@armoriq/policy-ir 0.1.4 → 0.1.6

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { P as PolicyDocument, V as Verdict, A as Approval, L as Layer, C as Condition, S as Statement, a as SourceTarget, b as PolicySource, D as Diagnostics } from './document-entry-CDOQVeis.cjs';
-export { c as Capture, d as ConditionOp, e as ConditionSpec, f as Defaults, g as Diagnostic, K as KeyTier, N as NEVER, h as NetworkEntry, O as Overlay, i as ParseResult, j as PolicySpec, k as PolicyTarget, l as Provenance, R as RuleValue, m as RuleVariant, n as SCHEMA_VERSION, o as SOURCE_OPERATORS, p as SchemaBinding, q as Severity, r as SourceOperator, s as StatementMatch, t as Subject, T as ToolsSection, u as VERDICTS, v as layerOfTarget, w as parseDocument, x as parseYaml, y as serialize, z as validate } from './document-entry-CDOQVeis.cjs';
+import { P as PolicyDocument, V as Verdict, A as Approval, L as Layer, C as Condition, S as Statement, D as Diagnostics, E as EnforceabilityReport, a as PolicySource, I as InventoryTool, b as InventoryPort } from './document-entry-iS3HikJ9.cjs';
+export { c as CAPABILITY_KEYS, d as COMPOSE_INTENT_MAX, e as Capture, f as ComposeAnswer, g as ComposeChangedCall, h as ComposeExample, i as ComposeHeldServer, j as ComposePreview, k as ComposeQuestion, l as ComposeReplay, m as ComposeRequest, n as ComposeResponse, o as ComposeTarget, p as ComposeUnsupported, q as ConditionOp, r as ConditionSpec, s as Defaults, t as Diagnostic, u as Enforceability, K as KeyTier, N as NEVER, v as NetworkEntry, O as Overlay, w as ParseResult, x as PolicySpec, y as PolicyTarget, z as Provenance, R as RuleValue, B as RuleVariant, F as SCHEMA_VERSION, G as SOURCE_OPERATORS, H as SchemaBinding, J as Section, M as Severity, Q as SourceOperator, T as SourceTarget, U as StatementMatch, W as Subject, X as ToolsSection, Y as VERDICTS, Z as enforceabilityReport, _ as layerOfTarget, $ as parseDocument, a0 as parseYaml, a1 as serialize, a2 as validate } from './document-entry-iS3HikJ9.cjs';
 
 /**
  * Canonical JSON: sorted keys, no whitespace, ASCII escapes for anything
@@ -43,6 +43,11 @@ interface Principal {
 /** One call, as the enforce path and the local hook both see it. */
 interface CallInput {
     tool: string;
+    /**
+     * The inventory's `mcp__<server>__<tool>` name for the tool the host matched,
+     * so a rule keyed by the qualified name applies to a bare-name call.
+     */
+    qualifiedName?: string;
     arguments: Record<string, unknown>;
     /**
      * Derived fields a host may supply: `path`, `program`, `command`,
@@ -98,7 +103,7 @@ interface BoundDocuments {
  * Four stages over four layers (PRD §7.4):
  *   1. floor: a floor block ends evaluation; otherwise its verdict is retained
  *   2. resolve: the member scope inside the most specific document
- *   3. candidate: member rule, then agent, then group, then the most specific tools.default
+ *   3. candidate: member rule, then agent, then group, then the stricter of the bound tools.default values
  *   4. merge: the stricter of floor and candidate
  */
 declare function evaluate(input: CallInput, bound: BoundDocuments): Evaluation;
@@ -122,47 +127,12 @@ declare function conditionsHold(input: CallInput, conditions: Condition[]): bool
 declare function conditionHolds(input: CallInput, condition: Condition): boolean;
 
