@aid-framework/ir 0.0.0 → 0.1.48

package/dist/gates/security.js

@@ -0,0 +1,225 @@
+/**
+ * Gate 5 — security. Fail-closed by default.
+ *
+ * The asymmetry is deliberate: a tool that writes or destroys and declares no `auth`
+ * is an error rather than a warning, because the safe reading of "no policy" is "no
+ * access", never "open access". Every rule this gate states is now live: the one it
+ * used to suppress is enforced below.
+ *
+ * The same asymmetry covers retrieval: a store reaches its backing service through
+ * `env:NAME`, so a connection string that appears literally in the IR is an error. No
+ * required gate touches a database -- the rule reads the declarations, never the store.
+ */
+import { sensitiveNames } from '../build.js';
+import { IR_DIAGNOSTIC_CODES } from '../diagnostics.js';
+import { reporter } from './contract.js';
+/** Builtins whose presence means the policy actually authenticates the caller. */
+const AUTHENTICATING_BUILTINS = ['isAuthenticated', 'hasRole', 'hasScope'];
+/** The one uri form a store may carry: a reference into the environment. */
+const ENV_REFERENCE = /^env:[A-Z][A-Z0-9_]{0,63}$/;
+/**
+ * A uri whose authority carries userinfo, i.e. a credential inlined before the host.
+ * The userinfo cannot span a `/`, so a path segment that contains `@` is not a match.
+ */
+const URI_USERINFO = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]*@/i;
+/**
+ * Empty, and empty on purpose. This was Phase 0's one suppressed rule:
+ *
+ *   check: 'security/input-output-guardrails'
+ *   reason: 'Phase 0 has no guardrail runtime, so whether a pipeline routes model
+ *            input and output through a guardrail cannot be enforced; §7.4 defers
+ *            the rule to the phase that ships one'
+ *
+ * It is no longer suppressed. Spec v0.2 makes `guardrails` declarable, so the question
+ * "does an endpoint that hands untrusted text to a model route it through an input
+ * guardrail?" can be answered from the declarations, and `checkInputGuardrails`
+ * answers it for every spec that can declare one. A 0.1 document predates the section
+ * and stays exempt — that is the version check, not a suppression entry, and the check
+ * says so in its own comment. What still has no runtime is *evaluating* the policy; that
+ * is the guardrails engine's layer, and a declared policy is the most this layer can
+ * honestly require.
+ */
+const SUPPRESSED = [];
+export function securityGate(ir, options) {
+    const diagnostics = [];
+    const report = reporter(options);
+    for (const tool of ir.tools) {
+        checkToolAuth(tool, diagnostics, report);
+    }
+    checkRedaction(ir, diagnostics, report);
+    checkStoreSecrets(ir, diagnostics, report);
+    checkInputGuardrails(ir, diagnostics, report);
+    const tools = new Map(ir.tools.map((tool) => [tool.id, tool]));
+    for (const pipeline of ir.pipelines) {
+        checkUnauthenticatedPath(pipeline, tools, diagnostics, report);
+    }
+    return { diagnostics, suppressed: SUPPRESSED };
+}
+function checkToolAuth(tool, diagnostics, report) {
+    const mutates = tool.sideEffects === 'write' || tool.sideEffects === 'destructive';
+    if (mutates && tool.auth === undefined) {
+        diagnostics.push(report.error({
+            code: IR_DIAGNOSTIC_CODES.securityMissingAuth,
+            message: `the security gate rejected this tool: "${tool.id}" has sideEffects "${tool.sideEffects}" but declares no auth, so it is callable by anyone`,
+            path: ['tools', tool.id, 'auth'],
+            hint: "declare a policy such as isAuthenticated() and hasScope('x')",
+        }));
+    }
+    if (tool.sideEffects === 'destructive' && !tool.requiresConfirmation) {
+        diagnostics.push(report.error({
+            code: IR_DIAGNOSTIC_CODES.securityMissingConfirmation,
+            message: `the security gate rejected this tool: "${tool.id}" is destructive but does not require confirmation`,
+            path: ['tools', tool.id, 'requiresConfirmation'],
+            hint: 'set requiresConfirmation: true',
+        }));
+    }
+}
+/**
+ * A trace config that is on must redact every field the IR marks as sensitive. An
+ * absent config is the builder's default (which redacts the whole sensitive set), so
+ * only a *declared* config can under-cover.
