@armoriq/policy-ir 0.1.2 → 0.1.3

package/dist/document.cjs

@@ -0,0 +1,722 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/document-entry.ts
+var document_entry_exports = {};
+__export(document_entry_exports, {
+  Diagnostics: () => Diagnostics,
+  NEVER: () => NEVER,
+  SOURCE_OPERATORS: () => SOURCE_OPERATORS,
+  VERDICTS: () => VERDICTS,
+  parseDocument: () => parseDocument,
+  parseYaml: () => parseYaml,
+  serialize: () => serialize,
+  validate: () => validate
+});
+module.exports = __toCommonJS(document_entry_exports);
+
+// src/document/parse.ts
+var import_yaml = require("yaml");
+
+// src/document/diagnostics.ts
+var Diagnostics = class {
+  items = [];
+  error(code, path, message) {
+    this.items.push({ code, severity: "error", path, message });
+  }
+  warning(code, path, message) {
+    this.items.push({ code, severity: "warning", path, message });
+  }
+  get hasErrors() {
+    return this.items.some((d) => d.severity === "error");
+  }
+};
+
+// src/document/grammar.ts
+var SOURCE_OPERATORS = [
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "matches",
+  "notMatches",
+  "startsWith",
+  "glob",
+  "withinWorkspace",
+  "exists"
+];
+var VERDICTS = ["allow", "hold", "block"];
+var NEVER = "never";
+
+// src/document/reader.ts
+var Reader = class {
+  constructor(diag) {
+    this.diag = diag;
+  }
+  diag;
+  object(value, path, keys) {
+    if (!isPlainObject(value)) {
+      this.diag.error("expected_object", path, `expected a mapping, got ${describe(value)}`);
+      return null;
+    }
+    for (const key of Object.keys(value)) {
+      if (!keys.includes(key)) this.diag.error("unknown_key", `${path}/${key}`, `unknown key "${key}"`);
+    }
+    return value;
+  }
+  /** A mapping whose keys are user-chosen (rule keys, member keys). */
+  map(value, path) {
+    if (isPlainObject(value)) return value;
+    this.diag.error("expected_object", path, `expected a mapping, got ${describe(value)}`);
+    return null;
+  }
+  string(value, path) {
+    if (typeof value === "string" && value.length > 0) return value;
+    this.diag.error("expected_string", path, `expected a non-empty string, got ${describe(value)}`);
+    return null;
+  }
+  optionalString(value, path) {
+    return value === void 0 ? void 0 : this.string(value, path) ?? void 0;
+  }
+  boolean(value, path) {
+    if (value === void 0 || typeof value === "boolean") return value;
+    this.diag.error("expected_boolean", path, `expected true or false, got ${describe(value)}`);
+    return void 0;
+  }
+  number(value, path) {
+    if (value === void 0 || typeof value === "number" && Number.isFinite(value)) return value;
+    this.diag.error("expected_number", path, `expected a number, got ${describe(value)}`);
+    return void 0;
+  }
+  strings(value, path) {
+    if (value === void 0) return void 0;
+    if (Array.isArray(value) && value.every((v) => typeof v === "string")) return value;
+    this.diag.error("expected_string_list", path, `expected a list of strings, got ${describe(value)}`);
+    return void 0;
+  }
+  verdict(value, path) {
+    if (typeof value === "string" && VERDICTS.includes(value)) return value;
+    this.diag.error("expected_verdict", path, `expected allow, hold or block, got ${describe(value)}`);
+    return null;
+  }
+  optionalVerdict(value, path) {
+    return value === void 0 ? void 0 : this.verdict(value, path) ?? void 0;
+  }
+  /** `never` or ISO-8601; absent materializes to `never` (VC-7c, FR-22). */
+  expiresAt(value, path) {
+    if (value === void 0) return NEVER;
+    if (value instanceof Date) return value.toISOString();
+    if (value === NEVER) return NEVER;
+    if (typeof value === "string" && !Number.isNaN(Date.parse(value))) return new Date(value).toISOString();
+    this.diag.error("expected_expiry", path, `expected "never" or an ISO-8601 date-time, got ${describe(value)}`);
+    return NEVER;
+  }
+};