 /**
- * Key selection: an exact key beats any glob, a longer glob beats a shorter
- * one. Two same-length globs matching one tool are rejected at compile time;
- * here the first in document order wins so evaluation stays deterministic.
- */
-declare function selectRuleKey(statements: Statement[], tool: string): string | null;
-
-/** One tool the target can reach, as the inventory knows it. */
-interface InventoryTool {
-    /** The wire name the model sees; for an MCP tool the host may also supply the qualified `mcp__<server>__<tool>` form as `qualifiedName`. */
-    name: string;
-    qualifiedName?: string;
-    owner: {
-        type: 'mcp_server' | 'agent' | 'local';
-        id: string;
-        name?: string;
-    };
-    schemaHash: string | null;
-    inputSchema?: unknown;
-    capabilities?: string[];
-    /** False for a row the observed feed created and no owner has declared: the compiler warns instead of binding. */
-    declared: boolean;
-}
-/** What a host implements: conmap on `tool_snapshots`, the Armor CLI on the local tool list. */
-interface InventoryPort {
-    toolsForTarget(target: SourceTarget): Promise<InventoryTool[]>;
-}
-declare const CAPABILITY_KEYS: ReadonlySet<string>;
-
-type Enforceability = 'enforced' | 'argument-only' | 'inert';
-type Section = 'tools' | 'files' | 'network' | 'skills' | 'secrets';
-/**
- * Per-section honesty (FR-9, FR-19): a local device sees real paths and
- * hosts; the enterprise SDK path sees only path-shaped and URL-shaped
- * arguments; skills and secrets have no enterprise surface at all.
+ * Key selection: a key matches the call's bare name or its qualified name.
+ * An exact key beats any glob, a longer key beats a shorter one. Two
+ * same-length globs matching one tool are rejected at compile time; here the
+ * first in document order wins so evaluation stays deterministic.
  */
-interface EnforceabilityReport {
-    sections: Partial<Record<Section, Enforceability>>;
-    /** Tools in the inventory that no capability rule reaches, when the document uses capability keys (M-12). */
-    notCoveredByCapabilityRules: string[];
-}
-declare function enforceabilityReport(source: PolicySource, inventory: InventoryTool[]): EnforceabilityReport;
+declare function selectRuleKey(statements: Statement[], call: Pick<CallInput, 'tool' | 'qualifiedName'>): string | null;
 
 interface CompileOptions {
     policyId: string;
@@ -198,4 +168,4 @@ declare function checkArgumentKeys(fields: string[], tool: InventoryTool, diag:
 
 declare const KNOWN_CONTROLS: ReadonlySet<string>;
 
