ,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACtD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,iBAAiB,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,6BAA6B,cAAc,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACtD,IAAI,kBAAkB,GAAG,0BAA0B,CAAC,kBAAkB,CAAC;IACvE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,gCAAgC,WAAW,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,MAAM,UAAU,GAAqB;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,0BAA0B,CAAC,SAAS;QAC5E,gBAAgB,EACd,MAAM,CAAC,MAAM,EAAE,kBAAkB,IAAI,0BAA0B,CAAC,gBAAgB;QAClF,kBAAkB;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS;KACtC,CAAC;IAEF,MAAM,MAAM,GAAqB;QAC/B,EAAE,EAAE,IAAI;QACR,MAAM;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAClE,SAAS,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE;QAChE,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;KAC1B,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,kBAAkB,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,uBAAuB,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,4OAA4O,CAAC;QAClV,CAAC;QACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC1D,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,mGAAmG,OAAO,wIAAwI,CAAC;QAC1X,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAE/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACvE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACxE,MAAM,CAAC,QAAQ,KAAK,IAAI;gBACxB,IAAI,CAAC,QAAQ,KAAK,IAAI;gBACtB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;YAC7C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAC/C,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;gBAC9C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,kBAAkB,CAAC,QAAQ,KAAK,IAAI;gBACpC,gBAAgB,CAAC,QAAQ,KAAK,IAAI;gBAClC,kBAAkB,CAAC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,cAAc;gBAC/B,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,iDAAiD,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAClK,CAAC,CAAC,GAAG,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,6EAA6E,aAAa,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvQ,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,oBAAoB,UAAU,qNAAqN,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,iGAAiG,CAAC;QAC/f,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,aAAa,CAAC,QAA0B,EAAE,QAAuB;IACxE,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,OAAO,EAAE,eAAe,KAAK,6dAA6d;KAC3f,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,KAAK,YAAY,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,cAAc,CACnB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,EACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;AACJ,CAAC"}

package/dist/src/core/policy-match.d.ts

@@ -243,6 +243,49 @@ export declare function supervisionOf(declared: DeclaredAutonomy, rule: PolicyCl
  * the thing that did not happen as well as the reason it cannot.
  */
 export declare function humanOnlyRefusal(actionClass: string, whatWasRefused: string): string;
+/**
+ * The `harness.launch.*` family: starting an agent harness session (APRV-354).
+ *
+ * Defined here rather than beside the classifier rows that emit it, because two
+ * enforcement paths and the classifier all have to agree on what the family IS,
+ * and a second spelling of the prefix is the shape of bug that lets one door
+ * close while another stays open.
+ */
+export declare const HARNESS_LAUNCH_PREFIX = "harness.launch.";
+/** Is `actionClass` a member of the `harness.launch.*` family? */
+export declare function isHarnessLaunchClass(actionClass: string): boolean;
+/**
+ * Does this family member resolve with NO explicit rule behind it? (APRV-354.)
+ *
+ * SPEC.md §7 says the family is never inferred autonomous. This is the stronger
+ * reading, and the one the family needs: it is never inferred AT ALL. A launch
+ * resolves only under a rule an operator wrote — `harness.launch.*` or
+ * `harness.launch.NAME` — and a policy that names neither refuses the launch
+ * rather than falling to `defaults.autonomy`.
+ *
+ * The reason is the window the softer reading opens. Before this family existed
+ * a harness launch was `unclassified`: refused outright. Adding the class and
+ * letting it fall to `defaults.autonomy` would make every launch grantable by a
+ * single approval in every project that has ever written `defaults: { autonomy:
+ * manual }` — which is all of them — the moment they upgraded. For most classes
+ * that is exactly right, because a manual default is an operator saying "ask
+ * me". For this one it is not: what the operator would be approving is a whole
+ * second agent whose own actions this gate never sees, and a capability that
+ * arrives by upgrade rather than by decision is not a capability anybody chose.
+ * Muse is the sharp end of it (a Contributor model trains on what it is shown,
+ * and the model may come from that harness's own settings where no command line
+ * shows it), and the rule is written for the family because the argument is not
+ * really about Muse.
+ *
+ * Keyed on `matched === null`, which is exactly "no rule of the policy's own
+ * decided this". That covers both spellings of the fallback: `provenance:
+ * "default"` (the file loaded and named nothing for this class) and
+ * `provenance: "fail-closed"` (the file did not load, so it names nothing for
+ * any class). An explicit rule resolves as written, human-only included.
