grafeo-ogm 2.1.0 → 2.2.0

package/dist/esm/policy/explain.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Pure helpers behind `Model.explainPolicies()` (GitHub issue #6).
+ *
+ * The explain path never re-derives a policy predicate. It consumes the
+ * fragments `WhereCompiler.compileForExplain` produced for enforcement,
+ * projects one boolean per applied policy, and cross-checks the verdict
+ * implied by those outcomes against the literal enforcement predicate.
+ */
+import { type CompiledPolicyFragments } from '../compilers/where.compiler';
+import type { DetailedPolicy, DetailedResolution, PolicyClauseOutcome, PolicyExplanation } from './types';
+/** Default candidate cap for one `explainPolicies` call. */
+export declare const EXPLAIN_DEFAULT_LIMIT = 100;
+/** Hard candidate cap — explain evaluates every policy per candidate. */
+export declare const EXPLAIN_MAX_LIMIT = 1000;
+/** Cypher variable holding the per-policy outcome list. */
+export declare const EXPLAIN_OUTCOMES = "__explain_outcomes";
+/** Cypher variable holding the literal enforcement verdict. */
+export declare const EXPLAIN_VISIBLE = "__explain_visible";
+/**
+ * Validate `options.limit` for an explain call: default 100, reject
+ * anything above 1,000 instead of silently clamping (a diagnostic must
+ * not quietly drop the candidate an operator asked about).
+ */
+export declare function resolveExplainLimit(limit: number | undefined): number;
+/** How one reported policy's outcome is determined for every candidate. */
+type ExplainSlot = {
+    readonly entry: DetailedPolicy;
+    readonly projected: number;
+} | {
+    readonly entry: DetailedPolicy;
+    readonly fixed: PolicyClauseOutcome;
+};
+export interface ExplainPlan {
+    /** Cypher boolean expressions projected as `__explain_outcomes`. */
+    readonly outcomeExpressions: ReadonlyArray<string>;
+    /** One slot per reported policy, in registration order. */
+    readonly slots: ReadonlyArray<ExplainSlot>;
+    readonly overriddenBy: string | null;
+    /** No policy is registered for the type — reads are unconstrained. */
+    readonly unrestricted: boolean;
+}
+/**
+ * Pair each detailed policy with its compiled fragments and decide which
+ * outcomes need a per-row projection. `fragments` must come from compiling
+ * `projectResolution(detailed)` — the SAME detailed object — so the
+ * positional alignment below holds; it is verified by identity anyway.
+ */
+export declare function buildExplainPlan(detailed: DetailedResolution | null, fragments: CompiledPolicyFragments | null): ExplainPlan;
+/**
+ * Turn one result row into its explanation and verify it. `rawVisible` is
+ * the enforcement predicate's own value (`coalesce(<clause>, false)`); the
+ * verdict recomputed from the per-policy outcomes MUST agree with it.
+ * AND/OR are monotone in Cypher's three-valued logic, so reading NULL as
+ * not-true at the leaves yields the same truth value as `coalesce` at the
+ * root — any disagreement is an engine bug, never a valid explanation.
+ */
+export declare function interpretExplainRow(plan: ExplainPlan, rawOutcomes: unknown, rawVisible: unknown, typeName: string, row: number): Omit<PolicyExplanation<never>, 'node'>;
+export {};
+//# sourceMappingURL=explain.d.ts.map

package/dist/esm/policy/explain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.d.ts","sourceRoot":"","sources":["../../../src/policy/explain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAElB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AACvC,2DAA2D;AAC3D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AACrD,+DAA+D;AAC/D,eAAO,MAAM,eAAe,sBAAsB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUrE;AAED,2EAA2E;AAC3E,KAAK,WAAW,GACZ;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAQD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,EACnC,SAAS,EAAE,uBAAuB,GAAG,IAAI,GACxC,WAAW,CAqFb;AAWD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,OAAO,EACpB,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CA0DxC"}

package/dist/esm/policy/explain.js

@@ -0,0 +1,169 @@
+/**
+ * Pure helpers behind `Model.explainPolicies()` (GitHub issue #6).
+ *
+ * The explain path never re-derives a policy predicate. It consumes the
+ * fragments `WhereCompiler.compileForExplain` produced for enforcement,
+ * projects one boolean per applied policy, and cross-checks the verdict
+ * implied by those outcomes against the literal enforcement predicate.