-export { Approval, type BoundDocuments, CAPABILITY_KEYS, type CallInput, type CompileOptions, type CompileResult, Condition, Diagnostics, type Enforceability, type EnforceabilityReport, type Evaluation, HASH_PREFIX, type InventoryPort, type InventoryTool, KNOWN_CONTROLS, Layer, type Obligation, PolicyDocument, PolicySource, type Principal, type SchemaDriftObligation, type Section, SourceTarget, Statement, VERDICT_RANK, Verdict, type VerdictProvenance, canonicalJson, checkArgumentKeys, checkGlobCollisions, compile, compileWithPort, conditionHolds, conditionsHold, enforceabilityReport, evaluate, globToRegExp, isGlob, matchGlob, policyHash, resolveField, resolveKey, schemaHash, selectRuleKey, sha256Canonical, stricter, verifyPolicyHash };
+export { Approval, type BoundDocuments, type CallInput, type CompileOptions, type CompileResult, Condition, Diagnostics, EnforceabilityReport, type Evaluation, HASH_PREFIX, InventoryPort, InventoryTool, KNOWN_CONTROLS, Layer, type Obligation, PolicyDocument, PolicySource, type Principal, type SchemaDriftObligation, Statement, VERDICT_RANK, Verdict, type VerdictProvenance, canonicalJson, checkArgumentKeys, checkGlobCollisions, compile, compileWithPort, conditionHolds, conditionsHold, evaluate, globToRegExp, isGlob, matchGlob, policyHash, resolveField, resolveKey, schemaHash, selectRuleKey, sha256Canonical, stricter, verifyPolicyHash };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PolicyDocument, V as Verdict, A as Approval, L as Layer, C as Condition, S as Statement, a as SourceTarget, b as PolicySource, D as Diagnostics } from './document-entry-CDOQVeis.js';
-export { c as Capture, d as ConditionOp, e as ConditionSpec, f as Defaults, g as Diagnostic, K as KeyTier, N as NEVER, h as NetworkEntry, O as Overlay, i as ParseResult, j as PolicySpec, k as PolicyTarget, l as Provenance, R as RuleValue, m as RuleVariant, n as SCHEMA_VERSION, o as SOURCE_OPERATORS, p as SchemaBinding, q as Severity, r as SourceOperator, s as StatementMatch, t as Subject, T as ToolsSection, u as VERDICTS, v as layerOfTarget, w as parseDocument, x as parseYaml, y as serialize, z as validate } from './document-entry-CDOQVeis.js';
+import { P as PolicyDocument, V as Verdict, A as Approval, L as Layer, C as Condition, S as Statement, D as Diagnostics, E as EnforceabilityReport, a as PolicySource, I as InventoryTool, b as InventoryPort } from './document-entry-iS3HikJ9.js';
+export { c as CAPABILITY_KEYS, d as COMPOSE_INTENT_MAX, e as Capture, f as ComposeAnswer, g as ComposeChangedCall, h as ComposeExample, i as ComposeHeldServer, j as ComposePreview, k as ComposeQuestion, l as ComposeReplay, m as ComposeRequest, n as ComposeResponse, o as ComposeTarget, p as ComposeUnsupported, q as ConditionOp, r as ConditionSpec, s as Defaults, t as Diagnostic, u as Enforceability, K as KeyTier, N as NEVER, v as NetworkEntry, O as Overlay, w as ParseResult, x as PolicySpec, y as PolicyTarget, z as Provenance, R as RuleValue, B as RuleVariant, F as SCHEMA_VERSION, G as SOURCE_OPERATORS, H as SchemaBinding, J as Section, M as Severity, Q as SourceOperator, T as SourceTarget, U as StatementMatch, W as Subject, X as ToolsSection, Y as VERDICTS, Z as enforceabilityReport, _ as layerOfTarget, $ as parseDocument, a0 as parseYaml, a1 as serialize, a2 as validate } from './document-entry-iS3HikJ9.js';
 
 /**
  * Canonical JSON: sorted keys, no whitespace, ASCII escapes for anything
@@ -43,6 +43,11 @@ interface Principal {
 /** One call, as the enforce path and the local hook both see it. */
 interface CallInput {
     tool: string;
+    /**
+     * The inventory's `mcp__<server>__<tool>` name for the tool the host matched,
+     * so a rule keyed by the qualified name applies to a bare-name call.
+     */
+    qualifiedName?: string;
     arguments: Record<string, unknown>;
     /**
      * Derived fields a host may supply: `path`, `program`, `command`,
@@ -98,7 +103,7 @@ interface BoundDocuments {
  * Four stages over four layers (PRD §7.4):
  *   1. floor: a floor block ends evaluation; otherwise its verdict is retained
  *   2. resolve: the member scope inside the most specific document
- *   3. candidate: member rule, then agent, then group, then the most specific tools.default
+ *   3. candidate: member rule, then agent, then group, then the stricter of the bound tools.default values
  *   4. merge: the stricter of floor and candidate
  */
 declare function evaluate(input: CallInput, bound: BoundDocuments): Evaluation;
@@ -122,47 +127,12 @@ declare function conditionsHold(input: CallInput, conditions: Condition[]): bool
 declare function conditionHolds(input: CallInput, condition: Condition): boolean;
 
