grafeo-ogm 2.1.1 → 2.3.0

package/dist/esm/policy/nested-writes.js

@@ -0,0 +1,193 @@
+/**
+ * Application-layer policy checks for create / update input (v2.3.0),
+ * shared by the ROOT write and every NESTED write reached through its
+ * relationships. A nested write enforces exactly what the equivalent
+ * direct write on the target type would:
+ *
+ * - nested `create` → the target's `create` permissives (default-deny)
+ *   and write restrictives (WITH CHECK) on the node input, as
+ *   `Model.create` does;
+ * - nested `update` → the target's `update` write restrictives on the
+ *   node input, as `Model.update` does. Its row filter (and
+ *   `onDeny: 'throw'`) is enforced in the compiled MATCH by the
+ *   mutation compiler.
+ *
+ * Pre-2.3.0 only the root type was checked, so a nested `create` / `update`
+ * wrote into protected types with none of their write policies applied.
+ *
+ * Runs BEFORE compile, so a rejected nested write never reaches the
+ * database. The walk mirrors the mutation compiler's input shapes:
+ * relationship → `{ create, update, … }` (single item or array), union
+ * targets keyed by member name, `create` items as `{ node, edge }` or a
+ * bare node, `update` as `{ node, edge }` or a bare node. Interface
+ * targets are skipped, as they are by the compiler (it emits no nested
+ * create / update for them).
+ */
+import { OGMError } from '../errors';
+import { isPlainObject } from '../utils/validation';
+import { PolicyDeniedError } from './errors';
+import { isWriteRestrictive, NO_ROOT_POLICY, } from './types';
+/** Guards against pathological (e.g. cyclic) input objects. */
+const MAX_NESTED_WRITE_DEPTH = 32;
+/**
+ * Evaluate `'create'` policies in JS for `inputs` of `typeName`.
+ *
+ * - Override → all input is allowed.
+ * - Permissive → at least one (whose `appliesWhen` matches) must exist;
+ *   create cannot fall back to default-deny silent-empty.
+ * - Restrictive → `when(ctx, input)` must return exactly `true` for every
+ *   input (v1.8.7 — explicit positive consent).
+ *
+ * A permissive's `when(ctx)` where-partial is a SHAPE hint only — it is
+ * not compiled against the input. Restrictive `when(ctx, input)` is the
+ * canonical "WITH CHECK" hook.
+ */
+export function evaluateCreatePolicies(bundle, typeName, inputs) {
+    if (!bundle || bundle.resolved.overridden)
+        return;
+    if (bundle.resolved.permissives.length === 0)
+        throw new PolicyDeniedError({
+            typeName,
+            operation: 'create',
+            reason: 'no-permissive-matched',
+            ...(bundle.defaults.onDeny === 'throw'
+                ? {}
+                : {
+                    detail: 'create operations cannot rely on default-deny silent-empty; at least one permissive must apply.',
+                }),
+        });
+    for (const input of inputs)
+        evaluateWriteRestrictives(bundle, typeName, 'create', input);
+}
+/**
+ * Evaluate WRITE-side restrictives (create/update) at the application
+ * layer. Each `WriteRestrictive` is invoked once with `(ctx, input)`;
+ * anything but an explicit `true` rejects with `PolicyDeniedError`.
+ * ReadRestrictives are not consumed here — they filter rows via the
+ * compiled WHERE clause.
+ */
+export function evaluateWriteRestrictives(bundle, typeName, operation, input) {
+    if (!bundle || bundle.resolved.overridden)
+        return;
+    for (const r of bundle.resolved.restrictives) {
+        if (!isWriteRestrictive(r))
+            continue;
+        // Compile-time gate: `appliesWhen` returning false drops the policy.
+        if (r.appliesWhen && !r.appliesWhen(bundle.ctx))
+            continue;
+        if (r.when(bundle.ctx, input ?? {}) !== true)
+            throw new PolicyDeniedError({
+                typeName,
+                operation,
+                reason: 'restrictive-rejected-input',
+                policyName: r.name,
+            });
+    }
+}
+/**
+ * Check every nested `create` / `update` inside create inputs of
+ * `nodeDef` (the root's own checks are the caller's).
+ */
+export function assertNestedCreatesAllowed(schema, nodeDef, inputs, bundle) {
+    if (!bundle)
+        return;
+    for (const input of inputs)
+        if (isPlainObject(input))
+            walkCreate(schema, nodeDef, input, bundle, 0);
+}
+/**
+ * Check every nested `create` / `update` inside an update input of
+ * `nodeDef` (the root's own checks are the caller's).
