@aduek/ne-sy 0.1.0-alpha.0

package/dist/policy.js

@@ -0,0 +1,362 @@
+import { createHash } from "node:crypto";
+import { DECISION_RANK, PolicyEvaluationError, errorCategoryForCode, isDecisionValue, } from "./types.js";
+import { analyzePolicyIr, hashPolicyIr, normalizePolicyPack as normalizePolicyPackIr, } from "./ir.js";
+import { compactRecord, compareStrings, getDotted, isPolicyPackInput, isRecord, makeDecision, stableValue, } from "./utils.js";
+import { validatePolicyPackSchema } from "./validation.js";
+export const POLICY_HASH_ALGORITHM = "sha256";
+export function analyzePolicies(policyInput) {
+    const findings = [];
+    const pack = normalizePolicyPackForAnalysis(policyInput, findings);
+    const policyIr = normalizePolicyPackIr(policyInput);
+    const policies = policyIr.policies;
+    if (policyInput !== undefined && isPolicyPackInput(policyInput)) {
+        if (policyIr.id === undefined || policyIr.id === null) {
+            findings.push({
+                severity: "error",
+                code: "missing_policy_pack_id",
+                message: "Policy pack must declare id.",
+                policyIds: [],
+                field: "id",
+            });
+        }
+        if (policyIr.version === undefined || policyIr.version === null) {
+            findings.push({
+                severity: "error",
+                code: "missing_policy_version",
+                message: "Policy pack must declare version.",
+                policyIds: [],
+                field: "version",
+            });
+        }
+        if (!pack.hasExplicitDefault) {
+            findings.push({
+                severity: "error",
+                code: "missing_default_decision",
+                message: "Policy pack must declare defaultDecision.",
+                policyIds: [],
+                field: "defaultDecision",
+            });
+        }
+        if (!isDecisionValue(policyIr.defaultDecision)) {
+            findings.push({
+                severity: "error",
+                code: "unsupported_default_decision",
+                message: `Policy pack has unsupported defaultDecision: ${String(policyIr.defaultDecision)}`,
+                policyIds: [],
+                field: "defaultDecision",
+            });
+        }
+    }
+    findings.push(...analyzePolicyIr(policyIr));
+    if (policies.length === 0) {
+        findings.push({
+            severity: "warning",
+            code: "empty_policy_pack",
+            message: "Policy pack contains no policies.",
+            policyIds: [],
+        });
+    }
+    const hasDefaultAllow = pack.hasExplicitDefault && pack.defaultDecision === "allow";
+    if (policies.length > 0 &&
+        !policies.some((policy) => policy.effect === "allow") &&
+        !hasDefaultAllow) {
+        findings.push({
+            severity: "warning",
+            code: "missing_explicit_allow",
+            message: "Policy pack has no explicit allow policy or allow default.",
+            policyIds: [],
+        });
+    }
+    const summary = {
+        policyPackId: pack.id,
+        policyVersion: pack.version,
+        defaultDecision: policyIr.defaultDecision,
+        hasExplicitDefault: pack.hasExplicitDefault,
+        policyCount: policies.length,
+        policyIrHash: hashPolicyIr(policyIr),
+        findingCount: findings.length,
+        errorCount: findings.filter((finding) => finding.severity === "error").length,
+        warningCount: findings.filter((finding) => finding.severity === "warning").length,
+        infoCount: findings.filter((finding) => finding.severity === "info").length,
+    };
+    const categorizedFindings = findings.map(categorizeFinding);
+    return {
+        summary,
+        findings: categorizedFindings,
+        hasErrors: summary.errorCount > 0,
+    };
+}
+export function validatePolicyPack(policyInput) {
+    const schemaErrors = validatePolicyPackSchema(policyInput);
+    const semanticErrors = analyzePolicies(policyInput).findings
+        .filter((finding) => finding.severity === "error")
+        .map((finding) => `${finding.code}: ${finding.message}`);
+    return [...schemaErrors, ...semanticErrors];
+}
+export function assertValidPolicyPack(policyInput) {
+    const errors = validatePolicyPack(policyInput);
+    if (errors.length > 0) {
+        const { category, code } = classifyValidationErrors(errors);
+        throw new PolicyEvaluationError(errors.join("; "), { category, code });
+    }
+}
+export function evaluatePolicies(agent, action, context, policyInput) {
+    if (policyInput === undefined) {
+        return makeDecision({
+            decision: "review",
+            reason: "No policies were configured for verification.",