 /**
- * Key selection: an exact key beats any glob, a longer glob beats a shorter
- * one. Two same-length globs matching one tool are rejected at compile time;
- * here the first in document order wins so evaluation stays deterministic.
- */
-declare function selectRuleKey(statements: Statement[], tool: string): string | null;
-
-/** One tool the target can reach, as the inventory knows it. */
-interface InventoryTool {
-    /** The wire name the model sees; for an MCP tool the host may also supply the qualified `mcp__<server>__<tool>` form as `qualifiedName`. */
-    name: string;
-    qualifiedName?: string;
-    owner: {
-        type: 'mcp_server' | 'agent' | 'local';
-        id: string;
-        name?: string;
-    };
-    schemaHash: string | null;
-    inputSchema?: unknown;
-    capabilities?: string[];
-    /** False for a row the observed feed created and no owner has declared: the compiler warns instead of binding. */
-    declared: boolean;
-}
-/** What a host implements: conmap on `tool_snapshots`, the Armor CLI on the local tool list. */
-interface InventoryPort {
-    toolsForTarget(target: SourceTarget): Promise<InventoryTool[]>;
-}
-declare const CAPABILITY_KEYS: ReadonlySet<string>;
-
-type Enforceability = 'enforced' | 'argument-only' | 'inert';
-type Section = 'tools' | 'files' | 'network' | 'skills' | 'secrets';
-/**
- * Per-section honesty (FR-9, FR-19): a local device sees real paths and
- * hosts; the enterprise SDK path sees only path-shaped and URL-shaped
- * arguments; skills and secrets have no enterprise surface at all.
+ * Key selection: a key matches the call's bare name or its qualified name.
+ * An exact key beats any glob, a longer key beats a shorter one. Two
+ * same-length globs matching one tool are rejected at compile time; here the
+ * first in document order wins so evaluation stays deterministic.
  */
-interface EnforceabilityReport {
-    sections: Partial<Record<Section, Enforceability>>;
-    /** Tools in the inventory that no capability rule reaches, when the document uses capability keys (M-12). */
-    notCoveredByCapabilityRules: string[];
-}
-declare function enforceabilityReport(source: PolicySource, inventory: InventoryTool[]): EnforceabilityReport;
+declare function selectRuleKey(statements: Statement[], call: Pick<CallInput, 'tool' | 'qualifiedName'>): string | null;
 
 interface CompileOptions {
     policyId: string;
@@ -198,4 +168,4 @@ declare function checkArgumentKeys(fields: string[], tool: InventoryTool, diag:
 
 declare const KNOWN_CONTROLS: ReadonlySet<string>;
 
-export { Approval, type BoundDocuments, CAPABILITY_KEYS, type CallInput, type CompileOptions, type CompileResult, Condition, Diagnostics, type Enforceability, type EnforceabilityReport, type Evaluation, HASH_PREFIX, type InventoryPort, type InventoryTool, KNOWN_CONTROLS, Layer, type Obligation, PolicyDocument, PolicySource, type Principal, type SchemaDriftObligation, type Section, SourceTarget, Statement, VERDICT_RANK, Verdict, type VerdictProvenance, canonicalJson, checkArgumentKeys, checkGlobCollisions, compile, compileWithPort, conditionHolds, conditionsHold, enforceabilityReport, evaluate, globToRegExp, isGlob, matchGlob, policyHash, resolveField, resolveKey, schemaHash, selectRuleKey, sha256Canonical, stricter, verifyPolicyHash };
+export { Approval, type BoundDocuments, type CallInput, type CompileOptions, type CompileResult, Condition, Diagnostics, EnforceabilityReport, type Evaluation, HASH_PREFIX, InventoryPort, InventoryTool, KNOWN_CONTROLS, Layer, type Obligation, PolicyDocument, PolicySource, type Principal, type SchemaDriftObligation, Statement, VERDICT_RANK, Verdict, type VerdictProvenance, canonicalJson, checkArgumentKeys, checkGlobCollisions, compile, compileWithPort, conditionHolds, conditionsHold, evaluate, globToRegExp, isGlob, matchGlob, policyHash, resolveField, resolveKey, schemaHash, selectRuleKey, sha256Canonical, stricter, verifyPolicyHash };

package/dist/index.js

@@ -214,10 +214,13 @@ function numeric(a, e, test) {
 }
 
 // src/evaluate/select.ts
-function selectRuleKey(statements, tool) {
+function selectRuleKey(statements, call) {
+  return selectKey(ruleKeysOf(statements), call.qualifiedName === void 0 ? [call.tool] : [call.tool, call.qualifiedName]);
+}
+function selectKey(keys, names) {
   let best = null;
-  for (const key of ruleKeysOf(statements)) {
-    if (!keyMatches(key, tool)) continue;
+  for (const key of keys) {
+    if (!names.some((name) => keyMatches(key, name))) continue;
     if (best === null || keyBeats(key, best)) best = key;
   }
   return best;
@@ -279,7 +282,7 @@ function decideLayer(statements, input) {
   return stricter(capability.statement.effect, ruleDecision.statement.effect) === ruleDecision.statement.effect ? ruleDecision : capability;
 }
 function decideRule(statements, input) {
-  const key = selectRuleKey(statements, input.tool);
+  const key = selectRuleKey(statements, input);
   if (key === null) return null;
   const winner = variantsOf(statements, key).find((v) => conditionsHold(input, v.conditions));
   return winner ? { statement: winner, obligations: driftObligations(winner, input) } : null;
@@ -307,11 +310,12 @@ function driftObligations(statement, input) {
 