+ */
+export declare function harnessLaunchNeedsRule(actionClass: string, resolution: Resolution): boolean;
+/** The refusal text for a harness launch no policy rule names (APRV-354). */
+export declare function harnessLaunchUnruledRefusal(actionClass: string, whatWasRefused: string): string;
 /**
  * Does `pattern` match `actionClass`?
  *

package/dist/src/core/policy-match.js

@@ -171,6 +171,58 @@ export function humanOnlyRefusal(actionClass, whatWasRefused) {
         `This is not a rejection — nobody decided anything, and asking again with a better summary will get the same answer. ` +
         `Nothing was appended. If the class should be gated rather than reserved, amend APPROVAL.md and re-attest it.`);
 }
+/**
+ * The `harness.launch.*` family: starting an agent harness session (APRV-354).
+ *
+ * Defined here rather than beside the classifier rows that emit it, because two
+ * enforcement paths and the classifier all have to agree on what the family IS,
+ * and a second spelling of the prefix is the shape of bug that lets one door
+ * close while another stays open.
+ */
+export const HARNESS_LAUNCH_PREFIX = "harness.launch.";
+/** Is `actionClass` a member of the `harness.launch.*` family? */
+export function isHarnessLaunchClass(actionClass) {
+    return actionClass.startsWith(HARNESS_LAUNCH_PREFIX);
+}
+/**
+ * Does this family member resolve with NO explicit rule behind it? (APRV-354.)
+ *
+ * SPEC.md §7 says the family is never inferred autonomous. This is the stronger
+ * reading, and the one the family needs: it is never inferred AT ALL. A launch
+ * resolves only under a rule an operator wrote — `harness.launch.*` or
+ * `harness.launch.NAME` — and a policy that names neither refuses the launch
+ * rather than falling to `defaults.autonomy`.
+ *
+ * The reason is the window the softer reading opens. Before this family existed
+ * a harness launch was `unclassified`: refused outright. Adding the class and
+ * letting it fall to `defaults.autonomy` would make every launch grantable by a
+ * single approval in every project that has ever written `defaults: { autonomy:
+ * manual }` — which is all of them — the moment they upgraded. For most classes
+ * that is exactly right, because a manual default is an operator saying "ask
+ * me". For this one it is not: what the operator would be approving is a whole
+ * second agent whose own actions this gate never sees, and a capability that
+ * arrives by upgrade rather than by decision is not a capability anybody chose.
+ * Muse is the sharp end of it (a Contributor model trains on what it is shown,
+ * and the model may come from that harness's own settings where no command line
+ * shows it), and the rule is written for the family because the argument is not
+ * really about Muse.
+ *
+ * Keyed on `matched === null`, which is exactly "no rule of the policy's own
+ * decided this". That covers both spellings of the fallback: `provenance:
+ * "default"` (the file loaded and named nothing for this class) and
+ * `provenance: "fail-closed"` (the file did not load, so it names nothing for
+ * any class). An explicit rule resolves as written, human-only included.