+ */
+import { policyValueExpression, } from '../compilers/where.compiler';
+import { OGMError } from '../errors';
+/** Default candidate cap for one `explainPolicies` call. */
+export const EXPLAIN_DEFAULT_LIMIT = 100;
+/** Hard candidate cap — explain evaluates every policy per candidate. */
+export const EXPLAIN_MAX_LIMIT = 1000;
+/** Cypher variable holding the per-policy outcome list. */
+export const EXPLAIN_OUTCOMES = '__explain_outcomes';
+/** Cypher variable holding the literal enforcement verdict. */
+export const EXPLAIN_VISIBLE = '__explain_visible';
+/**
+ * Validate `options.limit` for an explain call: default 100, reject
+ * anything above 1,000 instead of silently clamping (a diagnostic must
+ * not quietly drop the candidate an operator asked about).
+ */
+export function resolveExplainLimit(limit) {
+    if (limit == null)
+        return EXPLAIN_DEFAULT_LIMIT;
+    const n = Math.trunc(Number(limit));
+    if (!Number.isFinite(n) || n < 0)
+        throw new OGMError('limit must be a non-negative integer');
+    if (n > EXPLAIN_MAX_LIMIT)
+        throw new OGMError(`explainPolicies: limit ${n} exceeds the maximum of ${EXPLAIN_MAX_LIMIT} candidates per call. Narrow the candidate \`where\` instead.`);
+    return n;
+}
+function internalError(message) {
+    return new OGMError(`explainPolicies: ${message}. No explanation was returned — please report this as a grafeo-ogm bug.`);
+}
+/**
+ * Pair each detailed policy with its compiled fragments and decide which
+ * outcomes need a per-row projection. `fragments` must come from compiling
+ * `projectResolution(detailed)` — the SAME detailed object — so the
+ * positional alignment below holds; it is verified by identity anyway.
+ */
+export function buildExplainPlan(detailed, fragments) {
+    if (!detailed)
+        return {
+            outcomeExpressions: [],
+            slots: [],
+            overriddenBy: null,
+            unrestricted: true,
+        };
+    // An override fired: enforcement emits no predicate, nothing to project.
+    if (detailed.overriddenBy !== null)
+        return {
+            outcomeExpressions: [],
+            slots: detailed.entries.map((entry) => ({
+                entry,
+                fixed: entry.applied
+                    ? 'pass'
+                    : entry.skipped
+                        ? 'skipped'
+                        : 'not-applied',
+            })),
+            overriddenBy: detailed.overriddenBy,
+            unrestricted: false,
+        };
+    if (!fragments)
+        throw internalError('policy fragments are missing for the resolution');
+    const outcomeExpressions = [];
+    const slots = [];
+    let permIdx = 0;
+    let restIdx = 0;
+    for (const entry of detailed.entries) {
+        const { policy } = entry;
+        // No override fired, so every override evaluated to false.
+        if (policy.kind === 'override') {
+            slots.push({ entry, fixed: 'not-applied' });
+            continue;
+        }
+        // Non-applying permissives are dropped by the resolver — never compiled.
+        if (policy.kind === 'permissive' && !entry.applied) {
+            slots.push({ entry, fixed: 'not-applied' });
+            continue;
+        }
+        const compiled = policy.kind === 'permissive'
+            ? fragments.permissives[permIdx++]
+            : fragments.restrictives[restIdx++];
+        if (!compiled || compiled.policy !== policy)
+            throw internalError(`compiled fragments are misaligned with the resolution at policy "${entry.name}"`);
+        // Restrictives are compiled even when gated off (the compiler
+        // re-checks `appliesWhen` and emits nothing). Parts here would mean
+        // the two `appliesWhen` evaluations disagreed.