 // src/evaluate/evaluate.ts
 function evaluate(input, bound) {
+  if (!bound.floor && !bound.group && !bound.agent) throw new Error("evaluate: no document is bound to the target");
   const floor2 = decideFloor(bound.floor, input);
   if (floor2?.statement.effect === "block") return fromDecision(floor2, bound.floor, "floor");
-  const candidate = decideCandidate(input, bound);
+  const candidate = decideCandidate(input, bound, floor2 === null);
   const floorVerdict = floor2?.statement.effect ?? null;
-  if (floorVerdict && stricter(floorVerdict, candidate.verdict) !== candidate.verdict) {
+  if (!candidate || floorVerdict && stricter(floorVerdict, candidate.verdict) !== candidate.verdict) {
     return { ...fromDecision(floor2, bound.floor, "floor"), floorVerdict };
   }
   return { ...candidate, floorVerdict };
@@ -320,21 +324,28 @@ function decideFloor(doc, input) {
   if (!doc) return null;
   return decideLayer(liveStatements(doc, input).filter((s) => s.subject === null), input);
 }
-function decideCandidate(input, bound) {
-  for (const doc of [bound.agent, bound.group]) {
-    if (!doc) continue;
-    const statements = liveStatements(doc, input);
+function decideCandidate(input, bound, floorSilent) {
+  for (const doc2 of [bound.agent, bound.group]) {
+    if (!doc2) continue;
+    const statements = liveStatements(doc2, input);
     const member = decideLayer(memberScope(statements, input.member), input);
-    if (member) return fromDecision(member, doc, "member");
+    if (member) return fromDecision(member, doc2, "member");
     const own = decideLayer(statements.filter((s) => s.subject === null), input);
-    if (own) return fromDecision(own, doc, doc.layer);
+    if (own) return fromDecision(own, doc2, doc2.layer);
   }
-  return fromDefault(mostSpecific(bound));
+  const doc = defaultDocument(bound, floorSilent, input.timestamp);
+  return doc ? fromDefault(doc) : null;
 }
-function mostSpecific(bound) {
-  const doc = bound.agent ?? bound.group ?? bound.floor;
-  if (!doc) throw new Error("evaluate: no document is bound to the target");
-  return doc;
+function defaultDocument(bound, floorSilent, timestamp) {
+  const all = [bound.agent, bound.group, bound.floor].filter((d) => d !== void 0);
+  const live = all.filter((d) => isLive(d.expiresAt, timestamp));
+  if (live.length === 0) return all[0] ?? null;
+  let winner = null;
+  for (const doc of live) {
+    if (doc === bound.floor && !floorSilent) continue;
+    if (!winner || stricter(winner.defaults.tools, doc.defaults.tools) !== winner.defaults.tools) winner = doc;
+  }
+  return winner;
 }
 function fromDecision(decision, doc, layer) {
   const { statement } = decision;
@@ -360,7 +371,7 @@ function fromDefault(doc) {
   return {
     verdict,
     floorVerdict: null,
-    approval: null,
+    approval: verdict === "hold" ? doc.defaults.approval ?? null : null,
     obligations: [],
     provenance: { policyId: doc.policyId, statementId: null, ruleKey: "tools.default", variant: -1, layer: doc.layer }
   };
@@ -769,6 +780,35 @@ function parseCapture(r, value) {
   return out;
 }
 
