@armoriq/policy-ir 0.1.3 → 0.1.5

package/dist/{document-entry-CDOQVeis.d.cts → document-entry-CsMP9dea.d.cts}

@@ -40,6 +40,8 @@ interface Defaults {
     network: Verdict;
     files: Verdict;
     skills: Verdict;
+    /** Who approves a hold from `tools.default`: the source's `spec.approvalDefaults`. */
+    approval?: Approval;
 }
 interface Capture {
     arguments: boolean;
@@ -211,12 +213,35 @@ declare function parseYaml(text: string): ParseResult;
 /** Parse an already-loaded YAML/JSON value strictly. */
 declare function parseDocument(value: unknown): ParseResult;
 
+/** One tool the target can reach, as the inventory knows it. */
+interface InventoryTool {
+    /** The wire name the model sees; for an MCP tool the host may also supply the qualified `mcp__<server>__<tool>` form as `qualifiedName`. */
+    name: string;
+    qualifiedName?: string;
+    owner: {
+        type: 'mcp_server' | 'agent' | 'local';
+        id: string;
+        name?: string;
+    };
+    schemaHash: string | null;
+    inputSchema?: unknown;
+    capabilities?: string[];
+    /** False for a row the observed feed created and no owner has declared: the compiler warns instead of binding. */
+    declared: boolean;
+}
+/** What a host implements: conmap on `tool_snapshots`, the Armor CLI on the local tool list. */
+interface InventoryPort {
+    toolsForTarget(target: SourceTarget): Promise<InventoryTool[]>;
+}
+declare const CAPABILITY_KEYS: ReadonlySet<string>;
+
 /**
  * Everything that can be checked without an inventory. Inventory-dependent
  * checks (roster clamp, glob collisions on real tools, schema binding) live in
- * the compiler.
+ * the compiler. An inventory, when given, lets the loosening check match a
+ * tool's bare and qualified names across the base and an overlay.
  */
-declare function validate(source: PolicySource): Diagnostics;
+declare function validate(source: PolicySource, inventory?: InventoryTool[]): Diagnostics;
 
 /**
  * PolicySource back to YAML such that `parse(serialize(x))` equals `x`
@@ -226,4 +251,86 @@ declare function validate(source: PolicySource): Diagnostics;
  */
 declare function serialize(source: PolicySource): string;
 