+ */
+export function assertNestedUpdatesAllowed(schema, nodeDef, update, bundle) {
+    if (!bundle || !isPlainObject(update))
+        return;
+    walkUpdate(schema, nodeDef, update, bundle, 0);
+}
+/** A create node spec: its relationship keys may carry nested creates. */
+function walkCreate(schema, nodeDef, nodeSpec, bundle, depth) {
+    assertDepth(depth);
+    for (const [key, value] of Object.entries(nodeSpec)) {
+        const relDef = nodeDef.relationships.get(key);
+        if (!relDef || !isPlainObject(value))
+            continue;
+        for (const [targetDef, relInput] of relationshipTargets(schema, relDef, value))
+            if (isPlainObject(relInput))
+                checkCreates(schema, targetDef, relInput.create, bundle, depth);
+    }
+}
+/** An update spec: its relationship keys carry nested operation items. */
+function walkUpdate(schema, nodeDef, update, bundle, depth) {
+    assertDepth(depth);
+    for (const [key, value] of Object.entries(update)) {
+        const relDef = nodeDef.relationships.get(key);
+        if (!relDef || value == null)
+            continue;
+        for (const [targetDef, items] of relationshipTargets(schema, relDef, value))
+            for (const item of asArray(items)) {
+                if (!isPlainObject(item))
+                    continue;
+                if (item.create)
+                    checkCreates(schema, targetDef, item.create, bundle, depth);
+                if (isPlainObject(item.update)) {
+                    // Same node-spec resolution as the compiler's nested update.
+                    const spec = item.update;
+                    const nodeUpdate = (spec.node ?? (spec.edge ? {} : spec));
+                    evaluateWriteRestrictives(targetBundle(bundle, targetDef.typeName, 'update'), targetDef.typeName, 'update', nodeUpdate);
+                    if (isPlainObject(nodeUpdate))
+                        walkUpdate(schema, targetDef, nodeUpdate, bundle, depth + 1);
+                }
+            }
+    }
+}
+function checkCreates(schema, targetDef, creates, bundle, depth) {
+    for (const item of asArray(creates)) {
+        if (!isPlainObject(item))
+            continue;
+        // Same node-spec resolution as the compiler's nested create.
+        const nodeSpec = (item.node ?? item);
+        evaluateCreatePolicies(targetBundle(bundle, targetDef.typeName, 'create'), targetDef.typeName, [nodeSpec]);
+        if (isPlainObject(nodeSpec))
+            walkCreate(schema, targetDef, nodeSpec, bundle, depth + 1);
+    }
+}
+/**
+ * Concrete targets of a relationship paired with their slice of the
+ * input: the whole value for a node target, one entry per member key
+ * for a union target, none for an interface target.
+ */
+function relationshipTargets(schema, relDef, value) {
+    const nodeDef = schema.nodes.get(relDef.target);
+    if (nodeDef)
+        return [[nodeDef, value]];
+    const members = schema.unions?.get(relDef.target);
+    if (!members || !isPlainObject(value))
+        return [];
+    const targets = [];
+    for (const [memberKey, memberValue] of Object.entries(value)) {
+        const memberDef = members.includes(memberKey)
+            ? schema.nodes.get(memberKey)
+            : undefined;
+        if (memberDef && memberValue != null)
+            targets.push([memberDef, memberValue]);
+    }
+    return targets;
+}
+/** The target type's bundle for `op`; a type without policies is open. */
+function targetBundle(bundle, typeName, op) {
+    return {
+        ...bundle,
+        operation: op,
+        resolved: bundle.resolveForType(typeName, op) ?? NO_ROOT_POLICY,
+    };
+}
+function asArray(value) {
+    if (value == null)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+function assertDepth(depth) {
+    if (depth > MAX_NESTED_WRITE_DEPTH)
+        throw new OGMError(`Nested write input exceeds the maximum depth of ${MAX_NESTED_WRITE_DEPTH}.`);
+}
+//# sourceMappingURL=nested-writes.js.map

package/dist/esm/policy/nested-writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nested-writes.js","sourceRoot":"","sources":["../../../src/policy/nested-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAMrC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,+DAA+D;AAC/D,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAkC,EAClC,QAAgB,EAChB,MAA8C;IAE9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU;QAAE,OAAO;IAElD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC1C,MAAM,IAAI,iBAAiB,CAAC;YAC1B,QAAQ;YACR,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,uBAAuB;YAC/B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,MAAM,EACJ,iGAAiG;iBACpG,CAAC;SACP,CAAC,CAAC;IAEL,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,yBAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAkC,EAClC,QAAgB,EAChB,SAAoB,EACpB,KAA0C;IAE1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU;QAAE,OAAO;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAAE,SAAS;QACrC,qEAAqE;QACrE,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI;YAC1C,MAAM,IAAI,iBAAiB,CAAC;gBAC1B,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,4BAA4B;gBACpC,UAAU,EAAE,CAAC,CAAC,IAAI;aACnB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAsB,EACtB,OAAuB,EACvB,MAA8C,EAC9C,MAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAsB,EACtB,OAAuB,EACvB,MAA2C,EAC3C,MAAkC;IAElC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO;IAC9C,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,0EAA0E;AAC1E,SAAS,UAAU,CACjB,MAAsB,EACtB,OAAuB,EACvB,QAAiC,EACjC,MAA2B,EAC3B,KAAa;IAEb,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/C,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,mBAAmB,CACrD,MAAM,EACN,MAAM,EACN,KAAK,CACN;YACC,IAAI,aAAa,CAAC,QAAQ,CAAC;gBACzB,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,UAAU,CACjB,MAAsB,EACtB,OAAuB,EACvB,MAA+B,EAC/B,MAA2B,EAC3B,KAAa;IAEb,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI;YAAE,SAAS;QACvC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;YACzE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnC,IAAI,IAAI,CAAC,MAAM;oBACb,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC9D,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,6DAA6D;oBAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;oBACzB,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAGvD,CAAC;oBACF,yBAAyB,CACvB,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAClD,SAAS,CAAC,QAAQ,EAClB,QAAQ,EACR,UAAU,CACX,CAAC;oBACF,IAAI,aAAa,CAAC,UAAU,CAAC;wBAC3B,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,MAAsB,EACtB,SAAyB,EACzB,OAAgB,EAChB,MAA2B,EAC3B,KAAa;IAEb,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAA4B,CAAC;QAChE,sBAAsB,CACpB,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAClD,SAAS,CAAC,QAAQ,EAClB,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,aAAa,CAAC,QAAQ,CAAC;YACzB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,MAAsB,EACtB,MAA8B,EAC9B,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,SAAS,IAAI,WAAW,IAAI,IAAI;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CACnB,MAA2B,EAC3B,QAAgB,EAChB,EAAa;IAEb,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,cAAc;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,GAAG,sBAAsB;QAChC,MAAM,IAAI,QAAQ,CAChB,mDAAmD,sBAAsB,GAAG,CAC7E,CAAC;AACN,CAAC"}

package/dist/esm/policy/resolver.d.ts

@@ -1,5 +1,5 @@
 import type { SchemaMetadata } from '../schema/types';
-import type { Operation, Policy, PolicyContext, ResolvedPolicies } from './types';
+import type { DetailedResolution, Operation, Policy, PolicyContext, ResolvedPolicies } from './types';
 /**
  * Build an immutable resolver from a registry. The registry is built by
  * the OGM constructor after schema validation.
@@ -24,12 +24,36 @@ export declare class PolicyResolver<C extends PolicyContext = PolicyContext> {
      * identical Cypher).
      */
     resolve(typeName: string, op: Operation, ctx: C): ResolvedPolicies<C> | null;
+    /**
+     * Resolve every operation-matching policy for `(typeName, op, ctx)`
+     * WITHOUT dropping any: `applied` records the `appliesWhen(ctx)` gate
+     * (or, for overrides, `when(ctx)`), and `skipped` marks policies never
+     * evaluated because an earlier override fired. This is the single place
+     * the resolver invokes `appliesWhen`; `resolve()` projects from it.
+     *
+     * Callback invocation order is unchanged from the pre-explain resolver:
+     * override `when` callbacks first (stopping at the first that fires),
+     * then `appliesWhen` in registration order — skipped entirely when an
+     * override fired.
+     *
+     * Returns `null` exactly when `resolve()` does.
+     */
+    resolveDetailed(typeName: string, op: Operation, ctx: C): DetailedResolution<C> | null;
     /**
      * Gather all sources of policy that apply to a given concrete type:
-     * the type's own list, plus any interfaces it implements.
+     * the type's own list, plus any interfaces it implements — each tagged
+     * with the registry key that declared it.
      */
     private gatherSources;
 }
+/**
+ * Project a detailed resolution onto the `ResolvedPolicies` shape the
+ * compilers consume. `PolicyResolver.resolve()` is exactly
+ * `projectResolution(resolveDetailed(...))`; the explain path calls it on
+ * the SAME detailed object it reports on, so the compiled fragments stay
+ * positionally aligned with the reported entries.
+ */
+export declare function projectResolution<C extends PolicyContext>(detailed: DetailedResolution<C>): ResolvedPolicies<C>;
 /**
  * Stable, value-free fingerprint of a context object. Used in audit
  * metadata so query logs can be correlated by ctx-shape WITHOUT leaking

package/dist/esm/policy/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACV,SAAS,EAGT,MAAM,EACN,aAAa,EACb,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB;;;;;;;GAOG;AACH,qBAAa,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAGtC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EACvD,MAAM,EAAE,cAAc;IAMxB,kFAAkF;IAClF,MAAM,IAAI,OAAO;IAIjB;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI;IA6C5E;;;OAGG;IACH,OAAO,CAAC,aAAa;CAgBtB;AAWD;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAK9D"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAEV,kBAAkB,EAClB,SAAS,EAGT,MAAM,EACN,aAAa,EACb,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB;;;;;;;GAOG;AACH,qBAAa,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAGtC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EACvD,MAAM,EAAE,cAAc;IAMxB,kFAAkF;IAClF,MAAM,IAAI,OAAO;IAIjB;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI;IAK5E;;;;;;;;;;;;;OAaG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,CAAC,GACL,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI;IA0D/B;;;;OAIG;IACH,OAAO,CAAC,aAAa;CAiBtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,aAAa,EACvD,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC9B,gBAAgB,CAAC,CAAC,CAAC,CAyCrB;AAWD;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAK9D"}

package/dist/esm/policy/resolver.js

@@ -26,67 +26,136 @@ export class PolicyResolver {
      * identical Cypher).