+ */
+function checkRedaction(ir, diagnostics, report) {
+    const sensitive = sensitiveNames(ir);
+    if (sensitive.length === 0)
+        return;
+    checkRedactSet(ir.observability, sensitive, ['observability', 'redact'], diagnostics, report);
+    for (const pipeline of ir.pipelines) {
+        checkRedactSet(pipeline.observability, sensitive, ['pipelines', pipeline.id, 'observability', 'redact'], diagnostics, report);
+    }
+}
+function checkRedactSet(observability, sensitive, path, diagnostics, report) {
+    if (!observability.trace)
+        return;
+    const missing = sensitive.filter((name) => !observability.redact.includes(name));
+    if (missing.length === 0)
+        return;
+    diagnostics.push(report.error({
+        code: IR_DIAGNOSTIC_CODES.securityRedactionIncomplete,
+        message: `the security gate rejected this trace config: it is on but does not redact ${missing.join(', ')}, which the spec marks as sensitive`,
+        path,
+        hint: `add ${missing.join(', ')} to redact, or turn tracing off`,
+    }));
+}
+/**
+ * A retrieval store is a connection to something outside the app, so the only form a
+ * store `uri` may take is a reference into the environment. A literal DSN in the IR is
+ * a credential in the IR: it is serialized into the golden files, printed by any tool
+ * that reads them, and committed. The check is repeated here rather than left to the
+ * spec schema because the IR is a published contract that a non-TypeScript producer can
+ * write directly.
+ *
+ * A retriever's `source.uri` is legitimately a literal -- a path, or a bucket URL for
+ * the reserved kinds -- so it is not restricted to `env:`. What it may not do is inline
+ * a credential into the authority, which is what the userinfo scan catches.
+ */
+function checkStoreSecrets(ir, diagnostics, report) {
+    for (const store of ir.stores) {
+        if (store.uri === undefined || ENV_REFERENCE.test(store.uri))
+            continue;
+        diagnostics.push(report.error({
+            code: IR_DIAGNOSTIC_CODES.securityStoreSecret,
+            message: `the security gate rejected this store: "${store.id}" declares uri "${store.uri}", a literal connection string; a store reaches its backing service through env:NAME, so the value stays out of the IR`,
+            path: ['stores', store.id, 'uri'],
+            hint: 'set uri to env:<NAME> and provide the value through the environment',
+        }));
+    }
+    for (const retriever of ir.retrievers) {
+        if (!URI_USERINFO.test(retriever.source.uri))
+            continue;
+        diagnostics.push(report.error({
+            code: IR_DIAGNOSTIC_CODES.securityStoreSecret,
+            message: `the security gate rejected this source: "${retriever.id}" declares a uri with an inline credential in its authority, which the IR would then carry everywhere it is written`,
+            path: ['retrievers', retriever.id, 'source', 'uri'],
+            hint: 'drop the credentials from the uri and supply them through the environment',
+        }));
+    }
+}
+/**
+ * A pipeline behind an HTTP trigger must not reach a write or destructive tool
+ * through a policy that does not authenticate. A tool with *no* auth at all is
+ * already an error wherever it is used, so this narrows to the case that rule cannot
+ * see: auth is declared, but it is not an authentication predicate.
+ */
+function checkUnauthenticatedPath(pipeline, tools, diagnostics, report) {
+    const trigger = pipeline.trigger;
+    if (trigger.kind !== 'http')
+        return;
+    pipeline.steps.forEach((step, index) => {
+        if (step.kind !== 'tool')
+            return;
+        const tool = tools.get(step.tool);
+        if (tool === undefined)
+            return;
+        if (tool.sideEffects !== 'write' && tool.sideEffects !== 'destructive')
+            return;
+        if (tool.auth === undefined || policyAuthenticates(tool.auth))
+            return;
+        diagnostics.push(report.error({
+            code: IR_DIAGNOSTIC_CODES.securityUnauthenticatedPath,
+            message: `the security gate rejected this endpoint: the ${trigger.method.toUpperCase()} ${trigger.path} trigger reaches "${tool.id}", which ${tool.sideEffects === 'write' ? 'writes' : 'destroys'} and whose declared policy does not authenticate the caller`,
+            path: ['pipelines', pipeline.id, 'steps', index, 'tool'],
+            hint: `give "${tool.id}" a policy built from ${AUTHENTICATING_BUILTINS.join(', ')}`,
+        }));
+    });
+}
+/**
+ * §7.4, now live: an HTTP endpoint hands untrusted text straight to a model, so the IR
+ * has to show a guardrail that inspects it first. "Untrusted" is the HTTP trigger and
+ * only that trigger — a scheduled job and a manual run carry no caller-supplied text,
+ * and demanding a guardrail for them would be a declaration with nothing to inspect.
+ *
+ * The discriminator is the declared spec version, not the number of declared guardrails.
+ * A spec written against v0.1 predates the section and cannot opt into it, and
+ * retroactively failing every such project is a breaking change rather than a safety
+ * improvement. A spec written against v0.2 *can* declare guardrails, so declaring none
+ * is a decision rather than an inability, and it is not a reason to stay silent: an
+ * endpoint that hands caller text to a model with no input-stage guardrail fails the
+ * gate either way. Keying this on the declaration count instead would let a v0.2 spec
+ * buy an exemption by simply omitting the section.
+ *
+ * What this layer still does not do is *evaluate* the policy; that is the guardrails
+ * engine's layer (L3). A declared policy is the most this layer can honestly require,
+ * and making the declaration itself unconditional is the engine layer's call.