+        if (!entry.applied) {
+            if (compiled.parts.length > 0)
+                throw new OGMError(`explainPolicies: appliesWhen of policy "${entry.name}" returned different results across evaluations for the same ctx. appliesWhen must be a pure function of ctx.`);
+            slots.push({ entry, fixed: 'not-applied' });
+            continue;
+        }
+        const expr = policyValueExpression(policy.kind, compiled.parts);
+        if (expr === null) {
+            slots.push({ entry, fixed: 'abstain' });
+            continue;
+        }
+        slots.push({ entry, projected: outcomeExpressions.length });
+        outcomeExpressions.push(expr);
+    }
+    if (permIdx !== fragments.permissives.length ||
+        restIdx !== fragments.restrictives.length)
+        throw internalError('compiled fragments are misaligned with the resolution (unconsumed fragments)');
+    return { outcomeExpressions, slots, overriddenBy: null, unrestricted: false };
+}
+function toOutcome(value, policyName) {
+    if (value === true)
+        return 'pass';
+    if (value === false)
+        return 'fail';
+    if (value === null || value === undefined)
+        return 'null';
+    throw new OGMError(`explainPolicies: policy "${policyName}" evaluated to a non-boolean value (${typeof value}). Policy predicates must be boolean expressions.`);
+}
+/**
+ * Turn one result row into its explanation and verify it. `rawVisible` is
+ * the enforcement predicate's own value (`coalesce(<clause>, false)`); the
+ * verdict recomputed from the per-policy outcomes MUST agree with it.
+ * AND/OR are monotone in Cypher's three-valued logic, so reading NULL as
+ * not-true at the leaves yields the same truth value as `coalesce` at the
+ * root — any disagreement is an engine bug, never a valid explanation.
+ */
+export function interpretExplainRow(plan, rawOutcomes, rawVisible, typeName, row) {
+    if (!Array.isArray(rawOutcomes) ||
+        rawOutcomes.length !== plan.outcomeExpressions.length)
+        throw internalError(`row ${row} of type "${typeName}" returned ${Array.isArray(rawOutcomes) ? rawOutcomes.length : typeof rawOutcomes} policy outcomes, expected ${plan.outcomeExpressions.length}`);
+    const policies = plan.slots.map((slot) => ({
+        name: slot.entry.name,
+        named: slot.entry.named,
+        kind: slot.entry.kind,
+        source: slot.entry.source,
+        applied: slot.entry.applied,
+        outcome: 'fixed' in slot
+            ? slot.fixed
+            : toOutcome(rawOutcomes[slot.projected], slot.entry.name),
+    }));
+    let visible;
+    let permissiveGranted;
+    if (plan.unrestricted || plan.overriddenBy !== null) {
+        visible = true;
+        permissiveGranted = true;
+    }
+    else {
+        permissiveGranted = policies.some((p) => p.kind === 'permissive' && p.outcome === 'pass');
+        const restrictivesHold = policies.every((p) => p.kind !== 'restrictive' ||
+            !p.applied ||
+            p.outcome === 'pass' ||
+            p.outcome === 'abstain');
+        visible = permissiveGranted && restrictivesHold;
+    }
+    if (rawVisible !== visible)
+        throw internalError(`consistency check failed for row ${row} of type "${typeName}": the enforcement predicate evaluated to ${String(rawVisible)} but the per-policy outcomes imply ${String(visible)}`);
+    return {
+        visible,
+        overriddenBy: plan.overriddenBy,
+        permissiveGranted,
+        failedRestrictives: policies
+            .filter((p) => p.kind === 'restrictive' &&
+            (p.outcome === 'fail' || p.outcome === 'null'))
+            .map((p) => p.name),
+        policies,
+    };
+}
+//# sourceMappingURL=explain.js.map

package/dist/esm/policy/explain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.js","sourceRoot":"","sources":["../../../src/policy/explain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,GAEtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AASrC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAK,CAAC;AACvC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACrD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,qBAAqB,CAAC;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,sCAAsC,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,iBAAiB;QACvB,MAAM,IAAI,QAAQ,CAChB,0BAA0B,CAAC,2BAA2B,iBAAiB,+DAA+D,CACvI,CAAC;IACJ,OAAO,CAAC,CAAC;AACX,CAAC;AAiBD,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,QAAQ,CACjB,oBAAoB,OAAO,yEAAyE,CACrG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmC,EACnC,SAAyC;IAEzC,IAAI,CAAC,QAAQ;QACX,OAAO;YACL,kBAAkB,EAAE,EAAE