      */
     resolve(typeName, op, ctx) {
+        const detailed = this.resolveDetailed(typeName, op, ctx);
+        return detailed ? projectResolution(detailed) : null;
+    }
+    /**
+     * Resolve every operation-matching policy for `(typeName, op, ctx)`
+     * WITHOUT dropping any: `applied` records the `appliesWhen(ctx)` gate
+     * (or, for overrides, `when(ctx)`), and `skipped` marks policies never
+     * evaluated because an earlier override fired. This is the single place
+     * the resolver invokes `appliesWhen`; `resolve()` projects from it.
+     *
+     * Callback invocation order is unchanged from the pre-explain resolver:
+     * override `when` callbacks first (stopping at the first that fires),
+     * then `appliesWhen` in registration order — skipped entirely when an
+     * override fired.
+     *
+     * Returns `null` exactly when `resolve()` does.
+     */
+    resolveDetailed(typeName, op, ctx) {
         const sources = this.gatherSources(typeName);
         if (sources.length === 0)
             return null;
         const matching = [];
-        for (const list of sources)
-            for (const p of list)
-                if (operationMatches(p.operations, op))
-                    matching.push(p);
+        for (const { source, policies } of sources)
+            policies.forEach((policy, index) => {
+                if (operationMatches(policy.operations, op))
+                    matching.push({ policy, source, index });
+            });
         if (matching.length === 0)
             return null;
         // Override short-circuit. First matching override whose `when` returns
-        // true wins — emit nothing.
-        for (const p of matching)
-            if (p.kind === 'override' && p.when(ctx))
-                return {
-                    overridden: true,
-                    permissives: [],
-                    restrictives: [],
-                    evaluated: [p.name ?? 'override'],
-                };
-        const permissives = [];
-        const restrictives = [];
-        const evaluated = [];
-        for (const p of matching)
-            if (p.kind === 'permissive') {
-                // appliesWhen is compile-time. False → drop policy entirely.
-                if (p.appliesWhen && !p.appliesWhen(ctx))
-                    continue;
-                permissives.push(p);
-                evaluated.push(p.name ?? 'permissive');
+        // true wins — nothing after it is evaluated.
+        let firing = -1;
+        for (let i = 0; i < matching.length; i++) {
+            const p = matching[i].policy;
+            if (p.kind === 'override' && p.when(ctx)) {
+                firing = i;
+                break;
             }
-            else if (p.kind === 'restrictive') {
-                restrictives.push(p);
-                evaluated.push(p.name ?? 'restrictive');
+        }
+        const entries = matching.map(({ policy, source, index }, i) => {
+            const named = Boolean(policy.name);
+            const name = named
+                ? policy.name
+                : `${source}.${policy.kind}[${index}]`;
+            const base = { policy, kind: policy.kind, source, index, name, named };
+            if (firing >= 0) {
+                if (i === firing)
+                    return { ...base, applied: true, skipped: false };
+                // Overrides before the firing one WERE evaluated (to false).
+                if (policy.kind === 'override' && i < firing)
+                    return { ...base, applied: false, skipped: false };
+                return { ...base, applied: false, skipped: true };
             }
+            if (policy.kind === 'override')
+                return { ...base, applied: false, skipped: false };
+            const applied = !policy.appliesWhen || policy.appliesWhen(ctx);
+            return { ...base, applied, skipped: false };
+        });
         return {
-            overridden: false,
-            permissives,
-            restrictives,
-            evaluated,
+            overriddenBy: firing >= 0 ? entries[firing].name : null,
+            entries,
         };
     }
     /**
      * Gather all sources of policy that apply to a given concrete type:
-     * the type's own list, plus any interfaces it implements.
+     * the type's own list, plus any interfaces it implements — each tagged
+     * with the registry key that declared it.
      */
     gatherSources(typeName) {
         const out = [];
         const own = this.registry.get(typeName);
         if (own)
-            out.push(own);
+            out.push({ source: typeName, policies: own });
         const nodeDef = this.schema.nodes.get(typeName);
         if (nodeDef)
             for (const ifaceName of nodeDef.implementsInterfaces) {
                 const ifacePolicies = this.registry.get(ifaceName);
                 if (ifacePolicies)
-                    out.push(ifacePolicies);
+                    out.push({ source: ifaceName, policies: ifacePolicies });
             }
         return out;
     }
 }
+/**
+ * Project a detailed resolution onto the `ResolvedPolicies` shape the
+ * compilers consume. `PolicyResolver.resolve()` is exactly
+ * `projectResolution(resolveDetailed(...))`; the explain path calls it on
+ * the SAME detailed object it reports on, so the compiled fragments stay
+ * positionally aligned with the reported entries.