+ */
+export function harnessLaunchNeedsRule(actionClass, resolution) {
+    return isHarnessLaunchClass(actionClass) && resolution.matched === null;
+}
+/** The refusal text for a harness launch no policy rule names (APRV-354). */
+export function harnessLaunchUnruledRefusal(actionClass, whatWasRefused) {
+    return (`class ${actionClass} is a harness launch and this policy names no rule for it (SPEC.md §7, APRV-354), so ${whatWasRefused}. ` +
+        `Launching an agent harness resolves only under an explicit rule — \`${HARNESS_LAUNCH_PREFIX}*\` or \`${actionClass}\` — and never under \`defaults.autonomy\`, because a grant of this class covers the launch and nothing the launched session then does: that session runs its own tools outside this gate unless its own adapter is installed and attested. ` +
+        `This is not a rejection and nobody decided anything. ` +
+        `Nothing was appended. To allow it, add the line and re-attest (\`docs/proposals/harness-launch-2026-09.md\` carries this repository's pair, \`${HARNESS_LAUNCH_PREFIX}*\` at manual and \`${HARNESS_LAUNCH_PREFIX}muse\` at human-only).`);
+}
 const WILDCARD = "*";
 /** Split a dotted class or pattern into segments. */
 function segments(text) {

package/dist/src/core/policy-match.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-match.js","sourceRoot":"","sources":["../../../src/core/policy-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AA2GH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,UAAU,GAA+C;IACpE,YAAY,EAAE,CAAC;IACf,MAAM,EAAE,CAAC;IACT,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,CAAC;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,QAA0B,EAAE,IAA4B;IAMpF,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,+EAA+E;IAC/E,mEAAmE;IACnE,4EAA4E;IAC5E,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;IAC/B,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAC1F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,cAAsB;IAC1E,OAAO,CACL,SAAS,WAAW,gEAAgE,cAAc,IAAI;QACtG,yOAAyO;QACzO,sHAAsH;QACtH,8GAA8G,CAC/G,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,qDAAqD;AACrD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,WAAmB;IACjE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE5C,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GACvB,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;IAExE,IAAI,mBAAmB,EAAE,CAAC;QACxB,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,aAAa,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;IAC5E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,cAAc,KAAK,QAAQ;YAAE,SAAS;QAC1C,IAAI,cAAc,KAAK,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,QAAQ;YAAE,SAAS,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,CAAc,EAAE,CAAc;IACxD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;IAC/D,OAAO,CAAC,CAAC,CAAC,gEAAgE;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,CAAY,EAAE,CAAY;IACnD,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,aAAa,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC9C,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,WAAW,GAAyB;IACxC,QAAQ,EAAE,QAAQ;IAClB,gBAAgB,EAAE,QAAQ;IAC1B,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,KAAK;IACnB,iBAAiB,EAAE,KAAK;IACxB,oBAAoB,EAAE,EAAE;IACxB,UAAU,EAAE,EAAE;CACf,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,OAAO,CACrB,IAAsB,EACtB,WAAmB,EACnB,OAAO,GAAmB,EAAE;IAE5B,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAExD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC;QACxC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAE1B,OAAO,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,sEAAsE;AACtE,SAAS,oBAAoB,CAC3B,IAA6C,EAC7C,WAAmB,EACnB,UAAuB;IAEvB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,oCAAoC;IACpC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,WAAW;QACvB,wEAAwE;QACxE,wEAAwE;QACxE,iDAAiD;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,SAAS,YAAY,CACnB,IAA6C,EAC7C,UAAuB;IAEvB,qEAAqE;IACrE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC;IAC5D,OAAO;QACL,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChC,gBAAgB,EAAE,QAAQ;QAC1B,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,KAAK;QACnB,iBAAiB,EAAE,KAAK;QACxB,oBAAoB,EAAE,EAAE;QACxB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,UAAuB;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAE7E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM;QAC7E,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;QACnD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QACtC,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QACvD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;QACxC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;QAClC,YAAY,EAAE,KAAK;QACnB,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,iBAAiB,EAAE,SAAS,CAAC,KAAK,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAC1D;QACD,oBAAoB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;QACrE,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,SAAS,UAAU,CAAC,UAAsB,EAAE,OAAuB;IACjE,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,UAAU,CAAC;IAChG,IAAI,UAAU,CAAC,iBAAiB;QAAE,OAAO,UAAU,CAAC;IACpD,OAAO;QACL,GAAG,UAAU;QACb,QAAQ,EAAE,QAAQ;QAClB,0EAA0E;QAC1E,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,0EAA0E;QAC1E,4BAA4B;QAC5B,gBAAgB,EAAE,QAAQ;QAC1B,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,IAAI;QACd,2EAA2E;QAC3E,gCAAgC;QAChC,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,OAAO;QACnB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy-match.js","sourceRoot":"","sources":["../../../src/core/policy-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AA2GH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