;YACtB,KAAK,EAAE,EAAE;YACT,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;SACnB,CAAC;IAEJ,yEAAyE;IACzE,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI;QAChC,OAAO;YACL,kBAAkB,EAAE,EAAE;YACtB,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtC,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,OAAO;oBAClB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,KAAK,CAAC,OAAO;wBACb,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,aAAa;aACpB,CAAC,CAAC;YACH,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,KAAK;SACpB,CAAC;IAEJ,IAAI,CAAC,SAAS;QACZ,MAAM,aAAa,CAAC,iDAAiD,CAAC,CAAC;IAEzE,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACzB,2DAA2D;QAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,YAAY;YAC1B,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAClC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;YACzC,MAAM,aAAa,CACjB,oEAAoE,KAAK,CAAC,IAAI,GAAG,CAClF,CAAC;QAEJ,8DAA8D;QAC9D,oEAAoE;QACpE,+CAA+C;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAC3B,MAAM,IAAI,QAAQ,CAChB,2CAA2C,KAAK,CAAC,IAAI,+GAA+G,CACrK,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IACE,OAAO,KAAK,SAAS,CAAC,WAAW,CAAC,MAAM;QACxC,OAAO,KAAK,SAAS,CAAC,YAAY,CAAC,MAAM;QAEzC,MAAM,aAAa,CACjB,8EAA8E,CAC/E,CAAC;IAEJ,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,UAAkB;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,IAAI,QAAQ,CAChB,4BAA4B,UAAU,uCAAuC,OAAO,KAAK,mDAAmD,CAC7I,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAiB,EACjB,WAAoB,EACpB,UAAmB,EACnB,QAAgB,EAChB,GAAW;IAEX,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAC3B,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,kBAAkB,CAAC,MAAM;QAErD,MAAM,aAAa,CACjB,OAAO,GAAG,aAAa,QAAQ,cAAc,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,WAAW,8BAA8B,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAChL,CAAC;IAEJ,MAAM,QAAQ,GAA8B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;QACvB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QACrB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;QACzB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;QAC3B,OAAO,EACL,OAAO,IAAI,IAAI;YACb,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;KAC9D,CAAC,CAAC,CAAC;IAEJ,IAAI,OAAgB,CAAC;IACrB,IAAI,iBAA0B,CAAC;IAC/B,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,GAAG,IAAI,CAAC;QACf,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CACvD,CAAC;QACF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,aAAa;YACxB,CAAC,CAAC,CAAC,OAAO;YACV,CAAC,CAAC,OAAO,KAAK,MAAM;YACpB,CAAC,CAAC,OAAO,KAAK,SAAS,CAC1B,CAAC;QACF,OAAO,GAAG,iBAAiB,IAAI,gBAAgB,CAAC;IAClD,CAAC;IAED,IAAI,UAAU,KAAK,OAAO;QACxB,MAAM,aAAa,CACjB,oCAAoC,GAAG,aAAa,QAAQ,6CAA6C,MAAM,CAAC,UAAU,CAAC,sCAAsC,MAAM,CAAC,OAAO,CAAC,EAAE,CACnL,CAAC;IAEJ,OAAO;QACL,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,iBAAiB;QACjB,kBAAkB,EAAE,QAAQ;aACzB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,aAAa;YACxB,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CACjD;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/esm/policy/resolver.d.ts

@@ -1,5 +1,5 @@
 import type { SchemaMetadata } from '../schema/types';
-import type { Operation, Policy, PolicyContext, ResolvedPolicies } from './types';
+import type { DetailedResolution, Operation, Policy, PolicyContext, ResolvedPolicies } from './types';
 /**
  * Build an immutable resolver from a registry. The registry is built by
  * the OGM constructor after schema validation.
@@ -24,12 +24,36 @@ export declare class PolicyResolver<C extends PolicyContext = PolicyContext> {
      * identical Cypher).
      */
     resolve(typeName: string, op: Operation, ctx: C): ResolvedPolicies<C> | null;
+    /**
+     * Resolve every operation-matching policy for `(typeName, op, ctx)`
+     * WITHOUT dropping any: `applied` records the `appliesWhen(ctx)` gate
+     * (or, for overrides, `when(ctx)`), and `skipped` marks policies never
+     * evaluated because an earlier override fired. This is the single place
+     * the resolver invokes `appliesWhen`; `resolve()` projects from it.
+     *
+     * Callback invocation order is unchanged from the pre-explain resolver:
+     * override `when` callbacks first (stopping at the first that fires),
+     * then `appliesWhen` in registration order — skipped entirely when an
+     * override fired.
+     *
+     * Returns `null` exactly when `resolve()` does.
+     */
+    resolveDetailed(typeName: string, op: Operation, ctx: C): DetailedResolution<C> | null;
     /**
      * Gather all sources of policy that apply to a given concrete type:
-     * the type's own list, plus any interfaces it implements.