+ */
+export function projectResolution(detailed) {
+    if (detailed.overriddenBy !== null) {
+        const firing = detailed.entries.find((e) => e.policy.kind === 'override' && e.applied);
+        return {
+            overridden: true,
+            permissives: [],
+            restrictives: [],
+            evaluated: [firing.policy.name ?? 'override'],
+        };
+    }
+    const permissives = [];
+    const restrictives = [];
+    const evaluated = [];
+    for (const { policy: p, applied } of detailed.entries)
+        if (p.kind === 'permissive') {
+            // appliesWhen is compile-time. False → drop policy entirely.
+            if (!applied)
+                continue;
+            permissives.push(p);
+            evaluated.push(p.name ?? 'permissive');
+        }
+        else if (p.kind === 'restrictive') {
+            // Restrictives are kept even when `appliesWhen(ctx)` is false —
+            // the compiler / `evaluateWriteRestrictives` enforce the gate
+            // downstream. Dropping them here would change what
+            // `InterfaceModel.compileInterfacePolicyClause` sees: an
+            // implementer left with no permissives AND no restrictives is
+            // treated as unconstrained (`THEN true`) instead of default-deny.
+            restrictives.push(p);
+            // Audit metadata lists only policies that actually applied.
+            if (applied)
+                evaluated.push(p.name ?? 'restrictive');
+        }
+    return {
+        overridden: false,
+        permissives,
+        restrictives,
+        evaluated,
+    };
+}
 function operationMatches(operations, op) {
     for (const candidate of operations)
         if (candidate === '*' || candidate === op)

package/dist/esm/policy/resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAYpC;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAIzB,YACE,QAAuD,EACvD,MAAsB;QAEtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kFAAkF;IAClF,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAgB,EAAE,EAAa,EAAE,GAAM;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,QAAQ,GAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,OAAO;YACxB,KAAK,MAAM,CAAC,IAAI,IAAI;gBAClB,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,uEAAuE;QACvE,4BAA4B;QAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtC,OAAO;oBACL,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,EAAE;oBACf,YAAY,EAAE,EAAE;oBAChB,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC;iBAClC,CAAC;QAEN,MAAM,WAAW,GAA0B,EAAE,CAAC;QAC9C,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,CAAC,IAAI,QAAQ;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,6DAA6D;gBAC7D,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACnD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACpC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC;YAC1C,CAAC;QAEH,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,QAAgB;QAEhB,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,OAAO;YACT,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,IAAI,aAAa;oBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,UAA8C,EAC9C,EAAa;IAEb,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAA8B;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/policy/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAcpC;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAIzB,YACE,QAAuD,EACvD,MAAsB;QAEtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kFAAkF;IAClF,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAgB,EAAE,EAAa,EAAE,GAAM;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,CACb,QAAgB,EAChB,EAAa,EACb,GAAM;QAEN,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,QAAQ,GAIT,EAAE,CAAC;QACR,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO;YACxC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBACjC,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;oBACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QAEL,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAwB,QAAQ,CAAC,GAAG,CAC/C,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK;gBAChB,CAAC,CAAE,MAAM,CAAC,IAAe;gBACzB,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YACzC,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAEvE,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,KAAK,MAAM;oBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACpE,6DAA6D;gBAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,MAAM;oBAC1C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACrD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;gBAC5B,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAErD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9C,CAAC,CACF,CAAC;QAEF,OAAO;YACL,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACvD,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,aAAa,CACnB,QAAgB;QAEhB,MAAM,GAAG,GAA6D,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,OAAO;YACT,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,IAAI,aAAa;oBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7D,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA+B;IAE/B,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,CAChD,CAAC;QACH,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAA0B,EAAE,CAAC;IAC9C,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO;QACnD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5B,6DAA6D;YAC7D,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,gEAAgE;YAChE,8DAA8D;YAC9D,mDAAmD;YACnD,yDAAyD;YACzD,8DAA8D;YAC9D,kEAAkE;YAClE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,4DAA4D;YAC5D,IAAI,OAAO;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC;QACvD,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,WAAW;QACX,YAAY;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA8C,EAC9C,EAAa;IAEb,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAA8B;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/esm/policy/types.d.ts

@@ -167,6 +167,111 @@ export interface ResolvedPolicies<C extends PolicyContext = PolicyContext> {
     /** Names of policies that fired (for audit logging). */
     evaluated: ReadonlyArray<string>;
 }
+/**
+ * Resolution used for a ROOT type that has no policy for the operation,
+ * when a policy context is bound anyway (v2.3.0). Binding it — instead of
+ * dropping the whole bundle — keeps `resolveForType` reachable, so the
+ * policies of every TARGET type reached through relationships (nested
+ * selection, traversal filters, nested writes) stay enforced; a type
+ * without policies must not be a gateway around its neighbours'.