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function describe(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "a list";
+  if (value instanceof Date) return "a date";
+  return typeof value === "object" ? "a mapping" : JSON.stringify(value);
+}
+
+// src/document/parse.ts
+function parseYaml(text) {
+  const diag = new Diagnostics();
+  let value;
+  try {
+    value = (0, import_yaml.parse)(text);
+  } catch (error) {
+    diag.error("yaml_syntax", "", error.message);
+    return { source: null, diagnostics: diag };
+  }
+  return parseValue(value, diag);
+}
+function parseDocument(value) {
+  return parseValue(value, new Diagnostics());
+}
+var ROOT_KEYS = ["apiVersion", "kind", "metadata", "target", "precedence", "spec"];
+var SPEC_KEYS = ["tools", "files", "network", "skills", "secrets", "members", "products", "capture", "approvalDefaults", "expiresAt"];
+var VARIANT_KEYS = ["action", "when", "approval", "reason", "controls", "expiresAt"];
+function parseValue(value, diag) {
+  const r = new Reader(diag);
+  const root = r.object(value, "", ROOT_KEYS);
+  if (!root) return { source: null, diagnostics: diag };
+  if (root.apiVersion !== "armor.io/v2") diag.error("unsupported_api_version", "/apiVersion", `expected armor.io/v2`);
+  if (root.kind !== "Policy") diag.error("unsupported_kind", "/kind", `expected Policy`);
+  const metadata = parseMetadata(r, root.metadata);
+  const target = parseTarget(r, diag, root.target);
+  const precedence = parsePrecedence(diag, root.precedence);
+  const spec = parseSpec(r, diag, root.spec);
+  if (diag.hasErrors || !metadata || !target || !spec) return { source: null, diagnostics: diag };
+  const source = { apiVersion: "armor.io/v2", kind: "Policy", metadata, target, spec };
+  if (precedence) source.precedence = precedence;
+  return { source, diagnostics: diag };
+}
+function parseMetadata(r, value) {
+  const m = r.object(value, "/metadata", ["name", "description", "orgId", "labels"]);
+  if (!m) return null;
+  const name = r.string(m.name, "/metadata/name");
+  if (!name) return null;
+  const out = { name };
+  const description = r.optionalString(m.description, "/metadata/description");
+  const orgId = r.optionalString(m.orgId, "/metadata/orgId");
+  if (description) out.description = description;
+  if (orgId) out.orgId = orgId;
+  if (m.labels !== void 0) out.labels = parseLabels(r, m.labels);
+  return out;
+}
+function parseLabels(r, value) {
+  const labels = r.map(value, "/metadata/labels") ?? {};
+  const out = {};
+  for (const [k, v] of Object.entries(labels)) {
+    const s = r.string(v, `/metadata/labels/${k}`);
+    if (s) out[k] = s;
+  }
+  return out;
+}
+var TARGET_FORMS = ["agent", "group", "org", "device"];
+function parseTarget(r, diag, value) {
+  const t = r.object(value, "/target", ["agent", "mcpServers", "group", "org", "device"]);
+  if (!t) return null;
+  const forms = TARGET_FORMS.filter((f) => t[f] !== void 0);
+  if (forms.length !== 1) {
+    diag.error("target_form", "/target", `exactly one of agent, group, org or device is required; got ${forms.length}`);
+    return null;
+  }
+  return targetOf(r, diag, t, forms[0]);
+}
+function targetOf(r, diag, t, form) {
+  if (form === "org" || form === "device") return fixedTarget(diag, t, form);
+  if (t.mcpServers !== void 0 && form !== "agent") diag.error("unknown_key", "/target/mcpServers", "mcpServers belongs to an agent target");
+  const id = r.string(t[form], `/target/${form}`);
+  if (!id) return null;
+  if (form === "group") return { group: id };
+  const servers = r.strings(t.mcpServers, "/target/mcpServers");
+  return servers ? { agent: id, mcpServers: servers } : { agent: id };
+}
+var FIXED_TARGETS = {
+  org: { value: "*", code: "target_org", message: 'the organization floor is written as org: "*"' },
+  device: { value: "local", code: "target_device", message: "the only device target is local" }
+};
+function fixedTarget(diag, t, form) {