+            matchedPolicyIds: [],
+            metadata: { enforcementSource: "no_policy", failClosed: true },
+        });
+    }
+    assertValidPolicyPack(policyInput);
+    const pack = normalizePolicyPack(policyInput);
+    const scope = { agent, action, context };
+    const matched = pack.policies.filter((policy) => matchesPolicy(policy, scope));
+    if (matched.length === 0) {
+        return defaultDecision(pack, policyInput);
+    }
+    const selected = matched.reduce((current, next) => {
+        return DECISION_RANK[next.effect] > DECISION_RANK[current.effect] ? next : current;
+    });
+    return makeDecision({
+        decision: selected.effect,
+        reason: selected.reason || selected.description || "Policy matched.",
+        matchedPolicyIds: matched.map((policy) => policy.id),
+        metadata: compactRecord({
+            enforcementSource: "matched_policy",
+            matchedPolicyCount: matched.length,
+            selectedPolicyId: selected.id,
+            policyPackId: pack.id,
+            policyVersion: pack.version,
+            policyHash: policyHash(policyInput),
+            ...(selected.metadata ?? {}),
+        }),
+    });
+}
+export function policyVersion(policyInput) {
+    if (policyInput && !Array.isArray(policyInput) && isPolicyPackInput(policyInput)) {
+        return policyInput.version;
+    }
+    return undefined;
+}
+export function policyPackId(policyInput) {
+    if (policyInput && !Array.isArray(policyInput) && isPolicyPackInput(policyInput)) {
+        return policyInput.id;
+    }
+    return undefined;
+}
+export function policyHash(policyInput) {
+    if (policyInput === undefined)
+        return undefined;
+    return hashPolicyPack(policyInput);
+}
+export function canonicalPolicyJson(policyInput) {
+    return JSON.stringify(stableValue(policyInput));
+}
+export function hashPolicyPack(policyInput) {
+    return createHash(POLICY_HASH_ALGORITHM)
+        .update(canonicalPolicyJson(policyInput), "utf8")
+        .digest("hex");
+}
+function defaultDecision(pack, policyInput) {
+    if (!isDecisionValue(pack.defaultDecision)) {
+        throw new PolicyEvaluationError(`Unknown default decision: ${pack.defaultDecision}`);
+    }
+    return makeDecision({
+        decision: pack.defaultDecision,
+        reason: pack.defaultReason,
+        matchedPolicyIds: [],
+        metadata: compactRecord({
+            enforcementSource: "policy_pack_default",
+            defaultDecision: pack.defaultDecision,
+            policyPackId: pack.id,
+            policyVersion: pack.version,
+            policyHash: policyHash(policyInput),
+        }),
+    });
+}
+function normalizePolicyPack(policyInput) {
+    if (policyInput === undefined) {
+        return {
+            defaultDecision: "review",
+            defaultReason: "No policies were configured for verification.",
+            hasExplicitDefault: true,
+            policies: [],
+            raw: undefined,
+        };
+    }
+    if (Array.isArray(policyInput)) {
+        return {
+            defaultDecision: "allow",
+            defaultReason: "No policy matched; action allowed by default.",
+            hasExplicitDefault: false,
+            policies: policyInput,
+            raw: policyInput,
+        };
+    }
+    if (isPolicyPackInput(policyInput)) {
+        const defaultDecisionValue = String(policyInput.defaultDecision ?? "allow");
+        return {
+            id: policyInput.id,
+            version: policyInput.version,
+            defaultDecision: defaultDecisionValue,
+            defaultReason: policyInput.defaultReason ??
+                `No policy matched; default decision \`${defaultDecisionValue}\` applied.`,
+            hasExplicitDefault: policyInput.defaultDecision !== undefined,
+            policies: Array.isArray(policyInput.policies) ? policyInput.policies : [],
+            raw: policyInput,
+        };
+    }
+    return {
+        defaultDecision: "allow",
+        defaultReason: "No policy matched; action allowed by default.",
+        hasExplicitDefault: false,
+        policies: [policyInput],
+        raw: policyInput,
+    };
+}
+function normalizePolicyPackForAnalysis(policyInput, findings) {
+    try {
+        return normalizePolicyPack(policyInput);
+    }
+    catch (error) {
+        findings.push({
+            severity: "error",
+            code: "malformed_policy_pack",
+            message: error instanceof Error ? error.message : String(error),
+            policyIds: [],
+        });
+        return {
+            defaultDecision: "allow",
+            defaultReason: "No policy matched; action allowed by default.",
+            hasExplicitDefault: false,