-export { type Approval as A, type Condition as C, Diagnostics as D, type KeyTier as K, type Layer as L, NEVER as N, type Overlay as O, type PolicyDocument as P, type RuleValue as R, type Statement as S, type ToolsSection as T, type Verdict as V, type SourceTarget as a, type PolicySource as b, type Capture as c, type ConditionOp as d, type ConditionSpec as e, type Defaults as f, type Diagnostic as g, type NetworkEntry as h, type ParseResult as i, type PolicySpec as j, type PolicyTarget as k, type Provenance as l, type RuleVariant as m, SCHEMA_VERSION as n, SOURCE_OPERATORS as o, type SchemaBinding as p, type Severity as q, type SourceOperator as r, type StatementMatch as s, type Subject as t, VERDICTS as u, layerOfTarget as v, parseDocument as w, parseYaml as x, serialize as y, validate as z };
+type Enforceability = 'enforced' | 'argument-only' | 'inert';
+type Section = 'tools' | 'files' | 'network' | 'skills' | 'secrets';
+/**
+ * Per-section honesty (FR-9, FR-19): a local device sees real paths and
+ * hosts; the enterprise SDK path sees only path-shaped and URL-shaped
+ * arguments; skills and secrets have no enterprise surface at all.
+ */
+interface EnforceabilityReport {
+    sections: Partial<Record<Section, Enforceability>>;
+    /** Tools in the inventory that no capability rule reaches, when the document uses capability keys (M-12). */
+    notCoveredByCapabilityRules: string[];
+}
+declare function enforceabilityReport(source: PolicySource, inventory: InventoryTool[]): EnforceabilityReport;
+
+declare const COMPOSE_INTENT_MAX = 4000;
+interface ComposeTarget {
+    agent: string;
+}
+interface ComposeAnswer {
+    questionId: string;
+    /** The question as it was asked, since compose keeps no state between rounds. */
+    question: string;
+    text: string;
+}
+interface ComposeRequest {
+    target: ComposeTarget;
+    intent: string;
+    draft?: string;
+    answers?: ComposeAnswer[];
+}
+interface ComposeUnsupported {
+    sentence: string;
+    reason: string;
+}
+interface ComposeQuestion {
+    id: string;
+    text: string;
+}
+interface ComposeChangedCall {
+    auditId: string;
+    tool: string;
+    arguments: Record<string, unknown>;
+    executedAt: string;
+    from: Verdict;
+    to: Verdict;
+}
+interface ComposeReplay {
+    calls: number;
+    verdicts: Record<Verdict, number>;
+    changed: ComposeChangedCall[];
+}
+interface ComposeExample {
+    /** Same format as `Diagnostic.path`: `/spec/tools/rules/<key>/<variant>`. */
+    path: string;
+    call: {
+        tool: string;
+        qualifiedName?: string;
+        arguments: Record<string, unknown>;
+    };
+    verdict: Verdict;
+}
+interface ComposePreview {
+    replay: ComposeReplay | null;
+    examples: ComposeExample[];
+}
+interface ComposeResponse {
+    composeId: string;
+    document: PolicyDocument | null;
+    yaml: string;
+    diagnostics: Diagnostic[];
+    report: EnforceabilityReport;
+    unsupported: ComposeUnsupported[];
+    questions: ComposeQuestion[];
+    /** Source sentence per rule, keyed by `Diagnostic.path`: `/spec/tools/rules/<key>/<variant>`. */
+    sources: Record<string, string>;
+    preview: ComposePreview;
+    model: string;
+    rounds: number;
+    /** The model's one-paragraph explanation of the draft. */
+    reasoning?: string;
+}
+
+export { parseYaml as $, type Approval as A, SCHEMA_VERSION as B, type Condition as C, Diagnostics as D, type EnforceabilityReport as E, SOURCE_OPERATORS as F, type SchemaBinding as G, type Section as H, type InventoryTool as I, type Severity as J, type KeyTier as K, type Layer as L, type SourceOperator as M, NEVER as N, type Overlay as O, type PolicyDocument as P, type SourceTarget as Q, type RuleValue as R, type Statement as S, type StatementMatch as T, type Subject as U, type Verdict as V, type ToolsSection as W, VERDICTS as X, enforceabilityReport as Y, layerOfTarget as Z, parseDocument as _, type PolicySource as a, serialize as a0, validate as a1, type InventoryPort as b, CAPABILITY_KEYS as c, COMPOSE_INTENT_MAX as d, type Capture as e, type ComposeAnswer as f, type ComposeChangedCall as g, type ComposeExample as h, type ComposePreview as i, type ComposeQuestion as j, type ComposeReplay as k, type ComposeRequest as l, type ComposeResponse as m, type ComposeTarget as n, type ComposeUnsupported as o, type ConditionOp as p, type ConditionSpec as q, type Defaults as r, type Diagnostic as s, type Enforceability as t, type NetworkEntry as u, type ParseResult as v, type PolicySpec as w, type PolicyTarget as x, type Provenance as y, type RuleVariant as z };

package/dist/{document-entry-CDOQVeis.d.ts → document-entry-CsMP9dea.d.ts}

@@ -40,6 +40,8 @@ interface Defaults {
     network: Verdict;
     files: Verdict;
     skills: Verdict;
+    /** Who approves a hold from `tools.default`: the source's `spec.approvalDefaults`. */
+    approval?: Approval;
 }
 interface Capture {
     arguments: boolean;
@@ -211,12 +213,35 @@ declare function parseYaml(text: string): ParseResult;
 /** Parse an already-loaded YAML/JSON value strictly. */
 declare function parseDocument(value: unknown): ParseResult;
 