+     * the type's own list, plus any interfaces it implements — each tagged
+     * with the registry key that declared it.
      */
     private gatherSources;
 }
+/**
+ * Project a detailed resolution onto the `ResolvedPolicies` shape the
+ * compilers consume. `PolicyResolver.resolve()` is exactly
+ * `projectResolution(resolveDetailed(...))`; the explain path calls it on
+ * the SAME detailed object it reports on, so the compiled fragments stay
+ * positionally aligned with the reported entries.
+ */
+export declare function projectResolution<C extends PolicyContext>(detailed: DetailedResolution<C>): ResolvedPolicies<C>;
 /**
  * Stable, value-free fingerprint of a context object. Used in audit
  * metadata so query logs can be correlated by ctx-shape WITHOUT leaking

package/dist/esm/policy/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACV,SAAS,EAGT,MAAM,EACN,aAAa,EACb,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB;;;;;;;GAOG;AACH,qBAAa,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAGtC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EACvD,MAAM,EAAE,cAAc;IAMxB,kFAAkF;IAClF,MAAM,IAAI,OAAO;IAIjB;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI;IA6C5E;;;OAGG;IACH,OAAO,CAAC,aAAa;CAgBtB;AAWD;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAK9D"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAEV,kBAAkB,EAClB,SAAS,EAGT,MAAM,EACN,aAAa,EACb,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB;;;;;;;GAOG;AACH,qBAAa,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAGtC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EACvD,MAAM,EAAE,cAAc;IAMxB,kFAAkF;IAClF,MAAM,IAAI,OAAO;IAIjB;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI;IAK5E;;;;;;;;;;;;;OAaG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,CAAC,GACL,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI;IA0D/B;;;;OAIG;IACH,OAAO,CAAC,aAAa;CAiBtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,aAAa,EACvD,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC9B,gBAAgB,CAAC,CAAC,CAAC,CAyCrB;AAWD;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAK9D"}

package/dist/esm/policy/resolver.js

@@ -26,67 +26,136 @@ export class PolicyResolver {
      * identical Cypher).
      */
     resolve(typeName, op, ctx) {
+        const detailed = this.resolveDetailed(typeName, op, ctx);
+        return detailed ? projectResolution(detailed) : null;
+    }
+    /**
+     * Resolve every operation-matching policy for `(typeName, op, ctx)`
+     * WITHOUT dropping any: `applied` records the `appliesWhen(ctx)` gate
+     * (or, for overrides, `when(ctx)`), and `skipped` marks policies never
+     * evaluated because an earlier override fired. This is the single place
+     * the resolver invokes `appliesWhen`; `resolve()` projects from it.
+     *
+     * Callback invocation order is unchanged from the pre-explain resolver:
+     * override `when` callbacks first (stopping at the first that fires),
+     * then `appliesWhen` in registration order — skipped entirely when an
+     * override fired.
+     *
+     * Returns `null` exactly when `resolve()` does.
+     */
+    resolveDetailed(typeName, op, ctx) {
         const sources = this.gatherSources(typeName);
         if (sources.length === 0)
             return null;
         const matching = [];
-        for (const list of sources)
-            for (const p of list)
-                if (operationMatches(p.operations, op))
-                    matching.push(p);
+        for (const { source, policies } of sources)
+            policies.forEach((policy, index) => {
+                if (operationMatches(policy.operations, op))
+                    matching.push({ policy, source, index });
+            });
         if (matching.length === 0)
             return null;
         // Override short-circuit. First matching override whose `when` returns
-        // true wins — emit nothing.
-        for (const p of matching)
-            if (p.kind === 'override' && p.when(ctx))
-                return {
-                    overridden: true,
-                    permissives: [],
-                    restrictives: [],
-                    evaluated: [p.name ?? 'override'],
-                };
-        const permissives = [];
-        const restrictives = [];
-        const evaluated = [];
-        for (const p of matching)
-            if (p.kind === 'permissive') {
-                // appliesWhen is compile-time. False → drop policy entirely.
-                if (p.appliesWhen && !p.appliesWhen(ctx))
-                    continue;
-                permissives.push(p);
-                evaluated.push(p.name ?? 'permissive');
+        // true wins — nothing after it is evaluated.