+            policies: [],
+            raw: undefined,
+        };
+    }
+}
+function categorizeFinding(finding) {
+    return {
+        ...finding,
+        errorCategory: finding.errorCategory ?? errorCategoryForCode(finding.code),
+    };
+}
+function classifyValidationErrors(errors) {
+    const codes = errors
+        .filter((error) => error.includes(":"))
+        .map((error) => error.split(":", 1)[0]);
+    if (errors.some((error) => error.startsWith("schema_validation_error"))) {
+        return { category: "validation_error", code: "policy_validation_error" };
+    }
+    for (const preferred of ["malformed_policy", "unsupported_policy_construct", "validation_error"]) {
+        for (const code of codes) {
+            const category = errorCategoryForCode(code);
+            if (category === preferred)
+                return { category, code };
+        }
+    }
+    return { category: "evaluation_error", code: "policy_evaluation_error" };
+}
+function matchesPolicy(policy, scope) {
+    if (!policy.conditions)
+        return true;
+    return evaluateCondition(policy.conditions, scope);
+}
+function evaluateCondition(condition, scope) {
+    if ("all" in condition) {
+        return condition.all.every((item) => evaluateCondition(item, scope));
+    }
+    if ("any" in condition) {
+        return condition.any.some((item) => evaluateCondition(item, scope));
+    }
+    const actual = getDotted(scope, condition.field);
+    switch (condition.operator) {
+        case "equals":
+            return actual === condition.value;
+        case "not_equals":
+            return actual !== condition.value;
+        case "greater_than":
+            return Number(actual) > Number(condition.value);
+        case "less_than":
+            return Number(actual) < Number(condition.value);
+        case "in":
+            return Array.isArray(condition.value) && condition.value.includes(actual);
+        default:
+            throw new PolicyEvaluationError(`Unsupported operator: ${String(condition.operator)}`, {
+                category: "unsupported_policy_construct",
+                code: "unsupported_operator",
+            });
+    }
+}
+function validateConditionTree(condition, policyId) {
+    const findings = [];
+    if (condition === undefined)
+        return findings;
+    if (!isRecord(condition)) {
+        return [{
+                severity: "error",
+                code: "malformed_conditions",
+                message: "Policy conditions must be an object.",
+                policyIds: [policyId],
+                field: "conditions",
+            }];
+    }
+    if ("all" in condition || "any" in condition) {
+        const key = "all" in condition ? "all" : "any";
+        const group = condition[key];
+        if (!Array.isArray(group)) {
+            return [{
+                    severity: "error",
+                    code: "malformed_condition_group",
+                    message: `Condition group \`${key}\` must be a list.`,
+                    policyIds: [policyId],
+                    field: `conditions.${key}`,
+                }];
+        }
+        for (const child of group) {
+            findings.push(...validateConditionTree(child, policyId));
+        }
+        return findings;
+    }
+    if (!condition.field) {
+        findings.push({
+            severity: "error",
+            code: "missing_condition_field",
+            message: "Condition is missing a field.",
+            policyIds: [policyId],
+            field: "conditions.field",
+        });
+    }
+    const operator = String(condition.operator ?? "equals");
+    if (!["equals", "not_equals", "greater_than", "less_than", "in"].includes(operator)) {
+        findings.push({
+            severity: "error",
+            code: "unsupported_operator",
+            message: `Condition uses unsupported operator: ${operator}`,
+            policyIds: [policyId],
+            field: "conditions.operator",
+        });
+    }
+    return findings;
+}
+function conditionSignature(condition) {
+    return JSON.stringify(signatureValue(condition));
+}
+function signatureValue(value) {
+    if (isRecord(value)) {
+        if (Array.isArray(value.all)) {
+            return { all: value.all.map(conditionSignature).sort() };
+        }
+        if (Array.isArray(value.any)) {
+            return { any: value.any.map(conditionSignature).sort() };
+        }
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => compareStrings(left, right))
+            .map(([key, entry]) => [key, signatureValue(entry)]));
+    }
+    if (Array.isArray(value)) {
+        return value.map(signatureValue);
+    }
+    return value;
+}