,UAAU,GAA+C;IACpE,YAAY,EAAE,CAAC;IACf,MAAM,EAAE,CAAC;IACT,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,CAAC;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,QAA0B,EAAE,IAA4B;IAMpF,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,+EAA+E;IAC/E,mEAAmE;IACnE,4EAA4E;IAC5E,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;IAC/B,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAC1F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,cAAsB;IAC1E,OAAO,CACL,SAAS,WAAW,gEAAgE,cAAc,IAAI;QACtG,yOAAyO;QACzO,sHAAsH;QACtH,8GAA8G,CAC/G,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,WAAW,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB,EAAE,UAAsB;IAChF,OAAO,oBAAoB,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,cAAsB;IACrF,OAAO,CACL,SAAS,WAAW,wFAAwF,cAAc,IAAI;QAC9H,uEAAuE,qBAAqB,YAAY,WAAW,8OAA8O;QACjW,uDAAuD;QACvD,iJAAiJ,qBAAqB,uBAAuB,qBAAqB,wBAAwB,CAC3O,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,qDAAqD;AACrD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,WAAmB;IACjE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE5C,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GACvB,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;IAExE,IAAI,mBAAmB,EAAE,CAAC;QACxB,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,aAAa,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;IAC5E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,cAAc,KAAK,QAAQ;YAAE,SAAS;QAC1C,IAAI,cAAc,KAAK,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,QAAQ;YAAE,SAAS,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,CAAc,EAAE,CAAc;IACxD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;IAC/D,OAAO,CAAC,CAAC,CAAC,gEAAgE;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,CAAY,EAAE,CAAY;IACnD,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,aAAa,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC9C,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,WAAW,GAAyB;IACxC,QAAQ,EAAE,QAAQ;IAClB,gBAAgB,EAAE,QAAQ;IAC1B,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,KAAK;IACnB,iBAAiB,EAAE,KAAK;IACxB,oBAAoB,EAAE,EAAE;IACxB,UAAU,EAAE,EAAE;CACf,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,OAAO,CACrB,IAAsB,EACtB,WAAmB,EACnB,OAAO,GAAmB,EAAE;IAE5B,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAExD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC;QACxC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAE1B,OAAO,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,sEAAsE;AACtE,SAAS,oBAAoB,CAC3B,IAA6C,EAC7C,WAAmB,EACnB,UAAuB;IAEvB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,oCAAoC;IACpC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,WAAW;QACvB,wEAAwE;QACxE,wEAAwE;QACxE,iDAAiD;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,SAAS,YAAY,CACnB,IAA6C,EAC7C,UAAuB;IAEvB,qEAAqE;IACrE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC;IAC5D,OAAO;QACL,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChC,gBAAgB,EAAE,QAAQ;QAC1B,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,KAAK;QACnB,iBAAiB,EAAE,KAAK;QACxB,oBAAoB,EAAE,EAAE;QACxB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,UAAuB;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAE7E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM;QAC7E,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;QACnD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QACtC,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QACvD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;QACxC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;QAClC,YAAY,EAAE,KAAK;QACnB,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,iBAAiB,EAAE,SAAS,CAAC,KAAK,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAC1D;QACD,oBAAoB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;QACrE,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,SAAS,UAAU,CAAC,UAAsB,EAAE,OAAuB;IACjE,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,UAAU,CAAC;IAChG,IAAI,UAAU,CAAC,iBAAiB;QAAE,OAAO,UAAU,CAAC;IACpD,OAAO;QACL,GAAG,UAAU;QACb,QAAQ,EAAE,QAAQ;QAClB,0EAA0E;QAC1E,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,0EAA0E;QAC1E,4BAA4B;QAC5B,gBAAgB,EAAE,QAAQ;QAC1B,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,IAAI;QACd,2EAA2E;QAC3E,gCAAgC;QAChC,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,OAAO;QACnB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC"}

package/dist/src/core/policy-proposal.d.ts

@@ -185,6 +185,41 @@ export declare function diffSize(summary: DiffSummary): {
 export declare function summarizeDiff(policyPath: string, baseline: Uint8Array | null | undefined, live: Uint8Array, attestedSha256: string | null, schemaDir?: string): DiffSummary;
 /** The stored value a channel displays as the prompt's full payload. */
 export declare function proposalPayloadValue(policyPath: string, text: string): Record<string, unknown>;
+/** What {@link inForcePolicyText} could recover, or why it could not. */
+export type InForcePolicy = {
+    ok: true;
+    text: string;
+    sha256: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The bytes of the policy currently IN FORCE, recovered and hash-verified
+ * (APRV-324 follow-up).
+ *
+ * The attestation ceremony records only the SHA-256 of the bytes it attests, so
+ * the log alone cannot produce them — `summarizeDiff` above says exactly that,
+ * and takes its baseline from a caller. What CAN produce them is the payload
+ * store: every `policy.proposed` binds the whole policy text as its payload
+ * (SPEC.md §10.4, so an approver can read the file rather than a summary of
+ * it), and a proposal that was attested therefore left the attested text
+ * addressable by its own `payload_hash`.
