@astrale-os/kernel-core 0.4.1

package/dist/auth/expression/scope.d.ts

@@ -0,0 +1,81 @@
+/**
+ * AUTH_V2 Scope Utilities
+ *
+ * Proper scope intersection logic.
+ * Scopes can only be made MORE restrictive, never less.
+ */
+import type { FilterDetail } from '#auth/access';
+import type { Permission } from '#auth/permissions';
+import type { IdentityId } from '#ids';
+import type { IdentityExpr, Scope } from './types';
+/**
+ * Intersect two individual scopes.
+ * Returns the most restrictive combination of both.
+ *
+ * Each dimension (nodes, perms, principals) is intersected:
+ * - nodes/principals: undefined = unrestricted, [] = nothing allowed
+ * - perms: undefined = unrestricted, 0 = nothing allowed, positive = these bits
+ *
+ * Returns null if the intersection is impossible (would allow nothing).
+ */
+export declare function intersectScope(a: Scope, b: Scope): Scope | null;
+/**
+ * Intersect two scope arrays.
+ *
+ * Multiple scopes are OR'd (any scope passing = access granted).
+ * Intersection of two scope arrays = for each pair, compute intersection,
+ * keep only valid (non-null) results.
+ *
+ * Empty array = deny-all (no scope satisfies access). This matches
+ * `checkFilter` semantics, where `[]` is the encoding for "all
+ * intersections were impossible". Composing deny-all with any other
+ * scope set must remain deny-all — otherwise a previously-impossible
+ * branch is silently widened back to its sibling's scopes.
+ *
+ * The undefined/no-scopes case ("unrestricted") is encoded with
+ * `Scope[] | undefined` at call sites; consumers like `checkFilter`
+ * branch on `scopes === undefined` before calling here.
+ *
+ * @param a First scope array (OR'd together)
+ * @param b Second scope array (OR'd together)
+ * @returns Intersection of scopes (also OR'd together); `[]` when
+ *          either input is `[]` or no scope pair has a non-null intersection.
+ */
+export declare function intersectScopes(a: Scope[], b: Scope[]): Scope[];
+/**
+ * Check if a single scope allows the given principal and perm.
+ * Rich version that returns the failed check reason.
+ */
+export declare function scopePasses(scope: Scope, principal: IdentityId | undefined, perm: Permission): {
+    passes: boolean;
+    failedCheck?: 'principal' | 'perm';
+};
+/**
+ * Check scope filter for cold path (returns FilterDetail[]).
+ *
+ * Distinguishes three cases:
+ * - undefined: no scopes at all → unrestricted (allowed)
+ * - []: all scope intersections were impossible → denied
+ * - non-empty: evaluate each scope against principal + perm
+ */
+export declare function checkFilter(scopes: Scope[] | undefined, principal: IdentityId | undefined, perm: Permission): {
+    allowed: boolean;
+    details?: FilterDetail[];
+    applicableScopes?: Scope[];
+};
+/**
+ * Wrap an expression in a scope node.
+ *
+ * @param expr - The expression to wrap
+ * @param scope - The scope to apply
+ */
+export declare function applyScope(expr: IdentityExpr, scope: Scope): IdentityExpr;
+/**
+ * Wrap an expression in a scope node with multiple scopes.
+ * Used by the auth layer to narrow delegated expressions.
+ *
+ * @param expr - The expression to narrow
+ * @param scopes - Scopes to apply (OR'd together)
+ */
+export declare function applyTopLevelScopes(expr: IdentityExpr, scopes: Scope[]): IdentityExpr;
+//# sourceMappingURL=scope.d.ts.map

package/dist/auth/expression/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../auth/expression/scope.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,mBAAmB,CAAA;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAmClD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAiB/D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAqB/D;AAkBD;;;GAGG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,UAAU,GAAG,SAAS,EACjC,IAAI,EAAE,UAAU,GACf;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAWzD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,EAC3B,SAAS,EAAE,UAAU,GAAG,SAAS,EACjC,IAAI,EAAE,UAAU,GACf;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAA;CAAE,CAyB5E;AAMD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,YAAY,CAEzE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAGrF"}