+/** One tool the target can reach, as the inventory knows it. */
+interface InventoryTool {
+    /** The wire name the model sees; for an MCP tool the host may also supply the qualified `mcp__<server>__<tool>` form as `qualifiedName`. */
+    name: string;
+    qualifiedName?: string;
+    owner: {
+        type: 'mcp_server' | 'agent' | 'local';
+        id: string;
+        name?: string;
+    };
+    schemaHash: string | null;
+    inputSchema?: unknown;
+    capabilities?: string[];
+    /** False for a row the observed feed created and no owner has declared: the compiler warns instead of binding. */
+    declared: boolean;
+}
+/** What a host implements: conmap on `tool_snapshots`, the Armor CLI on the local tool list. */
+interface InventoryPort {
+    toolsForTarget(target: SourceTarget): Promise<InventoryTool[]>;
+}
+declare const CAPABILITY_KEYS: ReadonlySet<string>;
+
 /**
  * Everything that can be checked without an inventory. Inventory-dependent
  * checks (roster clamp, glob collisions on real tools, schema binding) live in
- * the compiler.
+ * the compiler. An inventory, when given, lets the loosening check match a
+ * tool's bare and qualified names across the base and an overlay.
  */
-declare function validate(source: PolicySource): Diagnostics;
+declare function validate(source: PolicySource, inventory?: InventoryTool[]): Diagnostics;
 
 /**
  * PolicySource back to YAML such that `parse(serialize(x))` equals `x`
@@ -226,4 +251,86 @@ declare function validate(source: PolicySource): Diagnostics;
  */
 declare function serialize(source: PolicySource): string;
 
-export { type Approval as A, type Condition as C, Diagnostics as D, type KeyTier as K, type Layer as L, NEVER as N, type Overlay as O, type PolicyDocument as P, type RuleValue as R, type Statement as S, type ToolsSection as T, type Verdict as V, type SourceTarget as a, type PolicySource as b, type Capture as c, type ConditionOp as d, type ConditionSpec as e, type Defaults as f, type Diagnostic as g, type NetworkEntry as h, type ParseResult as i, type PolicySpec as j, type PolicyTarget as k, type Provenance as l, type RuleVariant as m, SCHEMA_VERSION as n, SOURCE_OPERATORS as o, type SchemaBinding as p, type Severity as q, type SourceOperator as r, type StatementMatch as s, type Subject as t, VERDICTS as u, layerOfTarget as v, parseDocument as w, parseYaml as x, serialize as y, validate as z };
+type Enforceability = 'enforced' | 'argument-only' | 'inert';
+type Section = 'tools' | 'files' | 'network' | 'skills' | 'secrets';
+/**
+ * Per-section honesty (FR-9, FR-19): a local device sees real paths and
+ * hosts; the enterprise SDK path sees only path-shaped and URL-shaped
+ * arguments; skills and secrets have no enterprise surface at all.
+ */
+interface EnforceabilityReport {
+    sections: Partial<Record<Section, Enforceability>>;
+    /** Tools in the inventory that no capability rule reaches, when the document uses capability keys (M-12). */
+    notCoveredByCapabilityRules: string[];
+}
+declare function enforceabilityReport(source: PolicySource, inventory: InventoryTool[]): EnforceabilityReport;