+  const expected = FIXED_TARGETS[form];
+  if (t[form] === expected.value) return form === "org" ? { org: "*" } : { device: "local" };
+  diag.error(expected.code, `/target/${form}`, expected.message);
+  return null;
+}
+function parsePrecedence(diag, value) {
+  if (value === void 0 || value === "device-first" || value === "agent-first") return value;
+  diag.error("expected_precedence", "/precedence", "expected device-first or agent-first");
+  return void 0;
+}
+function parseSpec(r, diag, value) {
+  const s = r.object(value, "/spec", SPEC_KEYS);
+  if (!s) return null;
+  const tools = parseTools(r, diag, s.tools, "/spec/tools");
+  if (!tools) return null;
+  const spec = { tools, expiresAt: r.expiresAt(s.expiresAt, "/spec/expiresAt") };
+  assign(spec, "files", parseFiles(r, s.files));
+  assign(spec, "network", parseNetwork(r, s.network));
+  assign(spec, "skills", parseSkills(r, s.skills));
+  assign(spec, "secrets", parseSecrets(r, s.secrets));
+  assign(spec, "members", parseOverlays(r, diag, s.members, "/spec/members"));
+  assign(spec, "products", parseOverlays(r, diag, s.products, "/spec/products"));
+  assign(spec, "capture", parseCapture(r, s.capture));
+  assign(spec, "approvalDefaults", parseApproval(r, s.approvalDefaults, "/spec/approvalDefaults"));
+  return spec;
+}
+function assign(spec, key, value) {
+  if (value !== void 0) spec[key] = value;
+}
+function parseTools(r, diag, value, path) {
+  const t = r.object(value, path, ["default", "rules"]);
+  if (!t) return null;
+  const dflt = r.verdict(t.default, `${path}/default`);
+  if (!dflt) return null;
+  const rules = parseRules(r, diag, t.rules, `${path}/rules`);
+  return rules ? { default: dflt, rules } : { default: dflt };
+}
+function parseRules(r, diag, value, path) {
+  if (value === void 0) return void 0;
+  const map = r.map(value, path);
+  if (!map) return void 0;
+  const out = {};
+  for (const [key, rule] of Object.entries(map)) {
+    const parsed = parseRule(r, diag, rule, `${path}/${key}`);
+    if (parsed) out[key] = parsed;
+  }
+  return out;
+}
+function parseRule(r, diag, value, path) {
+  if (typeof value === "string") {
+    const v = r.verdict(value, path);
+    return v ? [{ action: v, expiresAt: "never" }] : null;
+  }
+  if (!Array.isArray(value)) {
+    diag.error("expected_rule", path, "expected a verdict or a list of variants");
+    return null;
+  }
+  const variants = value.map((v, i) => parseVariant(r, diag, v, `${path}/${i}`));
+  return variants.every((v) => v !== null) ? variants : null;
+}
+function parseVariant(r, diag, value, path) {
+  const v = r.object(value, path, VARIANT_KEYS);
+  if (!v) return null;
+  const action = r.verdict(v.action, `${path}/action`);
+  if (!action) return null;
+  const variant = { action, expiresAt: r.expiresAt(v.expiresAt, `${path}/expiresAt`) };
+  const when = parseWhen(r, diag, v.when, `${path}/when`);
+  const approval = parseApproval(r, v.approval, `${path}/approval`);
+  const reason = r.optionalString(v.reason, `${path}/reason`);
+  const controls = r.strings(v.controls, `${path}/controls`);
+  if (when) variant.when = when;
+  if (approval) variant.approval = approval;
+  if (reason) variant.reason = reason;
+  if (controls) variant.controls = controls;
+  return variant;
+}
+function parseWhen(r, diag, value, path) {
+  if (value === void 0) return void 0;
+  const map = r.map(value, path);
+  if (!map) return void 0;
+  const out = {};
+  for (const [field, spec] of Object.entries(map)) {
+    const cond = parseCondition(r, diag, spec, `${path}/${field}`);
+    if (cond) out[field] = cond;
+  }
+  return out;
+}
+function parseCondition(r, diag, value, path) {
+  const c = r.object(value, path, SOURCE_OPERATORS);
+  if (!c) return null;
+  const ops = Object.keys(c);
+  if (ops.length !== 1) {
+    diag.error("condition_operator", path, `exactly one operator is required; got ${ops.length}`);