+ */
+function checkInputGuardrails(ir, diagnostics, report) {
+    if (ir.specVersion === '0.1')
+        return;
+    if (!ir.guardrails.some((guardrail) => guardrail.stages.includes('input'))) {
+        for (const pipeline of ir.pipelines) {
+            const trigger = pipeline.trigger;
+            if (trigger.kind !== 'http')
+                continue;
+            const generate = pipeline.steps.find((step) => step.kind === 'generate');
+            if (generate === undefined)
+                continue;
+            diagnostics.push(report.error({
+                code: IR_DIAGNOSTIC_CODES.securityInputGuardrail,
+                message: `the security gate rejected this endpoint: the ${trigger.method.toUpperCase()} ${trigger.path} trigger passes caller-supplied text to prompt "${generate.prompt}", but the specification declares no guardrail with an "input" stage`,
+                path: ['pipelines', pipeline.id, 'steps', pipeline.steps.indexOf(generate)],
+                hint: 'declare a guardrail with stages: [input]',
+            }));
+        }
+    }
+}
+/**
+ * True when the policy mentions a builtin that establishes caller identity. `not` is
+ * deliberately not transparent: `not isAuthenticated()` denies what it names, so
+ * treating it as authenticating would be the fail-open reading.
+ */ export function policyAuthenticates(node) {
+    switch (node.kind) {
+        case 'call':
+            return (AUTHENTICATING_BUILTINS.includes(node.name) ||
+                node.args.some(policyAuthenticates));
+        case 'comparison':
+            return policyAuthenticates(node.left) || policyAuthenticates(node.right);
+        case 'and':
+        case 'or':
+            return policyAuthenticates(node.left) || policyAuthenticates(node.right);
+        case 'not':
+            return false;
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/gates/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/gates/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAqC,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAElG,kFAAkF;AAClF,MAAM,uBAAuB,GAAG,CAAC,iBAAiB,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAEpF,4EAA4E;AAC5E,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAEnD;;;GAGG;AACH,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,GAAsB,EAAE,CAAC;AAEzC,MAAM,UAAU,YAAY,CAAC,EAAM,EAAE,OAAoB;IACvD,MAAM,WAAW,GAAmB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC3C,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACpC,wBAAwB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAID,SAAS,aAAa,CAAC,IAAe,EAAE,WAA2B,EAAE,MAAgB;IACnF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa,CAAC;IAEnF,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,mBAAmB;YAC7C,OAAO,EAAE,0CAA0C,IAAI,CAAC,EAAE,sBAAsB,IAAI,CAAC,WAAW,qDAAqD;YACrJ,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC;YAChC,IAAI,EAAE,8DAA8D;SACrE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACrE,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,2BAA2B;YACrD,OAAO,EAAE,0CAA0C,IAAI,CAAC,EAAE,oDAAoD;YAC9G,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;YAChD,IAAI,EAAE,gCAAgC;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,EAAM,EAAE,WAA2B,EAAE,MAAgB;IAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,cAAc,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAE9F,KAAK,MAAM,QAAQ,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACpC,cAAc,CACZ,QAAQ,CAAC,aAAa,EACtB,SAAS,EACT,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EACrD,WAAW,EACX,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,aAAiC,EACjC,SAA4B,EAC5B,IAAyB,EACzB,WAA2B,EAC3B,MAAgB;IAEhB,IAAI,CAAC,aAAa,CAAC,KAAK;QAAE,OAAO;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;QACX,IAAI,EAAE,mBAAmB,CAAC,2BAA2B;QACrD,OAAO,EAAE,8EAA8E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;QAC9I,IAAI;QACJ,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;KACjE,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,EAAM,EAAE,WAA2B,EAAE,MAAgB;IAC9E,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QACvE,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,mBAAmB;YAC7C,OAAO,EAAE,2CAA2C,KAAK,CAAC,EAAE,mBAAmB,KAAK,CAAC,GAAG,wHAAwH;YAChN,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;YACjC,IAAI,EAAE,qEAAqE;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,mBAAmB;YAC7C,OAAO,EAAE,4CAA4C,SAAS,CAAC,EAAE,qHAAqH;YACtL,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC;YACnD,IAAI,EAAE,2EAA2E;SAClF,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,QAAuB,EACvB,KAA6B,EAC7B,WAA2B,EAC3B,MAAgB;IAEhB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IAEpC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QAC/B,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa;YAAE,OAAO;QAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QAEtE,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,2BAA2B;YACrD,OAAO,EAAE,iDAAiD,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,IAAI,qBAAqB,IAAI,CAAC,EAAE,YAAY,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,6DAA6D;YAC/P,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;YACxD,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,yBAAyB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACpF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,oBAAoB,CAAC,EAAM,EAAE,WAA2B,EAAE,MAAgB;IACjF,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK;QAAE,OAAO;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,QAAQ,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;YACzE,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;gBACX,IAAI,EAAE,mBAAmB,CAAC,sBAAsB;gBAChD,OAAO,EAAE,iDAAiD,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,IAAI,mDAAmD,QAAQ,CAAC,MAAM,sEAAsE;gBAC9O,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC3E,IAAI,EAAE,0CAA0C;aACjD,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG,CAAC,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IACtD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,CACJ,uBAA6C,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACpC,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,KAAK,KAAK,CAAC;QACX,KAAK,IAAI;YACP,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `@aid-framework/ir` — the packed intermediate representation, its builder, its build-time
+ * gates, the canonical serializer, and the PolicyExpr front end.