+ *
+ * `overridden: true` carries exactly its documented operational meaning
+ * here ("emit no root clause"): every root-level consumer treats it like
+ * the absence of a bundle, and no target-policy consumer reads it.
+ *
+ * Compare by identity (`resolved === NO_ROOT_POLICY`) to ask "did the
+ * root resolve anything for this operation?" — e.g. `aggregate`'s
+ * fallback to `read` policies. A real override resolution is a different
+ * object and must NOT be mistaken for it.
+ */
+export declare const NO_ROOT_POLICY: ResolvedPolicies;
+/**
+ * One operation-matching policy as seen by
+ * `PolicyResolver.resolveDetailed()`. Unlike `ResolvedPolicies`, nothing
+ * is dropped: policies gated off by `appliesWhen` and policies never
+ * evaluated because an override fired are reported too. Consumed by the
+ * explain path (`Model.explainPolicies`).
+ */
+export interface DetailedPolicy<C extends PolicyContext = PolicyContext> {
+    readonly policy: Policy<C>;
+    readonly kind: Policy<C>['kind'];
+    /** Type or interface whose registry entry declared this policy. */
+    readonly source: string;
+    /** Position in `source`'s registration list (all operations counted). */
+    readonly index: number;
+    /** `policy.name`, or `<source>.<kind>[<index>]` when unnamed. */
+    readonly name: string;
+    /** False when `name` is the synthesized fallback identifier. */
+    readonly named: boolean;
+    /**
+     * `appliesWhen(ctx)` held (absent counts as held). For an override:
+     * its `when(ctx)` returned true. Always false when `skipped`.
+     */
+    readonly applied: boolean;
+    /** Not evaluated at all because an earlier override fired. */
+    readonly skipped: boolean;
+}
+/**
+ * Outcome of one policy for one candidate node, as reported by
+ * `Model.explainPolicies()`:
+ *
+ * - `pass` — applied; its predicate evaluated to `true`.
+ * - `fail` — applied; evaluated to `false` (includes a restrictive hard
+ *   deny, `when: () => false`).
+ * - `null` — applied; evaluated to NULL (three-valued logic, e.g. a
+ *   missing property). Enforcement treats it as not-true.
+ * - `abstain` — applied, but emitted no predicate. A permissive abstain
+ *   grants nothing; a restrictive abstain restricts nothing.
+ * - `not-applied` — `appliesWhen(ctx)` was false (override: `when(ctx)`
+ *   was false). Not compiled or evaluated.
+ * - `skipped` — not evaluated because an earlier override fired.
+ */
+export type PolicyClauseOutcome = 'pass' | 'fail' | 'null' | 'abstain' | 'not-applied' | 'skipped';
+/** One policy's report within a `PolicyExplanation`. */
+export interface PolicyClauseExplanation {
+    /** `policy.name`, or `<source>.<kind>[<index>]` when unnamed. */
+    readonly name: string;
+    /** False when `name` is the synthesized fallback identifier. */
+    readonly named: boolean;
+    readonly kind: 'override' | 'permissive' | 'restrictive';
+    /** Type or interface whose registry entry declared the policy. */
+    readonly source: string;
+    /** `appliesWhen(ctx)` held (override: `when(ctx)` was true). */
+    readonly applied: boolean;
+    readonly outcome: PolicyClauseOutcome;
+}
+/**
+ * Per-candidate result of `Model.explainPolicies()`. `visible` is the
+ * exact verdict `find` enforces for the same bound context; the other
+ * fields explain it.
+ */
+export interface PolicyExplanation<T = Record<string, unknown>> {
+    /** The candidate, projected with the requested selection. */
+    readonly node: T;
+    /** Would `find` return this node for the bound context? */
+    readonly visible: boolean;
+    /** Name of the override that fired, else `null`. */
+    readonly overriddenBy: string | null;
+    /**
+     * Some permissive granted access (`true` when an override fired or the
+     * type has no policies). `false` → default deny.
+     */
+    readonly permissiveGranted: boolean;
+    /** Names of applied restrictives whose outcome is `fail` or `null`. */
+    readonly failedRestrictives: ReadonlyArray<string>;
+    /** Every `read` policy for the type, in registration order. */
+    readonly policies: ReadonlyArray<PolicyClauseExplanation>;
+}
+/**
+ * Full resolution for one (typeName, operation, ctx) triple. Entries are
+ * in registration order — the type's own policies first, then each
+ * implemented interface's.