+        let firing = -1;
+        for (let i = 0; i < matching.length; i++) {
+            const p = matching[i].policy;
+            if (p.kind === 'override' && p.when(ctx)) {
+                firing = i;
+                break;
             }
-            else if (p.kind === 'restrictive') {
-                restrictives.push(p);
-                evaluated.push(p.name ?? 'restrictive');
+        }
+        const entries = matching.map(({ policy, source, index }, i) => {
+            const named = Boolean(policy.name);
+            const name = named
+                ? policy.name
+                : `${source}.${policy.kind}[${index}]`;
+            const base = { policy, kind: policy.kind, source, index, name, named };
+            if (firing >= 0) {
+                if (i === firing)
+                    return { ...base, applied: true, skipped: false };
+                // Overrides before the firing one WERE evaluated (to false).
+                if (policy.kind === 'override' && i < firing)
+                    return { ...base, applied: false, skipped: false };
+                return { ...base, applied: false, skipped: true };
             }
+            if (policy.kind === 'override')
+                return { ...base, applied: false, skipped: false };
+            const applied = !policy.appliesWhen || policy.appliesWhen(ctx);
+            return { ...base, applied, skipped: false };
+        });
         return {
-            overridden: false,
-            permissives,
-            restrictives,
-            evaluated,
+            overriddenBy: firing >= 0 ? entries[firing].name : null,
+            entries,
         };
     }
     /**
      * Gather all sources of policy that apply to a given concrete type:
-     * the type's own list, plus any interfaces it implements.
+     * the type's own list, plus any interfaces it implements — each tagged
+     * with the registry key that declared it.
      */
     gatherSources(typeName) {
         const out = [];
         const own = this.registry.get(typeName);
         if (own)
-            out.push(own);
+            out.push({ source: typeName, policies: own });
         const nodeDef = this.schema.nodes.get(typeName);
         if (nodeDef)
             for (const ifaceName of nodeDef.implementsInterfaces) {
                 const ifacePolicies = this.registry.get(ifaceName);
                 if (ifacePolicies)
-                    out.push(ifacePolicies);
+                    out.push({ source: ifaceName, policies: ifacePolicies });
             }
         return out;
     }
 }
+/**
+ * Project a detailed resolution onto the `ResolvedPolicies` shape the
+ * compilers consume. `PolicyResolver.resolve()` is exactly
+ * `projectResolution(resolveDetailed(...))`; the explain path calls it on
+ * the SAME detailed object it reports on, so the compiled fragments stay
+ * positionally aligned with the reported entries.
+ */
+export function projectResolution(detailed) {
+    if (detailed.overriddenBy !== null) {
+        const firing = detailed.entries.find((e) => e.policy.kind === 'override' && e.applied);
+        return {
+            overridden: true,
+            permissives: [],
+            restrictives: [],
+            evaluated: [firing.policy.name ?? 'override'],
+        };
+    }
+    const permissives = [];
+    const restrictives = [];
+    const evaluated = [];
+    for (const { policy: p, applied } of detailed.entries)
+        if (p.kind === 'permissive') {
+            // appliesWhen is compile-time. False → drop policy entirely.
+            if (!applied)
+                continue;
+            permissives.push(p);
+            evaluated.push(p.name ?? 'permissive');
+        }
+        else if (p.kind === 'restrictive') {
+            // Restrictives are kept even when `appliesWhen(ctx)` is false —
+            // the compiler / `evaluateWriteRestrictives` enforce the gate
+            // downstream. Dropping them here would change what
+            // `InterfaceModel.compileInterfacePolicyClause` sees: an
+            // implementer left with no permissives AND no restrictives is
+            // treated as unconstrained (`THEN true`) instead of default-deny.
+            restrictives.push(p);
+            // Audit metadata lists only policies that actually applied.