+// src/document/loosening.ts
+function looseningsOf(base, overlay, inventory) {
+  const baseKeys = Object.keys(base.rules ?? {});
+  const overlayKeys = Object.keys(overlay);
+  const out = [];
+  for (const key of overlayKeys) {
+    const verdict = loosest(overlay[key]);
+    const bases = [baseVerdict(base, baseKeys.includes(key) ? key : null)];
+    for (const tool of inventory) {
+      const names = tool.qualifiedName === void 0 ? [tool.name] : [tool.name, tool.qualifiedName];
+      if (selectKey(overlayKeys, names) === key) bases.push(baseVerdict(base, selectKey(baseKeys, names)));
+    }
+    const strictest = bases.reduce((a, b) => looser(a, b) ? b : a);
+    if (looser(verdict, strictest)) out.push({ key, verdict, base: strictest });
+  }
+  return out;
+}
+function baseVerdict(base, key) {
+  const variants = key === null ? void 0 : base.rules?.[key];
+  if (!variants) return base.default;
+  return variants.reduce((v, x) => looser(v, x.action) ? x.action : v, "allow");
+}
+function loosest(variants) {
+  return variants.reduce((v, x) => looser(x.action, v) ? x.action : v, "block");
+}
+function looser(a, b) {
+  return VERDICT_RANK[a] < VERDICT_RANK[b];
+}
+
 // src/document/portable-regex.ts
 function isPortablePattern(pattern) {
   if (typeof pattern !== "string") return false;
@@ -883,9 +923,9 @@ function isSurrogate(c) {
 }
 
 // src/document/validate.ts
-function validate(source) {
+function validate(source, inventory = []) {
   const diag = new Diagnostics();
-  const ctx = { diag, approvalDefaults: source.spec.approvalDefaults, base: source.spec.tools };
+  const ctx = { diag, approvalDefaults: source.spec.approvalDefaults, base: source.spec.tools, inventory };
   validateTargetSections(ctx, source);
   if (source.spec.approvalDefaults) validateApproval(ctx, source.spec.approvalDefaults, "/spec/approvalDefaults", true);
   validateRules(ctx, source.spec.tools.rules, "/spec/tools/rules");
@@ -978,23 +1018,14 @@ function validateOverlays(ctx, overlays2, path) {
 }
 function flagLoosening(ctx, overlay, path) {
   const baseDefault = ctx.base.default;
-  if (overlay.tools?.default && looser(overlay.tools.default, baseDefault)) {
+  if (overlay.tools?.default && looser2(overlay.tools.default, baseDefault)) {
     ctx.diag.warning("loosening_grant", `${path}/tools/default`, `default ${overlay.tools.default} is looser than the base default ${baseDefault}`);
   }
-  for (const [key, variants] of Object.entries(overlay.tools?.rules ?? {})) {
-    const base = baseVerdictFor(ctx.base, key);
-    const loosest = variants.reduce((v, x) => looser(x.action, v) ? x.action : v, "block");
-    if (looser(loosest, base)) {
-      ctx.diag.warning("loosening_grant", `${path}/tools/rules/${key}`, `${key}: ${loosest} is looser than the base ${base}`);
-    }
+  for (const { key, verdict, base } of looseningsOf(ctx.base, overlay.tools?.rules ?? {}, ctx.inventory)) {
+    ctx.diag.warning("loosening_grant", `${path}/tools/rules/${key}`, `${key}: ${verdict} is looser than the base ${base}`);
   }
 }
-function baseVerdictFor(base, key) {
-  const variants = base.rules?.[key];
-  if (!variants) return base.default;
-  return variants.reduce((v, x) => looser(v, x.action) ? x.action : v, "allow");
-}
-function looser(a, b) {
+function looser2(a, b) {
   return VERDICT_RANK[a] < VERDICT_RANK[b];
 }
 function validateCapture(ctx, source) {
@@ -1036,11 +1067,11 @@ function resolveKey(key, inventory, diag, path) {
 }
 function bindExact(key, tool, diag, path) {
   if (!tool) {
-    diag.warning("unknown_tool_key", path, `"${key}" is not in the target's inventory; the rule compiles and binds nothing until the tool appears`);
+    diag.warning("unknown_tool_key", path, `"${key}" is not in the target's inventory yet; the rule is enforced on any call that names it, but its conditions are not checked against a schema`);
     return null;
   }
   if (!tool.declared) {
-    diag.warning("observed_only_tool", path, `"${key}" has only been observed, never declared; the rule compiles without a schema binding`);
+    diag.warning("observed_only_tool", path, `"${key}" has been observed but never declared; the rule is enforced on any call that names it, but its conditions are not checked against a schema`);
     return null;
   }
   return tool;
@@ -1348,13 +1379,15 @@ function uncovered(source, inventory) {
 