+
+declare const COMPOSE_INTENT_MAX = 4000;
+interface ComposeTarget {
+    agent: string;
+}
+interface ComposeAnswer {
+    questionId: string;
+    /** The question as it was asked, since compose keeps no state between rounds. */
+    question: string;
+    text: string;
+}
+interface ComposeRequest {
+    target: ComposeTarget;
+    intent: string;
+    draft?: string;
+    answers?: ComposeAnswer[];
+}
+interface ComposeUnsupported {
+    sentence: string;
+    reason: string;
+}
+interface ComposeQuestion {
+    id: string;
+    text: string;
+}
+interface ComposeChangedCall {
+    auditId: string;
+    tool: string;
+    arguments: Record<string, unknown>;
+    executedAt: string;
+    from: Verdict;
+    to: Verdict;
+}
+interface ComposeReplay {
+    calls: number;
+    verdicts: Record<Verdict, number>;
+    changed: ComposeChangedCall[];
+}
+interface ComposeExample {
+    /** Same format as `Diagnostic.path`: `/spec/tools/rules/<key>/<variant>`. */
+    path: string;
+    call: {
+        tool: string;
+        qualifiedName?: string;
+        arguments: Record<string, unknown>;
+    };
+    verdict: Verdict;
+}
+interface ComposePreview {
+    replay: ComposeReplay | null;
+    examples: ComposeExample[];
+}
+interface ComposeResponse {
+    composeId: string;
+    document: PolicyDocument | null;
+    yaml: string;
+    diagnostics: Diagnostic[];
+    report: EnforceabilityReport;
+    unsupported: ComposeUnsupported[];
+    questions: ComposeQuestion[];
+    /** Source sentence per rule, keyed by `Diagnostic.path`: `/spec/tools/rules/<key>/<variant>`. */
+    sources: Record<string, string>;
+    preview: ComposePreview;
+    model: string;
+    rounds: number;
+    /** The model's one-paragraph explanation of the draft. */
+    reasoning?: string;
+}
+
+export { parseYaml as $, type Approval as A, SCHEMA_VERSION as B, type Condition as C, Diagnostics as D, type EnforceabilityReport as E, SOURCE_OPERATORS as F, type SchemaBinding as G, type Section as H, type InventoryTool as I, type Severity as J, type KeyTier as K, type Layer as L, type SourceOperator as M, NEVER as N, type Overlay as O, type PolicyDocument as P, type SourceTarget as Q, type RuleValue as R, type Statement as S, type StatementMatch as T, type Subject as U, type Verdict as V, type ToolsSection as W, VERDICTS as X, enforceabilityReport as Y, layerOfTarget as Z, parseDocument as _, type PolicySource as a, serialize as a0, validate as a1, type InventoryPort as b, CAPABILITY_KEYS as c, COMPOSE_INTENT_MAX as d, type Capture as e, type ComposeAnswer as f, type ComposeChangedCall as g, type ComposeExample as h, type ComposePreview as i, type ComposeQuestion as j, type ComposeReplay as k, type ComposeRequest as l, type ComposeResponse as m, type ComposeTarget as n, type ComposeUnsupported as o, type ConditionOp as p, type ConditionSpec as q, type Defaults as r, type Diagnostic as s, type Enforceability as t, type NetworkEntry as u, type ParseResult as v, type PolicySpec as w, type PolicyTarget as x, type Provenance as y, type RuleVariant as z };