+            if (applied)
+                evaluated.push(p.name ?? 'restrictive');
+        }
+    return {
+        overridden: false,
+        permissives,
+        restrictives,
+        evaluated,
+    };
+}
 function operationMatches(operations, op) {
     for (const candidate of operations)
         if (candidate === '*' || candidate === op)

package/dist/esm/policy/resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAYpC;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAIzB,YACE,QAAuD,EACvD,MAAsB;QAEtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kFAAkF;IAClF,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAgB,EAAE,EAAa,EAAE,GAAM;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,QAAQ,GAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,OAAO;YACxB,KAAK,MAAM,CAAC,IAAI,IAAI;gBAClB,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,uEAAuE;QACvE,4BAA4B;QAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtC,OAAO;oBACL,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,EAAE;oBACf,YAAY,EAAE,EAAE;oBAChB,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC;iBAClC,CAAC;QAEN,MAAM,WAAW,GAA0B,EAAE,CAAC;QAC9C,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,CAAC,IAAI,QAAQ;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,6DAA6D;gBAC7D,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACnD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACpC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC;YAC1C,CAAC;QAEH,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,QAAgB;QAEhB,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,OAAO;YACT,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,IAAI,aAAa;oBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,UAA8C,EAC9C,EAAa;IAEb,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAA8B;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAcpC;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAIzB,YACE,QAAuD,EACvD,MAAsB;QAEtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kFAAkF;IAClF,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAgB,EAAE,EAAa,EAAE,GAAM;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,CACb,QAAgB,EAChB,EAAa,EACb,GAAM;QAEN,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,QAAQ,GAIT,EAAE,CAAC;QACR,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO;YACxC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBACjC,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;oBACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QAEL,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAwB,QAAQ,CAAC,GAAG,CAC/C,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK;gBAChB,CAAC,CAAE,MAAM,CAAC,IAAe;gBACzB,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YACzC,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAEvE,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,KAAK,MAAM;oBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACpE,6DAA6D;gBAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,MAAM;oBAC1C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACrD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;gBAC5B,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAErD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9C,CAAC,CACF,CAAC;QAEF,OAAO;YACL,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACvD,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,aAAa,CACnB,QAAgB;QAEhB,MAAM,GAAG,GAA6D,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,OAAO;YACT,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,IAAI,aAAa;oBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7D,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA+B;IAE/B,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,CAChD,CAAC;QACH,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAA0B,EAAE,CAAC;IAC9C,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO;QACnD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5B,6DAA6D;YAC7D,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,gEAAgE;YAChE,8DAA8D;YAC9D,mDAAmD;YACnD,yDAAyD;YACzD,8DAA8D;YAC9D,kEAAkE;YAClE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,4DAA4D;YAC5D,IAAI,OAAO;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC;QACvD,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,WAAW;QACX,YAAY;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA8C,EAC9C,EAAa;IAEb,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAA8B;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/esm/policy/types.d.ts

@@ -167,6 +167,93 @@ export interface ResolvedPolicies<C extends PolicyContext = PolicyContext> {
     /** Names of policies that fired (for audit logging). */
     evaluated: ReadonlyArray<string>;
 }
+/**
+ * One operation-matching policy as seen by
+ * `PolicyResolver.resolveDetailed()`. Unlike `ResolvedPolicies`, nothing
+ * is dropped: policies gated off by `appliesWhen` and policies never
+ * evaluated because an override fired are reported too. Consumed by the
+ * explain path (`Model.explainPolicies`).
+ */
+export interface DetailedPolicy<C extends PolicyContext = PolicyContext> {
+    readonly policy: Policy<C>;
+    readonly kind: Policy<C>['kind'];
+    /** Type or interface whose registry entry declared this policy. */
+    readonly source: string;
+    /** Position in `source`'s registration list (all operations counted). */
+    readonly index: number;
+    /** `policy.name`, or `<source>.<kind>[<index>]` when unnamed. */
+    readonly name: string;
+    /** False when `name` is the synthesized fallback identifier. */
+    readonly named: boolean;
+    /**
+     * `appliesWhen(ctx)` held (absent counts as held). For an override:
+     * its `when(ctx)` returned true. Always false when `skipped`.
+     */
+    readonly applied: boolean;
+    /** Not evaluated at all because an earlier override fired. */
+    readonly skipped: boolean;
+}
+/**
+ * Outcome of one policy for one candidate node, as reported by
+ * `Model.explainPolicies()`:
+ *
+ * - `pass` — applied; its predicate evaluated to `true`.
+ * - `fail` — applied; evaluated to `false` (includes a restrictive hard
+ *   deny, `when: () => false`).
+ * - `null` — applied; evaluated to NULL (three-valued logic, e.g. a
+ *   missing property). Enforcement treats it as not-true.
+ * - `abstain` — applied, but emitted no predicate. A permissive abstain
+ *   grants nothing; a restrictive abstain restricts nothing.
+ * - `not-applied` — `appliesWhen(ctx)` was false (override: `when(ctx)`
+ *   was false). Not compiled or evaluated.
+ * - `skipped` — not evaluated because an earlier override fired.