+    return null;
+  }
+  return c;
+}
+function parseApproval(r, value, path) {
+  if (value === void 0) return void 0;
+  const a = r.object(value, path, ["approvers", "roles", "members", "anyMember"]);
+  if (!a) return void 0;
+  const approvers = r.number(a.approvers, `${path}/approvers`);
+  const out = { approvers: approvers ?? 1 };
+  const roles = r.strings(a.roles, `${path}/roles`);
+  const members = r.strings(a.members, `${path}/members`);
+  const anyMember = r.boolean(a.anyMember, `${path}/anyMember`);
+  if (roles) out.roles = roles;
+  if (members) out.members = members;
+  if (anyMember !== void 0) out.anyMember = anyMember;
+  return out;
+}
+function parseFiles(r, value) {
+  if (value === void 0) return void 0;
+  const f = r.object(value, "/spec/files", ["deny", "allowOutsideWorkspace"]);
+  if (!f) return void 0;
+  const out = {};
+  const deny = r.strings(f.deny, "/spec/files/deny");
+  const outside = r.boolean(f.allowOutsideWorkspace, "/spec/files/allowOutsideWorkspace");
+  if (deny) out.deny = deny;
+  if (outside !== void 0) out.allowOutsideWorkspace = outside;
+  return out;
+}
+function parseNetwork(r, value) {
+  if (value === void 0) return void 0;
+  const n = r.object(value, "/spec/network", ["default", "allow", "deny"]);
+  if (!n) return void 0;
+  const out = {};
+  const dflt = r.optionalVerdict(n.default, "/spec/network/default");
+  const allow = parseNetworkEntries(r, n.allow, "/spec/network/allow");
+  const deny = parseNetworkEntries(r, n.deny, "/spec/network/deny");
+  if (dflt) out.default = dflt;
+  if (allow) out.allow = allow;
+  if (deny) out.deny = deny;
+  return out;
+}
+function parseNetworkEntries(r, value, path) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    r.strings(value, path);
+    return void 0;
+  }
+  const out = [];
+  value.forEach((entry, i) => {
+    if (typeof entry === "string") return void out.push(entry);
+    const e = r.object(entry, `${path}/${i}`, ["host", "reason"]);
+    const host = e ? r.string(e.host, `${path}/${i}/host`) : null;
+    if (e && host) out.push(e.reason === void 0 ? { host } : { host, reason: String(e.reason) });
+  });
+  return out;
+}
+function parseSkills(r, value) {
+  if (value === void 0) return void 0;
+  const s = r.object(value, "/spec/skills", ["default", "hold", "block"]);
+  if (!s) return void 0;
+  const out = {};
+  const dflt = r.optionalVerdict(s.default, "/spec/skills/default");
+  const hold = r.strings(s.hold, "/spec/skills/hold");
+  const block = r.strings(s.block, "/spec/skills/block");
+  if (dflt) out.default = dflt;
+  if (hold) out.hold = hold;
+  if (block) out.block = block;
+  return out;
+}
+function parseSecrets(r, value) {
+  if (value === void 0) return void 0;
+  const s = r.object(value, "/spec/secrets", ["envBlocklist"]);
+  if (!s) return void 0;
+  const envBlocklist = r.strings(s.envBlocklist, "/spec/secrets/envBlocklist");
+  return envBlocklist ? { envBlocklist } : {};
+}
+function parseOverlays(r, diag, value, path) {
+  if (value === void 0) return void 0;
+  const map = r.map(value, path);
+  if (!map) return void 0;
+  const out = {};
+  for (const [key, overlay] of Object.entries(map)) {
+    const parsed = parseOverlay(r, diag, overlay, `${path}/${key}`);
+    if (parsed) out[key] = parsed;
+  }
+  return out;
+}
+function parseOverlay(r, diag, value, path) {
+  const o = r.object(value, path, ["tools", "expiresAt"]);
+  if (!o) return null;
+  const overlay = { expiresAt: r.expiresAt(o.expiresAt, `${path}/expiresAt`) };
+  if (o.tools === void 0) return overlay;
+  const t = r.object(o.tools, `${path}/tools`, ["default", "rules"]);
+  if (!t) return overlay;
+  const tools = {};
+  const dflt = r.optionalVerdict(t.default, `${path}/tools/default`);
+  const rules = parseRules(r, diag, t.rules, `${path}/tools/rules`);
+  if (dflt) tools.default = dflt;
+  if (rules) tools.rules = rules;
+  overlay.tools = tools;