package/dist/types.d.ts

@@ -0,0 +1,112 @@
+export type DecisionValue = "allow" | "deny" | "review" | "log";
+export type ExecutionOutcome = "executed" | "blocked" | "pending_review" | "failed";
+export type FindingSeverity = "info" | "warning" | "error";
+export type ErrorCategory = "validation_error" | "malformed_policy" | "unsupported_policy_construct" | "evaluation_error" | "adapter_input_error" | "audit_write_error" | "simulation_unknown" | "solver_unknown";
+export declare const ERROR_CATEGORIES: readonly ErrorCategory[];
+export type PolicyOperator = "equals" | "not_equals" | "greater_than" | "less_than" | "in";
+export interface Decision {
+    decision: DecisionValue;
+    reason: string;
+    matchedPolicyIds: string[];
+    metadata: Record<string, unknown>;
+    allowed: boolean;
+}
+export interface VerifyActionInput {
+    agent: unknown;
+    action: unknown;
+    context?: unknown;
+    policies?: PolicyInput;
+    auditPath?: string;
+    failClosed?: boolean;
+}
+export interface VerificationResult {
+    decision: Decision;
+    auditEvent: AuditEvent;
+}
+export interface PolicyPack {
+    id?: string;
+    version?: string;
+    defaultDecision?: DecisionValue;
+    defaultReason?: string;
+    policies: Policy[];
+}
+export type PolicyInput = Policy | Policy[] | PolicyPack;
+export interface Policy {
+    id: string;
+    name?: string;
+    description?: string;
+    effect: DecisionValue;
+    conditions?: ConditionTree;
+    reason: string;
+    metadata?: Record<string, unknown>;
+}
+export type ConditionTree = {
+    all: ConditionTree[];
+} | {
+    any: ConditionTree[];
+} | Condition;
+export interface Condition {
+    field: string;
+    operator: PolicyOperator;
+    value: unknown;
+}
+export interface AuditEvent {
+    id: string;
+    action: unknown;
+    decision: Omit<Decision, "allowed">;
+    policyPackId?: string;
+    policyVersion?: string;
+    policyHash?: string;
+    actionHash?: string;
+    envelopeHash?: string;
+    evidenceHash?: string;
+    verifierVersion?: string;
+    runtime: {
+        agent: unknown;
+        context: unknown;
+        executionOutcome: ExecutionOutcome;
+    };
+    timestamp: string;
+}
+export interface PolicyFinding {
+    severity: FindingSeverity;
+    code: string;
+    message: string;
+    policyIds: string[];
+    field?: string;
+    errorCategory?: ErrorCategory;
+}
+export interface PolicyAnalysis {
+    summary: {
+        policyPackId?: string;
+        policyVersion?: string;
+        defaultDecision: string;
+        hasExplicitDefault: boolean;
+        policyCount: number;
+        policyIrHash?: string;
+        findingCount: number;
+        errorCount: number;
+        warningCount: number;
+        infoCount: number;
+    };
+    findings: PolicyFinding[];
+    hasErrors: boolean;
+}
+export declare const DECISION_RANK: Record<DecisionValue, number>;
+export declare class AduekError extends Error {
+    category: ErrorCategory;
+    code: string;
+    constructor(message: string, options?: {
+        category?: ErrorCategory;
+        code?: string;
+    });
+}
+export declare class PolicyEvaluationError extends AduekError {
+    constructor(message: string, options?: {
+        category?: ErrorCategory;
+        code?: string;
+    });
+}
+export declare function isDecisionValue(value: unknown): value is DecisionValue;
+export declare function errorCategoryForCode(code: string): ErrorCategory;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,QAAQ,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAC3D,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,kBAAkB,GAClB,8BAA8B,GAC9B,kBAAkB,GAClB,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,gBAAgB,CAAC;AAErB,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EASpD,CAAC;AACF,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,YAAY,GACZ,cAAc,GACd,WAAW,GACX,IAAI,CAAC;AAET,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,aAAa,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;AAEzD,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,GAAG,EAAE,aAAa,EAAE,CAAA;CAAE,GACxB;IAAE,GAAG,EAAE,aAAa,EAAE,CAAA;CAAE,GACxB,SAAS,CAAC;AAEd,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE;QACP,KAAK,EAAE,OAAO,CAAC;QACf,OAAO,EAAE,OAAO,CAAC;QACjB,gBAAgB,EAAE,gBAAgB,CAAC;KACpC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAKvD,CAAC;AAEF,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;gBAGX,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;CAO5D;AAED,qBAAa,qBAAsB,SAAQ,UAAU;gBAEjD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;CAQ5D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAyBhE"}