+ *
+ * So: find the hash in force, find any proposal that named exactly those bytes,
+ * read its stored text, and **verify**. Nothing here trusts the store — the
+ * recovered text is hashed and compared against the attested digest from the
+ * verified log, so a tampered, truncated or swapped payload file is a failure
+ * rather than a different policy wearing the attested hash.
+ *
+ * It fails, legitimately and often, and callers MUST have an answer for that:
+ * a policy attested at a terminal (`approval policy attest`, and `policy amend`
+ * on its human path) appends a `policy.updated` and stores nothing, so a chain
+ * that has never been attested from a phone has no recoverable bytes at all.
+ * `channels/contract.ts` is the caller, and its fallback is to refuse the
+ * privileged gesture rather than to assume.
+ */
+export declare function inForcePolicyText(records: readonly EventRecord[], storeDir: string): InForcePolicy;
 /**
  * Append a `policy.proposed` asking a human to attest `policyPath`'s bytes.
  *
@@ -244,6 +279,23 @@ export interface DecideAttestationOptions extends ProposalOptions {
     policyPath?: string;
     /** The channel delivery id this gesture answered, for audit. */
     batchDeliveryId?: string;
+    /**
+     * The authenticated account this answer arrived from (APRV-324 follow-up),
+     * recorded as `payload.sender`, and the kind of evidence it is.
+     *
+     * Absent means what it means everywhere else: the answer was attributed by
+     * configuration rather than by anything a transport authenticated, which is
+     * what every attestation before this field says. The RESOLUTION that decides
+     * whether a sender may answer at all is the decision surface's
+     * (`channels/contract.ts`), against the policy in force rather than the one
+     * being attested, and nothing here re-derives or second-guesses it.
+     */
+    sender?: {
+        channel: string;
+        id: string;
+        hashed?: true;
+    };
+    senderSource?: "policy";
 }
 /**
  * Answer a proposal: attest the bytes the prompt displayed, or decline them.

package/dist/src/core/policy-proposal.js

@@ -54,11 +54,11 @@
  */
 import { readFileSync } from "node:fs";
 import { basename, join } from "node:path";
-import { POLICY_HASH_FIELD, checkAttestationOfBytes, policyBytesHash, } from "./attest.js";
+import { POLICY_HASH_FIELD, attestationSha256, checkAttestationOfBytes, policyBytesHash, } from "./attest.js";
 import { tick } from "./clock.js";
 import { appendEvent, } from "./log.js";
 import { payloadHash } from "./payload.js";
-import { payloadStoreDirFor, storePayload } from "./payload-store.js";
+import { loadPayload, payloadStoreDirFor, storePayload } from "./payload-store.js";
 import { diffPolicies, renderDiff, SPEC_NAMESPACES } from "./policy-diff.js";
 import { loadPolicyText, POLICY_FILENAMES } from "./policy-load.js";
 import { readVerifiedRecords } from "./state.js";
@@ -76,6 +76,15 @@ const HUMAN_ACTOR = /^human:.+/u;
  * attestation as an ordinary authorization.
  */
 export const PROPOSAL_EVENT = "policy.proposed";
+/**
+ * The attestation's own event type (APRV-356).
+ *
+ * Spelled here rather than imported from `core/attest.ts` for the reason that
+ * module's header gives about direction: attestation knows nothing about
+ * proposals, and a cycle between the two would be a dependency neither needs.
+ * `attestationSha256` above already selects on the same string.
+ */
+const ATTESTATION_EVENT = "policy.updated";
 /** The event a decline appends. An attestation appends `policy.updated`. */
 export const DECLINE_EVENT = "policy.declined";
 /**
@@ -228,6 +237,82 @@ export function summarizeDiff(policyPath, baseline, live, attestedSha256, schema
 export function proposalPayloadValue(policyPath, text) {
     return { policy_path: basename(policyPath), text };
 }
+/**
+ * The bytes of the policy currently IN FORCE, recovered and hash-verified
+ * (APRV-324 follow-up).
+ *
+ * The attestation ceremony records only the SHA-256 of the bytes it attests, so
+ * the log alone cannot produce them — `summarizeDiff` above says exactly that,
+ * and takes its baseline from a caller. What CAN produce them is the payload
+ * store: every `policy.proposed` binds the whole policy text as its payload
+ * (SPEC.md §10.4, so an approver can read the file rather than a summary of
+ * it), and a proposal that was attested therefore left the attested text
+ * addressable by its own `payload_hash`.