+  return overlay;
+}
+function parseCapture(r, value) {
+  if (value === void 0) return void 0;
+  const c = r.object(value, "/spec/capture", ["arguments", "redact", "maxBytesPerCall", "sample"]);
+  if (!c) return void 0;
+  const out = {};
+  const args = r.boolean(c.arguments, "/spec/capture/arguments");
+  const redact = r.strings(c.redact, "/spec/capture/redact");
+  const max = r.number(c.maxBytesPerCall, "/spec/capture/maxBytesPerCall");
+  const sample = r.number(c.sample, "/spec/capture/sample");
+  if (args !== void 0) out.arguments = args;
+  if (redact) out.redact = redact;
+  if (max !== void 0) out.maxBytesPerCall = max;
+  if (sample !== void 0) out.sample = sample;
+  return out;
+}
+
+// src/evaluate/input.ts
+var VERDICT_RANK = { allow: 0, hold: 1, block: 2 };
+
+// src/document/portable-regex.ts
+function isPortablePattern(pattern) {
+  if (typeof pattern !== "string") return false;
+  try {
+    new RegExp(pattern);
+  } catch {
+    return false;
+  }
+  const parser = new Parser(pattern);
+  return parser.alternatives() && parser.done();
+}
+var ESCAPED_PUNCTUATION = new Set("\\/.*+?()[]{}|^$-");
+var CONTROL_ESCAPES = new Set("tnrfv");
+var SET_ESCAPES = new Set("dwsDWS");
+var CLASS_SET_ESCAPES = new Set("dws");
+var BARE_SPECIALS = new Set("]{}*+?");
+var QUANTIFIER = /^\{\d+(,\d*)?\}/;
+var Parser = class {
+  constructor(p) {
+    this.p = p;
+  }
+  p;
+  i = 0;
+  done() {
+    return this.i === this.p.length;
+  }
+  alternatives() {
+    while (!this.done() && this.p[this.i] !== ")") {
+      if (this.p[this.i] === "|") this.i++;
+      else if (!this.term()) return false;
+    }
+    return true;
+  }
+  term() {
+    const atom = this.atom();
+    return atom !== null && this.quantifier(atom === "quantifiable");
+  }
+  atom() {
+    const c = this.p[this.i++];
+    if (c === "^" || c === "$") return "assertion";
+    if (c === "\\") return this.escape();
+    if (c === "[") return this.charClass() ? "quantifiable" : null;
+    if (c === "(") return this.group() ? "quantifiable" : null;
+    return BARE_SPECIALS.has(c) ? null : "quantifiable";
+  }
+  escape() {
+    const e = this.p[this.i++] ?? "";
+    if (e === "b" || e === "B") return "assertion";
+    if (SET_ESCAPES.has(e) || CONTROL_ESCAPES.has(e) || ESCAPED_PUNCTUATION.has(e)) return "quantifiable";
+    return this.hexEscape(e) ? "quantifiable" : null;
+  }
+  hexEscape(e) {
+    const width = e === "x" ? 2 : e === "u" ? 4 : 0;
+    const digits = this.p.slice(this.i, this.i + width);
+    if (width === 0 || !/^[0-9a-fA-F]+$/.test(digits) || digits.length !== width) return false;
+    this.i += width;
+    return true;
+  }
+  group() {
+    if (this.p[this.i] === "?") {
+      if (this.p[this.i + 1] !== ":") return false;
+      this.i += 2;
+    }
+    if (!this.alternatives() || this.p[this.i] !== ")") return false;
+    this.i++;
+    return true;
+  }
+  charClass() {
+    if (this.p[this.i] === "^") this.i++;
+    if (this.p[this.i] === "]") return false;
+    while (!this.done() && this.p[this.i] !== "]") {
+      if (!this.classItem()) return false;
+    }
+    if (this.done()) return false;
+    this.i++;
+    return true;
+  }
+  classItem() {
+    const start = this.classAtom();
+    if (start === null) return false;
+    if (this.p[this.i] !== "-" || this.p[this.i + 1] === "]") return true;
+    this.i++;
+    return start === "char" && this.classAtom() === "char";
+  }
+  classAtom() {
+    const c = this.p[this.i++];
+    if (c === "[") return null;
+    if (c !== "\\") return isSurrogate(c) ? null : "char";
+    const e = this.p[this.i++] ?? "";
+    if (CLASS_SET_ESCAPES.has(e)) return "set";
+    if (CONTROL_ESCAPES.has(e) || ESCAPED_PUNCTUATION.has(e)) return "char";
+    return this.hexEscape(e) ? "char" : null;
+  }
+  quantifier(quantifiable) {
+    const length = this.quantifierLength();
+    if (length === 0) return true;