+ *
+ * The public entry point layer 3 (`generator-sdk`) consumes: `buildIR` turns a
+ * parsed spec value into an `IR`, `runGates` decides whether that IR is buildable
+ * for a set of target capability declarations, and `serializeIR` renders it as
+ * canonical JSON whose bytes are a function of identity alone.
+ */
+export type { BuildContext, BuildOptions, BuildResult } from './build.js';
+export { asArray, asBoolean, asNumber, asRecord, asString, asStringArray, buildEvalTarget, buildIR, buildTypeRef, DEFAULT_EVAL_MAX_REGRESSION, DEFAULT_EVAL_SAMPLES, DEFAULT_IDEMPOTENCY, DEFAULT_TARGET, DEFAULT_TOOL_RETRIES, DEFAULT_TOOL_TIMEOUT_MS, isBindingName, isSensitiveName, sensitiveNames, sortedKeys, templatePlaceholders, } from './build.js';
+export type { DeferredCapability, ModelCapability, RequiredCapability } from './capabilities.js';
+export { CAPABILITY_DERIVATIONS, DEFERRED_CAPABILITIES, deriveRequiredCapabilities, isModelCapability, isRequiredCapability, MODEL_CAPABILITIES, REQUIRED_CAPABILITIES, resolveRequiredCapability, SPEC_MODEL_CAPABILITY_MAP, TARGET_CAPABILITY_ALIASES, } from './capabilities.js';
+export type { CatalogModel, TargetCapabilityDeclarations } from './catalog/index.js';
+export { CATALOG_VERSION, catalogCostProfile, catalogCostProfiles, catalogModel, PHASE_0_TARGET_CAPABILITIES, phase0TargetCapabilities, } from './catalog/index.js';
+export type { IrDiagnostic, IrDiagnosticCode } from './diagnostics.js';
+export { IR_DIAGNOSTIC_CODES, irError, irWarning, offsetPosition, withPosition, } from './diagnostics.js';
+export type { EvalCostEstimate, Gate, GateId, GateName, GateOptions, GateReporter, GateResult, GateRunResult, ModelCostEstimate, SuppressedCheck, } from './gates/index.js';
+export { capabilityGate, costGate, diffPaths, estimateEvalCost, evalCoverageGate, GATES, isNormalized, normalize, normalizeGate, policyAuthenticates, referentialGate, reporter, runGates, securityGate, } from './gates/index.js';
+export type { ComparisonOperator, LexResult, PolicyBuiltin, PolicyCall, PolicyComparison, PolicyContext, PolicyExpr, PolicyLogical, PolicyNode, PolicyNot, PolicyOperand, PolicyParseResult, PolicyToken, PolicyTokenType, } from './policy/index.js';
+export { COMPARISON_OPERATORS, formatPolicyExpr, isPolicyBuiltin, POLICY_BUILTIN_ARITY, POLICY_BUILTINS, parsePolicyExpr, tokenize, tokenText, } from './policy/index.js';
+export type { OrderingOperator, PredicateBuiltin, PredicateCall, PredicateCaseId, PredicateComparison, PredicateContext, PredicateExpr, PredicateInvalid, PredicateLexResult, PredicateLogical, PredicateMetadata, PredicateNode, PredicateNot, PredicateOperator, PredicateParseResult, PredicatePath, PredicatePathRoot, PredicatePrediction, PredicateToken, PredicateTokenType, } from './predicate/index.js';
+export { formatPredicateExpr, isOrderingOperator, isPredicateBuiltin, ORDERING_OPERATORS, PREDICATE_BUILTIN_ARITY, PREDICATE_BUILTINS, PREDICATE_OPERATORS, PREDICATE_PATHS, parsePredicateExpr, predicateIsBoolean, tokenizePredicate, } from './predicate/index.js';
+export { CANONICAL_INDENT, canonicalJson, serializeIR } from './serialize.js';
+export type { AgentEngine, AgentOnBudgetExhausted, AgentShape, AgentStep, BranchStep, CompositeStep, CostProfile, DeploymentShape, EmbeddingShape, EmitStep, ErrorPolicy, EvalDataset, EvalGate, EvalShape, EvalTarget, EvalTargetKind, GenerateStep, GuardrailShape, GuardStep, Idempotency, IR, IrCollection, MapStep, MemoryShape, MetricShape, ModelLimits, ModelParams, ModelShape, ObservabilityShape, ParallelStep, PipelineShape, PipelineTrigger, PrimitiveType, ProjectShape, PromptOutput, PromptShape, PromptVariable, Provider, ReduceStep, RerankStep, RetrieverShape, RetrieveStep, RuntimeShape, SideEffects, StepInput, StepInputValue, StepShape, ToolHandler, ToolShape, ToolStep, Trait, TypeField, TypeRef, TypeShape, VectorStoreShape, } from './shapes.js';