package/dist/auth/expression/scope.js

@@ -0,0 +1,192 @@
+/**
+ * AUTH_V2 Scope Utilities
+ *
+ * Proper scope intersection logic.
+ * Scopes can only be made MORE restrictive, never less.
+ */
+// =============================================================================
+// SCOPE INTERSECTION
+// =============================================================================
+/**
+ * Intersect two arrays, returning elements present in both.
+ * undefined means "unrestricted" - the other array wins.
+ * Empty array means "nothing allowed".
+ */
+function intersectArrays(a, b) {
+    if (a === undefined && b === undefined)
+        return undefined;
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    const setB = new Set(b);
+    return a.filter((x) => setB.has(x));
+}
+/**
+ * Intersect two permission masks.
+ * undefined means "unrestricted" — the other mask wins.
+ * 0 means "nothing allowed".
+ */
+function intersectPermsMask(a, b) {
+    if (a === undefined && b === undefined)
+        return undefined;
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    return (a & b);
+}
+/**
+ * Intersect two individual scopes.
+ * Returns the most restrictive combination of both.
+ *
+ * Each dimension (nodes, perms, principals) is intersected:
+ * - nodes/principals: undefined = unrestricted, [] = nothing allowed
+ * - perms: undefined = unrestricted, 0 = nothing allowed, positive = these bits
+ *
+ * Returns null if the intersection is impossible (would allow nothing).
+ */
+export function intersectScope(a, b) {
+    const nodes = intersectArrays(a.nodes, b.nodes);
+    const perms = intersectPermsMask(a.perms, b.perms);
+    const principals = intersectArrays(a.principals, b.principals);
+    // If any dimension allows nothing, the scope is impossible
+    if (nodes?.length === 0 || perms === 0 || principals?.length === 0) {
+        return null;
+    }
+    // Build result, omitting undefined dimensions
+    const result = {};
+    if (nodes !== undefined)
+        result.nodes = nodes;
+    if (perms !== undefined)
+        result.perms = perms;
+    if (principals !== undefined)
+        result.principals = principals;
+    return result;
+}
+/**
+ * Intersect two scope arrays.
+ *
+ * Multiple scopes are OR'd (any scope passing = access granted).
+ * Intersection of two scope arrays = for each pair, compute intersection,
+ * keep only valid (non-null) results.
+ *
+ * Empty array = deny-all (no scope satisfies access). This matches
+ * `checkFilter` semantics, where `[]` is the encoding for "all
+ * intersections were impossible". Composing deny-all with any other
+ * scope set must remain deny-all — otherwise a previously-impossible
+ * branch is silently widened back to its sibling's scopes.
+ *
+ * The undefined/no-scopes case ("unrestricted") is encoded with
+ * `Scope[] | undefined` at call sites; consumers like `checkFilter`
+ * branch on `scopes === undefined` before calling here.
+ *
+ * @param a First scope array (OR'd together)
+ * @param b Second scope array (OR'd together)
+ * @returns Intersection of scopes (also OR'd together); `[]` when
+ *          either input is `[]` or no scope pair has a non-null intersection.
+ */
+export function intersectScopes(a, b) {
+    // Empty array = deny-all. Composing with anything stays deny-all.
+    if (a.length === 0 || b.length === 0)
+        return [];
+    const seen = new Set();
+    const results = [];
+    for (const scopeA of a) {