+ */
+export interface DetailedResolution<C extends PolicyContext = PolicyContext> {
+    /** Fallback-aware name of the override that fired, else `null`. */
+    readonly overriddenBy: string | null;
+    readonly entries: ReadonlyArray<DetailedPolicy<C>>;
+}
 /**
  * Carries policy state through one compile pass. Created per query in
  * `Model` / `InterfaceModel` and threaded into `WhereCompiler` /

package/dist/esm/policy/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,GAAG,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACrE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CACpC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAClD,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACnD,wEAAwE;IACxE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,CAC3B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IACzD,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACtD,cAAc,CAAC,CAAC,CAAC,GACjB,gBAAgB,CAAC,CAAC,CAAC,GACnB,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CACzB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,aAAa,GAAG,aAAa,IACrC;KACD,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACnD,GAAG;IACF,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC1D,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA0CD,wBAAgB,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EAC9D,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GACpC,cAAc,CAAC,CAAC,CAAC,CAQnB;AAED,wBAAgB,UAAU,CACxB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAkBpE;AAwCD,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAE3D,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAC/C,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChC,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAsDhF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,aAAa,EACvD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAI/B;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EACxD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAIhC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACvE,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,YAAY,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,wDAAwD;IACxD,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC1E,GAAG,EAAE,CAAC,CAAC;IACP,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;OAKG;IACH,cAAc,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,SAAS,KACV,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,EAAE,cAAc,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,GAAG,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACrE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CACpC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAClD,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACnD,wEAAwE;IACxE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,CAC3B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IACzD,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACtD,cAAc,CAAC,CAAC,CAAC,GACjB,gBAAgB,CAAC,CAAC,CAAC,GACnB,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CACzB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,CAAC,SAAS,aAAa,GAAG,aAAa,IACrC;KACD,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACnD,GAAG;IACF,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC1D,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA0CD,wBAAgB,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EAC9D,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GACpC,cAAc,CAAC,CAAC,CAAC,CAQnB;AAED,wBAAgB,UAAU,CACxB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAkBpE;AAwCD,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAE3D,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAC/C,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChC,wBAAgB,WAAW,CACzB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAsDhF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,aAAa,EACvD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAI/B;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EACxD,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACtB,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAIhC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACvE,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,YAAY,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,wDAAwD;IACxD,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc,EAAE,gBAK3B,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,GACN,MAAM,GACN,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;IACzD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5D,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACzE,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC1E,GAAG,EAAE,CAAC,CAAC;IACP,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;OAKG;IACH,cAAc,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,SAAS,KACV,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,EAAE,cAAc,CAAC;CAC1B"}

package/dist/esm/policy/types.js

@@ -120,4 +120,27 @@ export function isWriteRestrictive(p) {
             return true;
     return false;
 }
+/**
+ * Resolution used for a ROOT type that has no policy for the operation,
+ * when a policy context is bound anyway (v2.3.0). Binding it — instead of
+ * dropping the whole bundle — keeps `resolveForType` reachable, so the
+ * policies of every TARGET type reached through relationships (nested
+ * selection, traversal filters, nested writes) stay enforced; a type
+ * without policies must not be a gateway around its neighbours'.
+ *
+ * `overridden: true` carries exactly its documented operational meaning
+ * here ("emit no root clause"): every root-level consumer treats it like
+ * the absence of a bundle, and no target-policy consumer reads it.
+ *
+ * Compare by identity (`resolved === NO_ROOT_POLICY`) to ask "did the
+ * root resolve anything for this operation?" — e.g. `aggregate`'s
+ * fallback to `read` policies. A real override resolution is a different
+ * object and must NOT be mistaken for it.