+export { AGENT_ENGINES, AGENT_ON_BUDGET_EXHAUSTED, COMPOSITE_STEP_KINDS, DEFAULT_MAX_CONTEXT_TOKENS, DEFAULT_OBSERVABILITY, DEFAULT_RUNTIME, EVAL_TARGET_KINDS, IR_COLLECTIONS, IR_ONLY_COLLECTIONS, IR_VERSION, isCompositeStep, isProvider, MAX_STEP_DEPTH, modelIdentity, NON_COLLECTION_SECTIONS, PHASE_0_PROVIDERS, POPULATED_COLLECTION_BY_SECTION, PRIMITIVE_TYPES, PROVIDERS, pipelineIdentity, promptIdentity, toolIdentity, } from './shapes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EACL,OAAO,EACP,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,eAAe,EACf,OAAO,EACP,YAAY,EACZ,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,eAAe,EACf,cAAc,EACd,UAAU,EACV,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,OAAO,EACP,SAAS,EACT,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,aAAa,EACb,UAAU,EACV,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,QAAQ,EACR,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,YAAY,EACV,WAAW,EACX,sBAAsB,EACtB,UAAU,EACV,SAAS,EACT,UAAU,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,QAAQ,EACR,WAAW,EACX,WAAW,EACX,QAAQ,EACR,SAAS,EACT,UAAU,EACV,cAAc,EACd,YAAY,EACZ,cAAc,EACd,SAAS,EACT,WAAW,EACX,EAAE,EACF,YAAY,EACZ,OAAO,EACP,WAAW,EACX,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACd,QAAQ,EACR,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,cAAc,EACd,SAAS,EACT,WAAW,EACX,SAAS,EACT,QAAQ,EACR,KAAK,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,UAAU,EACV,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * `@aid-framework/ir` — the packed intermediate representation, its builder, its build-time
+ * gates, the canonical serializer, and the PolicyExpr front end.
+ *
+ * The public entry point layer 3 (`generator-sdk`) consumes: `buildIR` turns a
+ * parsed spec value into an `IR`, `runGates` decides whether that IR is buildable
+ * for a set of target capability declarations, and `serializeIR` renders it as
+ * canonical JSON whose bytes are a function of identity alone.
+ */
+export { asArray, asBoolean, asNumber, asRecord, asString, asStringArray, buildEvalTarget, buildIR, buildTypeRef, DEFAULT_EVAL_MAX_REGRESSION, DEFAULT_EVAL_SAMPLES, DEFAULT_IDEMPOTENCY, DEFAULT_TARGET, DEFAULT_TOOL_RETRIES, DEFAULT_TOOL_TIMEOUT_MS, isBindingName, isSensitiveName, sensitiveNames, sortedKeys, templatePlaceholders, } from './build.js';
+export { CAPABILITY_DERIVATIONS, DEFERRED_CAPABILITIES, deriveRequiredCapabilities, isModelCapability, isRequiredCapability, MODEL_CAPABILITIES, REQUIRED_CAPABILITIES, resolveRequiredCapability, SPEC_MODEL_CAPABILITY_MAP, TARGET_CAPABILITY_ALIASES, } from './capabilities.js';
+export { CATALOG_VERSION, catalogCostProfile, catalogCostProfiles, catalogModel, PHASE_0_TARGET_CAPABILITIES, phase0TargetCapabilities, } from './catalog/index.js';
+export { IR_DIAGNOSTIC_CODES, irError, irWarning, offsetPosition, withPosition, } from './diagnostics.js';
+export { capabilityGate, costGate, diffPaths, estimateEvalCost, evalCoverageGate, GATES, isNormalized, normalize, normalizeGate, policyAuthenticates, referentialGate, reporter, runGates, securityGate, } from './gates/index.js';
+export { COMPARISON_OPERATORS, formatPolicyExpr, isPolicyBuiltin, POLICY_BUILTIN_ARITY, POLICY_BUILTINS, parsePolicyExpr, tokenize, tokenText, } from './policy/index.js';
+export { formatPredicateExpr, isOrderingOperator, isPredicateBuiltin, ORDERING_OPERATORS, PREDICATE_BUILTIN_ARITY, PREDICATE_BUILTINS, PREDICATE_OPERATORS, PREDICATE_PATHS, parsePredicateExpr, predicateIsBoolean, tokenizePredicate, } from './predicate/index.js';
+export { CANONICAL_INDENT, canonicalJson, serializeIR } from './serialize.js';
+export { AGENT_ENGINES, AGENT_ON_BUDGET_EXHAUSTED, COMPOSITE_STEP_KINDS, DEFAULT_MAX_CONTEXT_TOKENS, DEFAULT_OBSERVABILITY, DEFAULT_RUNTIME, EVAL_TARGET_KINDS, IR_COLLECTIONS, IR_ONLY_COLLECTIONS, IR_VERSION, isCompositeStep, isProvider, MAX_STEP_DEPTH, modelIdentity, NON_COLLECTION_SECTIONS, PHASE_0_PROVIDERS, POPULATED_COLLECTION_BY_SECTION, PRIMITIVE_TYPES, PROVIDERS, pipelineIdentity, promptIdentity, toolIdentity, } from './shapes.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,OAAO,EACP,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,eAAe,EACf,OAAO,EACP,YAAY,EACZ,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,eAAe,EACf,cAAc,EACd,UAAU,EACV,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,OAAO,EACP,SAAS,EACT,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAC;AAa1B,OAAO,EACL,cAAc,EACd,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,QAAQ,EACR,SAAS,GACV,MAAM,mBAAmB,CAAC;AAuB3B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA0D9E,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,UAAU,EACV,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC"}

package/dist/policy/ast.d.ts

@@ -0,0 +1,61 @@
+/**
+ * PolicyExpr AST. Phase 0 supports exactly this grammar and anything else is a
+ * validation error, never a silent pass. The AST is plain JSON so it can be
+ * embedded in the IR and interpreted by any target without a second parser.