package/dist/document.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/document-entry.ts
 var document_entry_exports = {};
 __export(document_entry_exports, {
+  COMPOSE_INTENT_MAX: () => COMPOSE_INTENT_MAX,
   Diagnostics: () => Diagnostics,
   NEVER: () => NEVER,
   SOURCE_OPERATORS: () => SOURCE_OPERATORS,
@@ -437,6 +438,81 @@ function parseCapture(r, value) {
 // src/evaluate/input.ts
 var VERDICT_RANK = { allow: 0, hold: 1, block: 2 };
 
+// src/evaluate/glob.ts
+function globToRegExp(pattern) {
+  let source = "^";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      const double = pattern[i + 1] === "*";
+      source += double ? ".*" : "[^/]*";
+      if (double) i++;
+    } else if (ch === "?") {
+      source += "[^/]";
+    } else {
+      source += escapeRegExp(ch);
+    }
+  }
+  return new RegExp(source + "$");
+}
+function matchGlob(pattern, value) {
+  return globToRegExp(pattern).test(value);
+}
+function isGlob(key) {
+  return key.includes("*") || key.includes("?");
+}
+function escapeRegExp(ch) {
+  return /[\\^$.|?*+()[\]{}]/.test(ch) ? "\\" + ch : ch;
+}
+
+// src/evaluate/select.ts
+function selectKey(keys, names) {
+  let best = null;
+  for (const key of keys) {
+    if (!names.some((name) => keyMatches(key, name))) continue;
+    if (best === null || keyBeats(key, best)) best = key;
+  }
+  return best;
+}
+function keyMatches(key, tool) {
+  return isGlob(key) ? matchGlob(key, tool) : key === tool;
+}
+function keyBeats(candidate, incumbent) {
+  const candidateGlob = isGlob(candidate);
+  const incumbentGlob = isGlob(incumbent);
+  if (candidateGlob !== incumbentGlob) return !candidateGlob;
+  return candidate.length > incumbent.length;
+}
+
+// src/document/loosening.ts
+function looseningsOf(base, overlay, inventory) {
+  const baseKeys = Object.keys(base.rules ?? {});
+  const overlayKeys = Object.keys(overlay);
+  const out = [];
+  for (const key of overlayKeys) {
+    const verdict = loosest(overlay[key]);
+    const bases = [baseVerdict(base, baseKeys.includes(key) ? key : null)];
+    for (const tool of inventory) {
+      const names = tool.qualifiedName === void 0 ? [tool.name] : [tool.name, tool.qualifiedName];
+      if (selectKey(overlayKeys, names) === key) bases.push(baseVerdict(base, selectKey(baseKeys, names)));
+    }
+    const strictest = bases.reduce((a, b) => looser(a, b) ? b : a);
+    if (looser(verdict, strictest)) out.push({ key, verdict, base: strictest });
+  }
+  return out;
+}
+function baseVerdict(base, key) {
+  const variants = key === null ? void 0 : base.rules?.[key];
+  if (!variants) return base.default;
+  return variants.reduce((v, x) => looser(v, x.action) ? x.action : v, "allow");
+}
+function loosest(variants) {
+  return variants.reduce((v, x) => looser(x.action, v) ? x.action : v, "block");
+}
+function looser(a, b) {
+  return VERDICT_RANK[a] < VERDICT_RANK[b];
+}
+
 // src/document/portable-regex.ts
 function isPortablePattern(pattern) {
   if (typeof pattern !== "string") return false;
@@ -551,9 +627,9 @@ function isSurrogate(c) {
 }
 
 // src/document/validate.ts
-function validate(source) {
+function validate(source, inventory = []) {
   const diag = new Diagnostics();
-  const ctx = { diag, approvalDefaults: source.spec.approvalDefaults, base: source.spec.tools };
+  const ctx = { diag, approvalDefaults: source.spec.approvalDefaults, base: source.spec.tools, inventory };
   validateTargetSections(ctx, source);
   if (source.spec.approvalDefaults) validateApproval(ctx, source.spec.approvalDefaults, "/spec/approvalDefaults", true);
   validateRules(ctx, source.spec.tools.rules, "/spec/tools/rules");
@@ -646,23 +722,14 @@ function validateOverlays(ctx, overlays2, path) {
 }
 function flagLoosening(ctx, overlay, path) {
   const baseDefault = ctx.base.default;
-  if (overlay.tools?.default && looser(overlay.tools.default, baseDefault)) {
+  if (overlay.tools?.default && looser2(overlay.tools.default, baseDefault)) {
     ctx.diag.warning("loosening_grant", `${path}/tools/default`, `default ${overlay.tools.default} is looser than the base default ${baseDefault}`);
   }
-  for (const [key, variants] of Object.entries(overlay.tools?.rules ?? {})) {
-    const base = baseVerdictFor(ctx.base, key);
-    const loosest = variants.reduce((v, x) => looser(x.action, v) ? x.action : v, "block");
-    if (looser(loosest, base)) {
-      ctx.diag.warning("loosening_grant", `${path}/tools/rules/${key}`, `${key}: ${loosest} is looser than the base ${base}`);
-    }
+  for (const { key, verdict, base } of looseningsOf(ctx.base, overlay.tools?.rules ?? {}, ctx.inventory)) {
+    ctx.diag.warning("loosening_grant", `${path}/tools/rules/${key}`, `${key}: ${verdict} is looser than the base ${base}`);
   }
 }
-function baseVerdictFor(base, key) {
-  const variants = base.rules?.[key];
-  if (!variants) return base.default;
-  return variants.reduce((v, x) => looser(v, x.action) ? x.action : v, "allow");
-}
-function looser(a, b) {
+function looser2(a, b) {
   return VERDICT_RANK[a] < VERDICT_RANK[b];
 }
 function validateCapture(ctx, source) {
@@ -708,8 +775,12 @@ function overlays(map) {
   }
   return out;
 }
+
+// src/compose.ts
+var COMPOSE_INTENT_MAX = 4e3;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  COMPOSE_INTENT_MAX,
   Diagnostics,
   NEVER,
   SOURCE_OPERATORS,