+ */
+export const NO_ROOT_POLICY = Object.freeze({
+    overridden: true,
+    permissives: Object.freeze([]),
+    restrictives: Object.freeze([]),
+    evaluated: Object.freeze([]),
+});
 //# sourceMappingURL=types.js.map

package/dist/esm/policy/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/policy/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAoLrC,8EAA8E;AAC9E,wEAAwE;AACxE,+DAA+D;AAC/D,8EAA8E;AAE9E,SAAS,MAAM,CAAmB,GAAM;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAA8C,EAC9C,IAAY;IAEZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACvD,MAAM,IAAI,QAAQ,CAChB,GAAG,IAAI,kDAAkD,CAC1D,CAAC;AACN,CAAC;AAED,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAS;IAC5D,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,OAAO;IACP,GAAG;CACJ,CAAC,CAAC;AAEH,SAAS,qBAAqB,CAC5B,UAA8C,EAC9C,IAAY;IAEZ,KAAK,MAAM,EAAE,IAAI,UAAU;QACzB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAChB,GAAG,IAAI,+BAA+B,EAAE,0DAA0D,CACnG,CAAC;AACR,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,IAAqC;IAErC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACnD,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;QACjC,MAAM,IAAI,QAAQ,CAChB,8EAA8E,CAC/E,CAAC;IACJ,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAGxB,IAA0C;IAC1C,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;QAC5B,MAAM,IAAI,QAAQ,CAChB,yEAAyE,CAC1E,CAAC;IACJ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU;YAC5C,MAAM,IAAI,QAAQ,CAChB,wDAAwD,CACzD,CAAC;QACJ,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1C,MAAM,IAAI,QAAQ,CAChB,sDAAsD,CACvD,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAS;IAC3D,MAAM;IACN,QAAQ;IACR,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAS;IAC5D,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,UAA8C;IAE9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,EAAE,IAAI,UAAU;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,WAAW,GAAG,IAAI,CAAC;aAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;aAC5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;IAErD,IAAI,WAAW;QACb,MAAM,IAAI,QAAQ,CAChB,oOAAoO,CACrO,CAAC;IACJ,IAAI,OAAO,IAAI,QAAQ;QACrB,MAAM,IAAI,QAAQ,CAChB,8SAA8S,CAC/S,CAAC;IACJ,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC;AAgBD,MAAM,UAAU,WAAW,CAKzB,IAE8C;IAE9C,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAEvD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAkD,CAAC;QACrE,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;YACtC,MAAM,IAAI,QAAQ,CAChB,6MAA6M,CAC9M,CAAC;QACJ,IAAI,QAAQ,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;YACzD,MAAM,IAAI,QAAQ,CAChB,+KAA+K,CAChL,CAAC;QACJ,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,YAAY;IACZ,MAAM,QAAQ,GAAG,IAAiD,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;QACpC,MAAM,IAAI,QAAQ,CAChB,0EAA0E,CAC3E,CAAC;IACJ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU;YAChD,MAAM,IAAI,QAAQ,CAChB,yDAAyD,CAC1D,CAAC;QACJ,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC9C,MAAM,IAAI,QAAQ,CAChB,uDAAuD,CACxD,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAC/B,CAAuB;IAEvB,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAY,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,CAAuB;IAEvB,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/policy/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAoLrC,8EAA8E;AAC9E,wEAAwE;AACxE,+DAA+D;AAC/D,8EAA8E;AAE9E,SAAS,MAAM,CAAmB,GAAM;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAA8C,EAC9C,IAAY;IAEZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACvD,MAAM,IAAI,QAAQ,CAChB,GAAG,IAAI,kDAAkD,CAC1D,CAAC;AACN,CAAC;AAED,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAS;IAC5D,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,OAAO;IACP,GAAG;CACJ,CAAC,CAAC;AAEH,SAAS,qBAAqB,CAC5B,UAA8C,EAC9C,IAAY;IAEZ,KAAK,MAAM,EAAE,IAAI,UAAU;QACzB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAChB,GAAG,IAAI,+BAA+B,EAAE,0DAA0D,CACnG,CAAC;AACR,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,IAAqC;IAErC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACnD,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;QACjC,MAAM,IAAI,QAAQ,CAChB,8EAA8E,CAC/E,CAAC;IACJ,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAGxB,IAA0C;IAC1C,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;QAC5B,MAAM,IAAI,QAAQ,CAChB,yEAAyE,CAC1E,CAAC;IACJ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU;YAC5C,MAAM,IAAI,QAAQ,CAChB,wDAAwD,CACzD,CAAC;QACJ,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1C,MAAM,IAAI,QAAQ,CAChB,sDAAsD,CACvD,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAS;IAC3D,MAAM;IACN,QAAQ;IACR,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAS;IAC5D,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,UAA8C;IAE9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,EAAE,IAAI,UAAU;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,WAAW,GAAG,IAAI,CAAC;aAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;aAC5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;IAErD,IAAI,WAAW;QACb,MAAM,IAAI,QAAQ,CAChB,oOAAoO,CACrO,CAAC;IACJ,IAAI,OAAO,IAAI,QAAQ;QACrB,MAAM,IAAI,QAAQ,CAChB,8SAA8S,CAC/S,CAAC;IACJ,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC;AAgBD,MAAM,UAAU,WAAW,CAKzB,IAE8C;IAE9C,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAEvD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAkD,CAAC;QACrE,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;YACtC,MAAM,IAAI,QAAQ,CAChB,6MAA6M,CAC9M,CAAC;QACJ,IAAI,QAAQ,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;YACzD,MAAM,IAAI,QAAQ,CAChB,+KAA+K,CAChL,CAAC;QACJ,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,YAAY;IACZ,MAAM,QAAQ,GAAG,IAAiD,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;QACpC,MAAM,IAAI,QAAQ,CAChB,0EAA0E,CAC3E,CAAC;IACJ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU;YAChD,MAAM,IAAI,QAAQ,CAChB,yDAAyD,CAC1D,CAAC;QACJ,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC9C,MAAM,IAAI,QAAQ,CAChB,uDAAuD,CACxD,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAC/B,CAAuB;IAEvB,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAY,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,CAAuB;IAEvB,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAqB,MAAM,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAC"}