+ *
+ *   expression  := or
+ *   or          := and ('or' and)*
+ *   and         := comparison ('and' comparison)*
+ *   comparison  := unary (('==' | '!=' | '<' | '<=' | '>' | '>=') unary)?
+ *   unary       := 'not' unary | primary
+ *   primary     := 'true' | 'false' | string | number | call | '(' expression ')'
+ *   call        := builtin '(' (operand (',' operand)*)? ')'
+ *   operand     := primary
+ *
+ * Precedence, tightest first: `not`, comparison, `and`, `or`.
+ */
+export declare const POLICY_BUILTINS: readonly ['hasRole', 'hasScope', 'isAuthenticated'];
+export type PolicyBuiltin = (typeof POLICY_BUILTINS)[number];
+export declare const COMPARISON_OPERATORS: readonly ['==', '!=', '<=', '>=', '<', '>'];
+export type ComparisonOperator = (typeof COMPARISON_OPERATORS)[number];
+/** A state predicate call. Arguments are nodes; only the builtins above are accepted. */
+export interface PolicyCall {
+    kind: 'call';
+    name: PolicyBuiltin;
+    args: PolicyNode[];
+}
+export interface PolicyComparison {
+    kind: 'comparison';
+    op: ComparisonOperator;
+    left: PolicyNode;
+    right: PolicyNode;
+}
+export interface PolicyLogical {
+    kind: 'and' | 'or';
+    left: PolicyNode;
+    right: PolicyNode;
+}
+export interface PolicyNot {
+    kind: 'not';
+    operand: PolicyNode;
+}
+export type PolicyNode = PolicyCall | PolicyComparison | PolicyLogical | PolicyNot | {
+    kind: 'string';
+    value: string;
+} | {
+    kind: 'number';
+    value: number;
+} | {
+    kind: 'boolean';
+    value: boolean;
+};
+/** An argument position: any node, including a nested call. */
+export type PolicyOperand = PolicyNode;
+/** A parsed policy expression; always a node, never the source string. */
+export type PolicyExpr = PolicyNode;
+/** Arity of each builtin; the parser rejects any other argument count. */
+export declare const POLICY_BUILTIN_ARITY: Record<PolicyBuiltin, number>;
+export declare function isPolicyBuiltin(name: string): name is PolicyBuiltin;
+/** Renders an AST back to a normalized source form, for diagnostic messages. */
+export declare function formatPolicyExpr(node: PolicyNode): string;
+//# sourceMappingURL=ast.d.ts.map

package/dist/policy/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../src/policy/ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,eAAe,YAAI,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAU,CAAC;AAEnF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,oBAAoB,YAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AAEhF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,yFAAyF;AACzF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,kBAAkB,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,SAAS,GACT;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAExC,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC;AAEvC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC;AAEpC,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAI9D,CAAC;AAEF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAkBzD"}

package/dist/policy/ast.js

@@ -0,0 +1,48 @@
+/**
+ * PolicyExpr AST. Phase 0 supports exactly this grammar and anything else is a
+ * validation error, never a silent pass. The AST is plain JSON so it can be
+ * embedded in the IR and interpreted by any target without a second parser.
+ *
+ *   expression  := or
+ *   or          := and ('or' and)*
+ *   and         := comparison ('and' comparison)*
+ *   comparison  := unary (('==' | '!=' | '<' | '<=' | '>' | '>=') unary)?
+ *   unary       := 'not' unary | primary
+ *   primary     := 'true' | 'false' | string | number | call | '(' expression ')'
+ *   call        := builtin '(' (operand (',' operand)*)? ')'
+ *   operand     := primary
+ *
+ * Precedence, tightest first: `not`, comparison, `and`, `or`.