+ *
+ * So: find the hash in force, find any proposal that named exactly those bytes,
+ * read its stored text, and **verify**. Nothing here trusts the store — the
+ * recovered text is hashed and compared against the attested digest from the
+ * verified log, so a tampered, truncated or swapped payload file is a failure
+ * rather than a different policy wearing the attested hash.
+ *
+ * It fails, legitimately and often, and callers MUST have an answer for that:
+ * a policy attested at a terminal (`approval policy attest`, and `policy amend`
+ * on its human path) appends a `policy.updated` and stores nothing, so a chain
+ * that has never been attested from a phone has no recoverable bytes at all.
+ * `channels/contract.ts` is the caller, and its fallback is to refuse the
+ * privileged gesture rather than to assume.
+ */
+export function inForcePolicyText(records, storeDir) {
+    let attested = null;
+    for (let index = records.length - 1; index >= 0; index -= 1) {
+        const sha = attestationSha256(records[index]);
+        if (sha !== null) {
+            attested = sha;
+            break;
+        }
+    }
+    if (attested === null) {
+        return { ok: false, reason: "no policy is in force: the log carries no attestation" };
+    }
+    // Two kinds of record can name the attested bytes, and both are read
+    // (APRV-356). A `policy.proposed` binds the whole text so an approver can
+    // read the file on a phone; since APRV-356 an ATTESTATION binds it too, so a
+    // chain only ever attested at a terminal is recoverable as well. Newest
+    // first, and the two are not ranked against each other: both are verified
+    // against the same digest from the same verified log, so whichever is found
+    // first carries bytes that hash to it or it is skipped.
+    for (let index = records.length - 1; index >= 0; index -= 1) {
+        const record = records[index];
+        if (record.event !== PROPOSAL_EVENT && record.event !== ATTESTATION_EVENT)
+            continue;
+        const payload = record.payload;
+        if (payload === undefined)
+            continue;
+        if (payload["sha256"] !== attested)
+            continue;
+        const bound = payload["payload_hash"];
+        if (typeof bound !== "string")
+            continue;
+        const stored = loadPayload(storeDir, bound);
+        if (!stored.ok)
+            continue;
+        const value = stored.value;
+        if (typeof value !== "object" || value === null)
+            continue;
+        const text = value["text"];
+        if (typeof text !== "string")
+            continue;
+        // The verification, and the only reason reading a file beside the log is
+        // allowed to answer a question about authority at all.
+        if (policyBytesHash(Buffer.from(text, "utf8")) !== attested)
+            continue;
+        return { ok: true, text, sha256: attested };
+    }
+    return {
+        ok: false,
+        reason: `the policy in force hashes ${attested} and its BYTES are not recoverable: no record naming those bytes — neither a policy.proposed nor the attestation itself — binds a payload this log can read beside it. Since APRV-356 every attestation stores the attested text, so this is the ordinary state of a chain last attested BEFORE that landed, where a terminal attestation recorded only the digest.`,
+    };
+}
 /**
  * Append a `policy.proposed` asking a human to attest `policyPath`'s bytes.
  *
@@ -439,6 +524,21 @@ export function decideAttestation(logPath, seq, decision, actor, options = {}) {
         sha256: derived.sha256,
         proposed_seq: derived.seq,
     };
+    // APRV-324 follow-up. The account the tap came from, when a surface
+    // authenticated one and the policy IN FORCE mapped it to this actor. The
+    // resolution is `channels/contract.ts`'s and is deliberately not repeated
+    // here: what this function records is which account the answer came from,
+    // not which account is allowed to give one.
+    if (options.sender !== undefined) {
+        payload["sender"] = {
+            channel: options.sender.channel,
+            id: options.sender.id,
+            // APRV-370: only when true, so a raw record does not change shape.
+            ...(options.sender.hashed === true ? { hashed: true } : {}),
+        };
+        if (options.senderSource !== undefined)
+            payload["sender_source"] = options.senderSource;
+    }
     if (options.note !== undefined)
         payload["note"] = options.note;
     if (options.batchDeliveryId !== undefined && options.batchDeliveryId.length > 0) {