 // src/compile/compile.ts
 function compile(source, inventory, options) {
-  const diag = validate(source);
+  const diag = validate(source, inventory);
   const report = enforceabilityReport(source, inventory);
   if (diag.hasErrors) return { document: null, diagnostics: diag, report };
   const layer = layerOfTarget(targetOf2(source.target));
   const ctx = { inventory, diag, layer, approvalDefaults: source.spec.approvalDefaults, source: options.source ?? "yaml" };
   checkGlobCollisions(Object.keys(source.spec.tools.rules ?? {}), inventory, diag, "/spec/tools/rules");
-  checkDeviceFirst(source, diag);
+  checkOverlayGlobCollisions(source.spec.members, inventory, diag, "/spec/members");
+  checkOverlayGlobCollisions(source.spec.products, inventory, diag, "/spec/products");
+  checkDeviceFirst(source, inventory, diag);
   const statements = [
     ...lowerRules(source.spec.tools.rules, ctx, "/spec/tools/rules", null, source.spec.expiresAt),
     ...lowerFloors(source.spec, ctx),
@@ -1390,7 +1423,8 @@ function defaultsOf(source) {
     tools: source.spec.tools.default,
     network: source.spec.network?.default ?? "block",
     files: "allow",
-    skills: source.spec.skills?.default ?? "allow"
+    skills: source.spec.skills?.default ?? "allow",
+    ...source.spec.approvalDefaults ? { approval: source.spec.approvalDefaults } : {}
   };
 }
 function captureOf(source) {
@@ -1402,24 +1436,19 @@ function captureOf(source) {
     sample: c?.sample ?? 1
   };
 }
-function checkDeviceFirst(source, diag) {
+function checkOverlayGlobCollisions(overlays2, inventory, diag, path) {
+  for (const [key, overlay] of Object.entries(overlays2 ?? {})) {
+    checkGlobCollisions(Object.keys(overlay.tools?.rules ?? {}), inventory, diag, `${path}/${key}/tools/rules`);
+  }
+}
+function checkDeviceFirst(source, inventory, diag) {
   if (!("device" in source.target) || source.precedence === "agent-first") return;
   for (const [product, overlay] of Object.entries(source.spec.products ?? {})) {
-    for (const [key, variants] of Object.entries(overlay.tools?.rules ?? {})) {
-      if (loosensBase(variants, baseRankFor(source, key))) {
-        diag.error("device_first_loosening", `/spec/products/${product}/tools/rules/${key}`, `under device-first a product overlay may only tighten the base; set precedence: agent-first to allow this`);
-      }
+    for (const { key } of looseningsOf(source.spec.tools, overlay.tools?.rules ?? {}, inventory)) {
+      diag.error("device_first_loosening", `/spec/products/${product}/tools/rules/${key}`, `under device-first a product overlay may only tighten the base; set precedence: agent-first to allow this`);
     }
   }
 }
-function baseRankFor(source, key) {
-  const base = source.spec.tools.rules?.[key];
-  if (!Array.isArray(base)) return VERDICT_RANK[source.spec.tools.default];
-  return Math.min(...base.map((v) => VERDICT_RANK[v.action]));
-}
-function loosensBase(variants, baseRank) {
-  return variants.some((v) => VERDICT_RANK[v.action] < baseRank);
-}
 
 // src/compile/serialize.ts
 import { stringify } from "yaml";
@@ -1455,8 +1484,12 @@ function overlays(map) {
   }
   return out;
 }
+
+// src/compose.ts
+var COMPOSE_INTENT_MAX = 1e5;
 export {
   CAPABILITY_KEYS,
+  COMPOSE_INTENT_MAX,
   Diagnostics,
   HASH_PREFIX,
   KNOWN_CONTROLS,