+ */
+export const POLICY_BUILTINS = ['hasRole', 'hasScope', 'isAuthenticated'];
+export const COMPARISON_OPERATORS = ['==', '!=', '<=', '>=', '<', '>'];
+/** Arity of each builtin; the parser rejects any other argument count. */
+export const POLICY_BUILTIN_ARITY = {
+    hasRole: 1,
+    hasScope: 1,
+    isAuthenticated: 0,
+};
+export function isPolicyBuiltin(name) {
+    return POLICY_BUILTINS.includes(name);
+}
+/** Renders an AST back to a normalized source form, for diagnostic messages. */
+export function formatPolicyExpr(node) {
+    switch (node.kind) {
+        case 'string':
+            return JSON.stringify(node.value);
+        case 'number':
+            return String(node.value);
+        case 'boolean':
+            return node.value ? 'true' : 'false';
+        case 'call':
+            return `${node.name}(${node.args.map(formatPolicyExpr).join(', ')})`;
+        case 'comparison':
+            return `${formatPolicyExpr(node.left)} ${node.op} ${formatPolicyExpr(node.right)}`;
+        case 'and':
+        case 'or':
+            return `(${formatPolicyExpr(node.left)} ${node.kind} ${formatPolicyExpr(node.right)})`;
+        case 'not':
+            return `not ${formatPolicyExpr(node.operand)}`;
+    }
+}
+//# sourceMappingURL=ast.js.map

package/dist/policy/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../src/policy/ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAU,CAAC;AAInF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AA4ChF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAkC;IACjE,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,eAAe,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACvC,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACvE,KAAK,YAAY;YACf,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,KAAK,KAAK,CAAC;QACX,KAAK,IAAI;YACP,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACzF,KAAK,KAAK;YACR,OAAO,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/policy/index.d.ts

@@ -0,0 +1,7 @@
+export type { ComparisonOperator, PolicyBuiltin, PolicyCall, PolicyComparison, PolicyExpr, PolicyLogical, PolicyNode, PolicyNot, PolicyOperand, } from './ast.js';
+export { COMPARISON_OPERATORS, formatPolicyExpr, isPolicyBuiltin, POLICY_BUILTIN_ARITY, POLICY_BUILTINS, } from './ast.js';
+export type { LexResult, PolicyContext, PolicyToken, PolicyTokenType } from './lexer.js';
+export { tokenize, tokenText } from './lexer.js';
+export type { PolicyParseResult } from './parser.js';
+export { parsePolicyExpr } from './parser.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,UAAU,EACV,SAAS,EACT,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,4 @@
+export { COMPARISON_OPERATORS, formatPolicyExpr, isPolicyBuiltin, POLICY_BUILTIN_ARITY, POLICY_BUILTINS, } from './ast.js';
+export { tokenize, tokenText } from './lexer.js';
+export { parsePolicyExpr } from './parser.js';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/policy/lexer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * PolicyExpr lexer. Tracks byte offsets so every diagnostic can point at the
+ * offending span. Never throws: malformed input yields tokens plus diagnostics.
+ */
+import type { DiagnosticPath } from '@aid-framework/spec';
+import { IR_DIAGNOSTIC_CODES, type IrDiagnostic } from '../diagnostics.js';
+export type PolicyTokenType = 'boolean' | 'number' | 'string' | 'identifier' | 'operator' | 'lparen' | 'rparen' | 'comma' | 'eof';
+export interface PolicyToken {
+    type: PolicyTokenType;
+    /** Decoded value for literals and identifiers; the raw text for operators. */
+    value: string | number | boolean;
+    start: number;
+    end: number;
+}
+export interface PolicyContext {
+    path?: DiagnosticPath;
+    file?: string;
+}
+export interface LexResult {
+    tokens: PolicyToken[];
+    diagnostics: IrDiagnostic[];
+}
+export declare function policyDiagnostic(source: string, context: PolicyContext, offset: number, code: (typeof IR_DIAGNOSTIC_CODES)[keyof typeof IR_DIAGNOSTIC_CODES], message: string, hint?: string): IrDiagnostic;
+export declare function tokenize(source: string, context?: PolicyContext): LexResult;
+/** The token's text as written, for messages. */
+export declare function tokenText(token: PolicyToken): string;
+//# sourceMappingURL=lexer.d.ts.map

package/dist/policy/lexer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexer.d.ts","sourceRoot":"","sources":["../../src/policy/lexer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,KAAK,CAAC;AAEV,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,WAAW,EAAE,YAAY,EAAE,CAAC;CAC7B;AAID,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,EACpE,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,GACZ,YAAY,CAOd;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,SAAS,CA0F/E;AAED,iDAAiD;AACjD,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAIpD"}

package/dist/policy/lexer.js

@@ -0,0 +1,147 @@
+/**
+ * PolicyExpr lexer. Tracks byte offsets so every diagnostic can point at the
+ * offending span. Never throws: malformed input yields tokens plus diagnostics.