+    if (length < 0 || !quantifiable) return false;
+    this.i += length;
+    if (this.p[this.i] === "?") this.i++;
+    return true;
+  }
+  quantifierLength() {
+    const c = this.p[this.i];
+    if (c === "*" || c === "+" || c === "?") return 1;
+    if (c !== "{") return 0;
+    return QUANTIFIER.exec(this.p.slice(this.i))?.[0].length ?? -1;
+  }
+};
+function isSurrogate(c) {
+  const code = c.charCodeAt(0);
+  return code >= 55296 && code <= 57343;
+}
+
+// src/document/validate.ts
+function validate(source) {
+  const diag = new Diagnostics();
+  const ctx = { diag, approvalDefaults: source.spec.approvalDefaults, base: source.spec.tools };
+  validateTargetSections(ctx, source);
+  if (source.spec.approvalDefaults) validateApproval(ctx, source.spec.approvalDefaults, "/spec/approvalDefaults", true);
+  validateRules(ctx, source.spec.tools.rules, "/spec/tools/rules");
+  validateOverlays(ctx, source.spec.members, "/spec/members");
+  validateOverlays(ctx, source.spec.products, "/spec/products");
+  validateCapture(ctx, source);
+  return diag;
+}
+function validateTargetSections(ctx, source) {
+  const local = "device" in source.target;
+  if (!local && source.spec.products) ctx.diag.error("local_only_section", "/spec/products", "products applies only under target device: local");
+  if (!local && source.precedence) ctx.diag.error("local_only_section", "/precedence", "precedence applies only under target device: local");
+  if (local && source.spec.members) ctx.diag.error("enterprise_only_section", "/spec/members", "members applies only to an enterprise target");
+  if (local && source.metadata.orgId) ctx.diag.error("enterprise_only_field", "/metadata/orgId", "a local policy carries no orgId");
+}
+function validateRules(ctx, rules, path) {
+  for (const [key, variants] of Object.entries(rules ?? {})) {
+    validateVariants(ctx, variants, `${path}/${key}`);
+  }
+}
+function validateVariants(ctx, variants, path) {
+  variants.forEach((variant, i) => {
+    const vpath = `${path}/${i}`;
+    if (i > 0 && isUnconditional(variants[i - 1])) {
+      ctx.diag.error("unreachable_variant", vpath, `variant ${i - 1} has no when, so this variant can never be reached`);
+    }
+    validateVariant(ctx, variant, vpath);
+  });
+}
+function isUnconditional(variant) {
+  return !variant.when || Object.keys(variant.when).length === 0;
+}
+function validateVariant(ctx, variant, path) {
+  if (variant.action === "hold") validateHoldApprover(ctx, variant, path);
+  for (const [field, spec] of Object.entries(variant.when ?? {})) validateCondition(ctx, spec, `${path}/when/${field}`);
+}
+function validateHoldApprover(ctx, variant, path) {
+  if (variant.approval) return void validateApproval(ctx, variant.approval, `${path}/approval`, true);
+  if (!ctx.approvalDefaults) {
+    ctx.diag.error("hold_without_approver", path, "a hold names an approval or the document sets approvalDefaults");
+  }
+}
+function validateApproval(ctx, approval, path, requireResolvable) {
+  if (!Number.isInteger(approval.approvers) || approval.approvers < 1) {
+    ctx.diag.error("approvers_count", `${path}/approvers`, "approvers is a whole number of at least 1");
+  }
+  if (requireResolvable && !namesAnApprover(approval)) {
+    ctx.diag.error("approval_unresolvable", path, "an approval names roles, members or anyMember: true");
+  }
+}
+function namesAnApprover(approval) {
+  return (approval.roles?.length ?? 0) > 0 || (approval.members?.length ?? 0) > 0 || approval.anyMember === true;
+}
+var OPERANDS = {
+  eq: [() => true, "any value"],
+  neq: [() => true, "any value"],
+  in: [Array.isArray, "a list"],
+  notIn: [Array.isArray, "a list"],
+  gt: [isNumber, "a number"],
+  gte: [isNumber, "a number"],
+  lt: [isNumber, "a number"],
+  lte: [isNumber, "a number"],
+  matches: [isPortablePattern, "a regular expression in the portable subset"],
+  notMatches: [isPortablePattern, "a regular expression in the portable subset"],