+ */
+export type PolicyClauseOutcome = 'pass' | 'fail' | 'null' | 'abstain' | 'not-applied' | 'skipped';
+/** One policy's report within a `PolicyExplanation`. */
+export interface PolicyClauseExplanation {
+    /** `policy.name`, or `<source>.<kind>[<index>]` when unnamed. */
+    readonly name: string;
+    /** False when `name` is the synthesized fallback identifier. */
+    readonly named: boolean;
+    readonly kind: 'override' | 'permissive' | 'restrictive';
+    /** Type or interface whose registry entry declared the policy. */
+    readonly source: string;
+    /** `appliesWhen(ctx)` held (override: `when(ctx)` was true). */
+    readonly applied: boolean;
+    readonly outcome: PolicyClauseOutcome;
+}
+/**
+ * Per-candidate result of `Model.explainPolicies()`. `visible` is the
+ * exact verdict `find` enforces for the same bound context; the other
+ * fields explain it.
+ */
+export interface PolicyExplanation<T = Record<string, unknown>> {
+    /** The candidate, projected with the requested selection. */
+    readonly node: T;
+    /** Would `find` return this node for the bound context? */
+    readonly visible: boolean;
+    /** Name of the override that fired, else `null`. */
+    readonly overriddenBy: string | null;
+    /**
+     * Some permissive granted access (`true` when an override fired or the
+     * type has no policies). `false` → default deny.
+     */
+    readonly permissiveGranted: boolean;
+    /** Names of applied restrictives whose outcome is `fail` or `null`. */
+    readonly failedRestrictives: ReadonlyArray<string>;
+    /** Every `read` policy for the type, in registration order. */
+    readonly policies: ReadonlyArray<PolicyClauseExplanation>;
+}
+/**
+ * Full resolution for one (typeName, operation, ctx) triple. Entries are
+ * in registration order — the type's own policies first, then each
+ * implemented interface's.
+ */
+export interface DetailedResolution<C extends PolicyContext = PolicyContext> {
+    /** Fallback-aware name of the override that fired, else `null`. */
+    readonly overriddenBy: string | null;
+    readonly entries: ReadonlyArray<DetailedPolicy<C>>;
+}
 /**
  * Carries policy state through one compile pass. Created per query in
  * `Model` / `InterfaceModel` and threaded into `WhereCompiler` /

package/dist/esm/policy/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,GAAG,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACrE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CACpC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAClD,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACnD,wEAAwE;IACxE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,CAC3B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IACzD,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACtD,cAAc,CAAC,CAAC,CAAC,GACjB,gBAAgB,CAAC,CAAC,CAAC,GACnB,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CACzB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,aAAa,GAAG,aAAa,IACrC;KACD,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACnD,GAAG;IACF,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC1D,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA0CD,wBAAgB,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EAC9D,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GACpC,cAAc,CAAC,CAAC,CAAC,CAQnB;AAED,wBAAgB,UAAU,CACxB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAkBpE;AAwCD,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAE3D,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAC/C,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChC,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAsDhF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,aAAa,EACvD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAI/B;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EACxD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAIhC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACvE,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,YAAY,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,wDAAwD;IACxD,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC1E,GAAG,EAAE,CAAC,CAAC;IACP,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;OAKG;IACH,cAAc,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,SAAS,KACV,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,EAAE,cAAc,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,GAAG,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACrE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CACpC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAClD,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACnD,wEAAwE;IACxE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,CAC3B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IACzD,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACtD,cAAc,CAAC,CAAC,CAAC,GACjB,gBAAgB,CAAC,CAAC,CAAC,GACnB,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CACzB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,aAAa,GAAG,aAAa,IACrC;KACD,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACnD,GAAG;IACF,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC1D,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA0CD,wBAAgB,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EAC9D,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GACpC,cAAc,CAAC,CAAC,CAAC,CAQnB;AAED,wBAAgB,UAAU,CACxB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAkBpE;AAwCD,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAE3D,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAC/C,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChC,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAsDhF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,aAAa,EACvD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAI/B;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EACxD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAIhC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACvE,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,YAAY,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,wDAAwD;IACxD,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,GACN,MAAM,GACN,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;IACzD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5D,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACzE,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC1E,GAAG,EAAE,CAAC,CAAC;IACP,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;OAKG;IACH,cAAc,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,SAAS,KACV,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,EAAE,cAAc,CAAC;CAC1B"}