+ */
+import { IR_DIAGNOSTIC_CODES, irError, offsetPosition, withPosition, } from '../diagnostics.js';
+const KEYWORDS = new Set(['true', 'false', 'and', 'or', 'not']);
+export function policyDiagnostic(source, context, offset, code, message, hint) {
+    const { line, column } = offsetPosition(source, offset);
+    return withPosition(irError({ code, message, path: context.path, hint }), {
+        file: context.file,
+        line,
+        column,
+    });
+}
+export function tokenize(source, context = {}) {
+    const tokens = [];
+    const diagnostics = [];
+    let index = 0;
+    while (index < source.length) {
+        const char = source[index];
+        if (char === ' ' || char === '\t' || char === '\n' || char === '\r') {
+            index += 1;
+            continue;
+        }
+        if (char === '(' || char === ')' || char === ',') {
+            const type = char === '(' ? 'lparen' : char === ')' ? 'rparen' : 'comma';
+            tokens.push({ type, value: char, start: index, end: index + 1 });
+            index += 1;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            const end = scanString(source, index, char);
+            if (end === -1) {
+                diagnostics.push(policyDiagnostic(source, context, index, IR_DIAGNOSTIC_CODES.policyUnterminatedString, 'unterminated string literal', 'close the string with the same quote character it opened with'));
+                index = source.length;
+                continue;
+            }
+            tokens.push({
+                type: 'string',
+                value: decodeString(source.slice(index + 1, end - 1)),
+                start: index,
+                end,
+            });
+            index = end;
+            continue;
+        }
+        if (char >= '0' && char <= '9') {
+            const end = scanNumber(source, index);
+            tokens.push({ type: 'number', value: Number(source.slice(index, end)), start: index, end });
+            index = end;
+            continue;
+        }
+        if (isIdentifierStart(char)) {
+            const end = scanIdentifier(source, index);
+            const text = source.slice(index, end);
+            if (text === 'true' || text === 'false') {
+                tokens.push({ type: 'boolean', value: text === 'true', start: index, end });
+            }
+            else if (KEYWORDS.has(text)) {
+                tokens.push({ type: 'operator', value: text, start: index, end });
+            }
+            else {
+                tokens.push({ type: 'identifier', value: text, start: index, end });
+            }
+            index = end;
+            continue;
+        }
+        const pair = source.slice(index, index + 2);
+        if (pair === '==' || pair === '!=' || pair === '<=' || pair === '>=') {
+            tokens.push({ type: 'operator', value: pair, start: index, end: index + 2 });
+            index += 2;
+            continue;
+        }
+        if (char === '<' || char === '>') {
+            tokens.push({ type: 'operator', value: char, start: index, end: index + 1 });
+            index += 1;
+            continue;
+        }
+        diagnostics.push(policyDiagnostic(source, context, index, IR_DIAGNOSTIC_CODES.policySyntax, `unexpected character ${JSON.stringify(char)}`, 'PolicyExpr supports literals, comparisons, and/or/not, parentheses, and the hasRole/hasScope/isAuthenticated builtins'));
+        index += 1;
+    }
+    tokens.push({ type: 'eof', value: '', start: source.length, end: source.length });
+    return { tokens, diagnostics };
+}
+/** The token's text as written, for messages. */
+export function tokenText(token) {
+    if (token.type === 'string')
+        return JSON.stringify(token.value);
+    if (token.type === 'boolean')
+        return String(token.value);
+    return String(token.value);
+}
+function scanString(source, start, quote) {
+    let index = start + 1;
+    while (index < source.length) {
+        const char = source[index];
+        if (char === '\\') {
+            index += 2;
+            continue;
+        }
+        if (char === quote)
+            return index + 1;
+        index += 1;
+    }
+    return -1;
+}
+function decodeString(raw) {
+    let decoded = '';
+    for (let index = 0; index < raw.length; index += 1) {
+        const char = raw[index];
+        if (char === '\\' && index + 1 < raw.length) {
+            const next = raw[index + 1];
+            decoded += next === 'n' ? '\n' : next === 't' ? '\t' : next === 'r' ? '\r' : next;
+            index += 1;
+            continue;
+        }
+        decoded += char;
+    }
+    return decoded;
+}
+function scanNumber(source, start) {
+    let index = start;
+    while (index < source.length && isDigit(source[index]))
+        index += 1;
+    if (index < source.length && source[index] === '.') {
+        index += 1;
+        while (index < source.length && isDigit(source[index]))
+            index += 1;
+    }
+    return index;
+}
+function scanIdentifier(source, start) {
+    let index = start;
+    while (index < source.length && isIdentifierPart(source[index]))
+        index += 1;
+    return index;
+}
+function isDigit(char) {
+    return char >= '0' && char <= '9';
+}
+function isIdentifierStart(char) {
+    return (char >= 'a' && char <= 'z') || (char >= 'A' && char <= 'Z') || char === '_';
+}
+function isIdentifierPart(char) {
+    return isIdentifierStart(char) || isDigit(char);
+}
+//# sourceMappingURL=lexer.js.map