+        for (const scopeB of b) {
+            const intersection = intersectScope(scopeA, scopeB);
+            if (intersection !== null) {
+                const key = scopeToKey(intersection);
+                if (!seen.has(key)) {
+                    seen.add(key);
+                    results.push(intersection);
+                }
+            }
+        }
+    }
+    return results;
+}
+/**
+ * Create a deterministic string key for a scope (for deduplication).
+ * Uses JSON.stringify to avoid collisions from delimiter characters in IDs.
+ */
+function scopeToKey(scope) {
+    return JSON.stringify({
+        n: scope.nodes ? [...scope.nodes].sort() : null,
+        p: scope.perms ?? null,
+        r: scope.principals ? [...scope.principals].sort() : null,
+    });
+}
+// =============================================================================
+// RICH SCOPE CHECKS (used by pruning phase)
+// =============================================================================
+/**
+ * Check if a single scope allows the given principal and perm.
+ * Rich version that returns the failed check reason.
+ */
+export function scopePasses(scope, principal, perm) {
+    if (scope.principals !== undefined &&
+        (scope.principals.length === 0 || !principal || !scope.principals.includes(principal))) {
+        return { passes: false, failedCheck: 'principal' };
+    }
+    if (scope.perms !== undefined && (scope.perms & perm) === 0) {
+        return { passes: false, failedCheck: 'perm' };
+    }
+    return { passes: true };
+}
+/**
+ * Check scope filter for cold path (returns FilterDetail[]).
+ *
+ * Distinguishes three cases:
+ * - undefined: no scopes at all → unrestricted (allowed)
+ * - []: all scope intersections were impossible → denied
+ * - non-empty: evaluate each scope against principal + perm
+ */
+export function checkFilter(scopes, principal, perm) {
+    if (scopes === undefined) {
+        return { allowed: true, applicableScopes: [] };
+    }
+    if (scopes.length === 0) {
+        return { allowed: false, details: [] };
+    }
+    const details = [];
+    const applicableScopes = [];
+    for (let i = 0; i < scopes.length; i++) {
+        const result = scopePasses(scopes[i], principal, perm);
+        if (result.passes) {
+            applicableScopes.push(scopes[i]);
+        }
+        else {
+            details.push({ scopeIndex: i, failedCheck: result.failedCheck });
+        }
+    }
+    if (applicableScopes.length > 0) {
+        return { allowed: true, applicableScopes };
+    }
+    return { allowed: false, details };
+}
+// =============================================================================
+// EXPRESSION TREE SCOPE OPERATIONS
+// =============================================================================
+/**
+ * Wrap an expression in a scope node.
+ *
+ * @param expr - The expression to wrap
+ * @param scope - The scope to apply
+ */
+export function applyScope(expr, scope) {
+    return { kind: 'scope', scopes: [scope], expr };
+}
+/**
+ * Wrap an expression in a scope node with multiple scopes.
+ * Used by the auth layer to narrow delegated expressions.
+ *
+ * @param expr - The expression to narrow
+ * @param scopes - Scopes to apply (OR'd together)
+ */
+export function applyTopLevelScopes(expr, scopes) {
+    if (scopes.length === 0)
+        return expr;
+    return { kind: 'scope', scopes, expr };
+}
+//# sourceMappingURL=scope.js.map