package/dist/types.js

@@ -0,0 +1,71 @@
+export const ERROR_CATEGORIES = [
+    "validation_error",
+    "malformed_policy",
+    "unsupported_policy_construct",
+    "evaluation_error",
+    "adapter_input_error",
+    "audit_write_error",
+    "simulation_unknown",
+    "solver_unknown",
+];
+export const DECISION_RANK = {
+    allow: 0,
+    log: 1,
+    review: 2,
+    deny: 3,
+};
+export class AduekError extends Error {
+    category;
+    code;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = "AduekError";
+        this.category = options.category ?? "evaluation_error";
+        this.code = options.code ?? "aduek_error";
+    }
+}
+export class PolicyEvaluationError extends AduekError {
+    constructor(message, options = {}) {
+        super(message, {
+            category: options.category ?? "evaluation_error",
+            code: options.code ?? "policy_evaluation_error",
+        });
+        this.name = "PolicyEvaluationError";
+    }
+}
+export function isDecisionValue(value) {
+    return value === "allow" || value === "deny" || value === "review" || value === "log";
+}
+export function errorCategoryForCode(code) {
+    if ([
+        "schema_validation_error",
+        "missing_policy_pack_id",
+        "missing_policy_version",
+        "missing_default_decision",
+        "missing_condition_field",
+    ].includes(code))
+        return "validation_error";
+    if ([
+        "malformed_policy",
+        "malformed_policy_pack",
+        "malformed_policy_ir",
+        "malformed_conditions",
+        "malformed_condition_group",
+    ].includes(code))
+        return "malformed_policy";
+    if ([
+        "unsupported_default_decision",
+        "unsupported_effect",
+        "unsupported_operator",
+    ].includes(code))
+        return "unsupported_policy_construct";
+    if (code.startsWith("adapter_"))
+        return "adapter_input_error";
+    if (code.startsWith("audit_"))
+        return "audit_write_error";
+    if (code.startsWith("simulation_"))
+        return "simulation_unknown";
+    if (code.startsWith("solver_"))
+        return "solver_unknown";
+    return "evaluation_error";
+}

package/dist/utils.d.ts

@@ -0,0 +1,13 @@
+import type { Decision, PolicyPack } from "./types.js";
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function isPolicyPackInput(value: unknown): value is PolicyPack;
+export declare function getDotted(value: unknown, path: string): unknown;
+export declare function makeDecision(input: Omit<Decision, "allowed">): Decision;
+export declare function stableValue(value: unknown): unknown;
+export declare function compareStrings(left: string, right: string): number;
+export declare function compactRecord(record: Record<string, unknown>): Record<string, unknown>;
+export declare function agentRef(agent: unknown): {
+    id: string;
+    kind: string;
+};
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEvD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAErE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAO/D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,QAAQ,CAKvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAYnD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIlE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAItF;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CASrE"}

package/dist/utils.js

@@ -0,0 +1,51 @@
+export function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+export function isPolicyPackInput(value) {
+    return isRecord(value) && "policies" in value;
+}
+export function getDotted(value, path) {
+    return path.split(".").reduce((current, part) => {
+        if (current && typeof current === "object" && part in current) {
+            return current[part];
+        }
+        return undefined;
+    }, value);
+}
+export function makeDecision(input) {
+    return {
+        ...input,
+        allowed: input.decision === "allow" || input.decision === "log",
+    };
+}
+export function stableValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(stableValue);
+    }
+    if (isRecord(value)) {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => compareStrings(left, right))
+            .map(([key, entry]) => [key, stableValue(entry)]));
+    }
+    return value;
+}
+export function compareStrings(left, right) {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}
+export function compactRecord(record) {
+    return Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined && value !== null));
+}
+export function agentRef(agent) {
+    if (agent && typeof agent === "object") {
+        const record = agent;
+        return {
+            id: String(record.id ?? "agent"),
+            kind: String(record.kind ?? "agent"),
+        };
+    }
+    return { id: "agent", kind: "agent" };
+}

package/dist/validation.d.ts

@@ -0,0 +1,14 @@
+export type JsonSchema = Record<string, unknown>;
+export declare const ACTION_SCHEMA: JsonSchema;
+export declare const DECISION_SCHEMA: JsonSchema;
+export declare const POLICY_SCHEMA: JsonSchema;
+export declare const AUDIT_EVENT_SCHEMA: JsonSchema;
+export declare const SDK_SCHEMAS: {
+    readonly "action.schema.json": JsonSchema;
+    readonly "audit-event.schema.json": JsonSchema;
+    readonly "decision.schema.json": JsonSchema;
+    readonly "policy.schema.json": JsonSchema;
+};
+export declare function validatePolicyPackSchema(policyInput: unknown): string[];
+export declare function validateAuditEventSchema(event: unknown): string[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,UA+C3B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UA2B7B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAkE3B,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,UA+ChC,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;CAKd,CAAC;AAeX,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE,CAIvE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAIjE"}