+  startsWith: [isString, "a string"],
+  glob: [isString, "a glob"],
+  withinWorkspace: [isBoolean, "true or false"],
+  exists: [isBoolean, "true or false"]
+};
+function validateCondition(ctx, spec, path) {
+  const [op, value] = Object.entries(spec)[0];
+  const [check, expected] = OPERANDS[op];
+  if (!check(value)) ctx.diag.error("condition_operand", `${path}/${op}`, `${op} takes ${expected}`);
+}
+function isNumber(v) {
+  return typeof v === "number" && Number.isFinite(v);
+}
+function isString(v) {
+  return typeof v === "string";
+}
+function isBoolean(v) {
+  return typeof v === "boolean";
+}
+function validateOverlays(ctx, overlays2, path) {
+  for (const [key, overlay] of Object.entries(overlays2 ?? {})) {
+    const opath = `${path}/${key}`;
+    validateRules(ctx, overlay.tools?.rules, `${opath}/tools/rules`);
+    flagLoosening(ctx, overlay, opath);
+  }
+}
+function flagLoosening(ctx, overlay, path) {
+  const baseDefault = ctx.base.default;
+  if (overlay.tools?.default && looser(overlay.tools.default, baseDefault)) {
+    ctx.diag.warning("loosening_grant", `${path}/tools/default`, `default ${overlay.tools.default} is looser than the base default ${baseDefault}`);
+  }
+  for (const [key, variants] of Object.entries(overlay.tools?.rules ?? {})) {
+    const base = baseVerdictFor(ctx.base, key);
+    const loosest = variants.reduce((v, x) => looser(x.action, v) ? x.action : v, "block");
+    if (looser(loosest, base)) {
+      ctx.diag.warning("loosening_grant", `${path}/tools/rules/${key}`, `${key}: ${loosest} is looser than the base ${base}`);
+    }
+  }
+}
+function baseVerdictFor(base, key) {
+  const variants = base.rules?.[key];
+  if (!variants) return base.default;
+  return variants.reduce((v, x) => looser(v, x.action) ? x.action : v, "allow");
+}
+function looser(a, b) {
+  return VERDICT_RANK[a] < VERDICT_RANK[b];
+}
+function validateCapture(ctx, source) {
+  const c = source.spec.capture;
+  if (!c) return;
+  if (c.sample !== void 0 && (c.sample < 0 || c.sample > 1)) ctx.diag.error("capture_sample", "/spec/capture/sample", "sample is between 0 and 1");
+  if (c.maxBytesPerCall !== void 0 && (c.maxBytesPerCall < 0 || !Number.isInteger(c.maxBytesPerCall))) {
+    ctx.diag.error("capture_max_bytes", "/spec/capture/maxBytesPerCall", "maxBytesPerCall is a whole number of bytes");
+  }
+}
+
+// src/compile/serialize.ts
+var import_yaml2 = require("yaml");
+function serialize(source) {
+  const spec = { ...source.spec, tools: { ...source.spec.tools, rules: shorthand(source.spec.tools.rules) } };
+  if (spec.members) spec.members = overlays(spec.members);
+  if (spec.products) spec.products = overlays(spec.products);
+  const doc = {
+    apiVersion: source.apiVersion,
+    kind: source.kind,
+    metadata: source.metadata,
+    target: source.target
+  };
+  if (source.precedence) doc.precedence = source.precedence;
+  doc.spec = spec;
+  return (0, import_yaml2.stringify)(doc, { lineWidth: 0, defaultStringType: "PLAIN", defaultKeyType: "PLAIN", aliasDuplicateObjects: false });
+}
+function shorthand(rules) {
+  if (!rules) return void 0;
+  const out = {};
+  for (const [key, value] of Object.entries(rules)) out[key] = scalarIfPlain(value);
+  return out;
+}
+function scalarIfPlain(variants) {
+  const only = variants.length === 1 ? variants[0] : null;
+  const plain = only && Object.keys(only).length === 2 && only.expiresAt === "never";
+  return plain ? only.action : variants;
+}
+function overlays(map) {
+  const out = {};
+  for (const [key, overlay] of Object.entries(map)) {
+    out[key] = overlay.tools?.rules ? { ...overlay, tools: { ...overlay.tools, rules: shorthand(overlay.tools.rules) } } : overlay;
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Diagnostics,
+  NEVER,
+  SOURCE_OPERATORS,
+  VERDICTS,
+  parseDocument,
+  parseYaml,
+  serialize,
+  validate
+});
+//# sourceMappingURL=document.cjs.map