package/dist/auth/expression/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../auth/expression/scope.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;GAIG;AACH,SAAS,eAAe,CAAI,CAAkB,EAAE,CAAkB;IAChE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,CAA6B,EAC7B,CAA6B;IAE7B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAC,GAAG,CAAC,CAAmB,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,CAAQ,EAAE,CAAQ;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAE9D,2DAA2D;IAC3D,IAAI,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,UAAU,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GAAU,EAAE,CAAA;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;IAE5D,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,kEAAkE;IAClE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAY,EAAE,CAAA;IAE3B,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACnD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;gBACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBACb,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,KAAY;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QAC/C,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QACtB,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC,CAAA;AACJ,CAAC;AAED,gFAAgF;AAChF,4CAA4C;AAC5C,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,KAAY,EACZ,SAAiC,EACjC,IAAgB;IAEhB,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;QAC9B,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EACtF,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,MAA2B,EAC3B,SAAiC,EACjC,IAAgB;IAEhB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACxC,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAA;IAClC,MAAM,gBAAgB,GAAY,EAAE,CAAA;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QACvD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAY,EAAE,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;IAC5C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC;AAED,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAkB,EAAE,KAAY;IACzD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAkB,EAAE,MAAe;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACxC,CAAC"}

package/dist/auth/expression/types.d.ts

@@ -0,0 +1,122 @@
+import type { CredentialInput } from '#auth/credentials';
+import type { PermissionMask } from '#auth/permissions';
+import type { IdentityId, NodeId } from '#ids';
+export type Scope = {
+    nodes?: NodeId[];
+    perms?: PermissionMask;
+    principals?: IdentityId[];
+};
+/**
+ * Expression tree for identity composition.
+ *
+ * - identity: leaf node representing a single identity
+ * - scope: wraps an expression with scope restrictions (scopes are OR'd)
+ * - union: OR of N expressions (A ∪ B ∪ C)
+ * - intersect: AND of N expressions (A ∩ B ∩ C)
+ * - exclude: set difference — base minus all excluded (base \ (e1 ∪ e2 ∪ ...))
+ *
+ * Scope nodes enable principal/perm filtering during pruning.
+ * Pruning evaluates scope nodes and propagates node restrictions
+ * to identity leaves, producing a PrunedIdentityExpr.
+ */
+export type IdentityExpr = {
+    kind: 'identity';
+    id: IdentityId;
+} | {
+    kind: 'scope';
+    scopes: Scope[];
+    expr: IdentityExpr;
+} | {
+    kind: 'union';
+    operands: IdentityExpr[];
+} | {
+    kind: 'intersect';
+    operands: IdentityExpr[];
+} | {
+    kind: 'exclude';
+    base: IdentityExpr;
+    excluded: IdentityExpr[];
+};
+/**
+ * Unresolved identity expression (before kernel resolution).
+ *
+ * Client-side expressions reference identities by plain ID.
+ * Credential-based identity resolution is handled separately via a kernel operation/syscall.
+ *
+ * Structure mirrors resolved IdentityExpr.
+ */
+export type UnresolvedIdentityExpr = {
+    kind: 'identity';
+    self: true;
+} | {
+    kind: 'identity';
+    credential: CredentialInput;
+} | {
+    kind: 'scope';
+    scopes: Scope[];
+    expr: UnresolvedIdentityExpr;
+} | {
+    kind: 'union';
+    operands: UnresolvedIdentityExpr[];
+} | {
+    kind: 'intersect';
+    operands: UnresolvedIdentityExpr[];
+} | {
+    kind: 'exclude';
+    base: UnresolvedIdentityExpr;
+    excluded: UnresolvedIdentityExpr[];
+};
+/**
+ * Self identity expression.
+ */
+export type SelfIdentityExpr = {
+    kind: 'identity';
+    self: true;
+} | {
+    kind: 'scope';
+    scopes: Scope[];
+    expr: SelfIdentityExpr;
+} | {
+    kind: 'union';
+    operands: SelfIdentityExpr[];
+} | {
+    kind: 'intersect';
+    operands: SelfIdentityExpr[];
+} | {
+    kind: 'exclude';
+    base: SelfIdentityExpr;
+    excluded: SelfIdentityExpr[];
+};
+/**
+ * Expression tree after scope evaluation (pruning phase output).
+ *
+ * No 'scope' kind — all scopes have been evaluated:
+ * - principal/perm restrictions pruned dead branches (null → algebraic simplification)
+ * - node restrictions propagated to identity leaves as nodeRestriction
+ *
+ * Each identity leaf carries its own nodeRestriction (intersection of
+ * ancestor scope nodes). undefined = unrestricted, NodeId[] = must be
+ * descendant of at least one of these nodes.
+ *
+ * Algebraic simplifications applied during pruning:
+ * - A ∪ ∅ = A (filter null from union operands)
+ * - A ∩ ∅ = ∅ (any null in intersect → whole thing null)
+ * - ∅ \ A = ∅ (null base → null)
+ * - A \ ∅ = A (null excluded → drop it)
+ */
+export type PrunedIdentityExpr = {
+    kind: 'identity';
+    id: IdentityId;
+    nodeRestriction?: NodeId[];
+} | {
+    kind: 'union';
+    operands: PrunedIdentityExpr[];
+} | {
+    kind: 'intersect';
+    operands: PrunedIdentityExpr[];
+} | {
+    kind: 'exclude';
+    base: PrunedIdentityExpr;
+    excluded: PrunedIdentityExpr[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/expression/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/expression/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAI9C,MAAM,MAAM,KAAK,GAAG;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,UAAU,CAAC,EAAE,UAAU,EAAE,CAAA;CAC1B,CAAA;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAAA;AAIrE;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,IAAI,EAAE,sBAAsB,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAA;CAAE,CAAA;AAIzF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAA;AAI7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAAA"}

package/dist/auth/expression/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/expression/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/expression/types.ts"],"names":[],"mappings":""}

package/dist/auth/expression/validation.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Input Validation for Authorization
+ *
+ * Validates expression trees, Cypher identifiers, scopes, and access check inputs.
+ * Pure functions, no I/O.
+ */
+import type { Grant } from '#auth/grants';
+import type { Permission } from '#auth/permissions';
+import type { NodeId } from '#ids';
+import { validatePermission, validatePermissionMask } from '#auth/permissions';
+import type { IdentityExpr, Scope } from './types';
+export { validatePermission, validatePermissionMask };
+/**
+ * Validate a string is safe for Cypher interpolation.
+ * Throws if validation fails.
+ */
+export declare function validateCypherId(value: string, fieldName: string): void;
+/**
+ * Exhaustive check helper - throws if an unknown expression kind is encountered.
+ */
+export declare function throwExhaustiveCheck(expr: never): never;
+/**
+ * Validate all IDs in a scope array.
+ */
+export declare function validateScopes(scopes: Scope[] | undefined): void;
+export declare const MAX_EXPRESSION_DEPTH = 100;
+export declare function validateExpression(expr: IdentityExpr, depth?: number): void;
+/**
+ * Validate all inputs for an access check.
+ *
+ * Path values are validated at parse time and so do not need separate
+ * Cypher-id validation here.
+ */
+export declare function validateAccessInputs(grant: Grant, perm: Permission, principal: NodeId): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/expression/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../auth/expression/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAElC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,CAAA;AAarD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUvE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAEvD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,GAAG,IAAI,CAiBhE;AAED,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,MAAU,GAAG,IAAI,CAqC9E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAI5F"}

package/dist/auth/expression/validation.js

@@ -0,0 +1,108 @@
+/**
+ * Input Validation for Authorization
+ *
+ * Validates expression trees, Cypher identifiers, scopes, and access check inputs.
+ * Pure functions, no I/O.
+ */
+import { validatePermission, validatePermissionMask } from '#auth/permissions';
+export { validatePermission, validatePermissionMask };
+// =============================================================================
+// INPUT VALIDATION (Security: Cypher Injection Prevention)
+// =============================================================================
+/**
+ * Regex for safe Cypher identifiers.
+ * Allows: alphanumeric, underscore, hyphen, colon (for namespaced IDs)
+ * Max length: 256 chars to prevent DoS
+ */
+const SAFE_ID_REGEX = /^[a-zA-Z0-9_:-]{1,256}$/;
+/**
+ * Validate a string is safe for Cypher interpolation.
+ * Throws if validation fails.
+ */
+export function validateCypherId(value, fieldName) {
+    if (typeof value !== 'string') {
+        throw new Error(`${fieldName} must be a string`);
+    }
+    if (value.length > 256 || !SAFE_ID_REGEX.test(value)) {
+        const preview = value.length > 50 ? value.slice(0, 50) + '...' : value;
+        throw new Error(`Invalid ${fieldName}: "${preview}" must contain only alphanumeric characters, underscores, hyphens, and colons (max 256 chars)`);
+    }
+}
+/**
+ * Exhaustive check helper - throws if an unknown expression kind is encountered.
+ */
+export function throwExhaustiveCheck(expr) {
+    throw new Error(`Unknown expression kind: ${expr.kind}`);
+}
+/**
+ * Validate all IDs in a scope array.
+ */
+export function validateScopes(scopes) {
+    if (!scopes)
+        return;
+    for (const scope of scopes) {
+        if (scope.nodes) {
+            for (const nodeId of scope.nodes) {
+                validateCypherId(nodeId, 'scope node ID');
+            }
+        }
+        if (scope.principals) {
+            for (const principalId of scope.principals) {
+                validateCypherId(principalId, 'scope principal ID');
+            }
+        }
+        if (scope.perms !== undefined) {
+            validatePermissionMask(scope.perms);
+        }
+    }
+}
+export const MAX_EXPRESSION_DEPTH = 100;
+export function validateExpression(expr, depth = 0) {
+    if (depth > MAX_EXPRESSION_DEPTH) {
+        throw new Error(`Expression tree exceeds maximum depth of ${MAX_EXPRESSION_DEPTH}`);
+    }
+    switch (expr.kind) {
+        case 'identity':
+            validateCypherId(expr.id, 'identity ID');
+            break;
+        case 'scope':
+            if (!expr.scopes || expr.scopes.length === 0) {
+                throw new Error('Scope node must have at least one scope');
+            }
+            validateScopes(expr.scopes);
+            validateExpression(expr.expr, depth + 1);
+            break;
+        case 'union':
+        case 'intersect':
+            if (!expr.operands || expr.operands.length < 2) {
+                throw new Error(`${expr.kind} must have at least 2 operands`);
+            }
+            for (const operand of expr.operands) {
+                validateExpression(operand, depth + 1);
+            }
+            break;
+        case 'exclude':
+            validateExpression(expr.base, depth + 1);
+            if (!expr.excluded || expr.excluded.length < 1) {
+                throw new Error('exclude must have at least 1 excluded operand');
+            }
+            for (const excluded of expr.excluded) {
+                validateExpression(excluded, depth + 1);
+            }
+            break;
+        default:
+            throwExhaustiveCheck(expr);
+    }
+}
+/**
+ * Validate all inputs for an access check.
+ *
+ * Path values are validated at parse time and so do not need separate
+ * Cypher-id validation here.
+ */
+export function validateAccessInputs(grant, perm, principal) {
+    validatePermission(perm);
+    validateCypherId(principal, 'principal');
+    validateExpression(grant.expr);
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/expression/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../auth/expression/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAI9E,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,CAAA;AAErD,gFAAgF;AAChF,2DAA2D;AAC3D,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,aAAa,GAAG,yBAAyB,CAAA;AAE/C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,SAAiB;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAA;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;QACtE,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,MAAM,OAAO,+FAA+F,CACjI,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAW;IAC9C,MAAM,IAAI,KAAK,CAAC,4BAA6B,IAAyB,CAAC,IAAI,EAAE,CAAC,CAAA;AAChF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAA2B;IACxD,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC3C,gBAAgB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,MAAM,UAAU,kBAAkB,CAAC,IAAkB,EAAE,KAAK,GAAW,CAAC;IACtE,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,oBAAoB,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAA;YACxC,MAAK;QACP,KAAK,OAAO;YACV,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YAC5D,CAAC;YACD,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACxC,MAAK;QACP,KAAK,OAAO,CAAC;QACb,KAAK,WAAW;YACd,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,gCAAgC,CAAC,CAAA;YAC/D,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,kBAAkB,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACxC,CAAC;YACD,MAAK;QACP,KAAK,SAAS;YACZ,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;YAClE,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACzC,CAAC;YACD,MAAK;QACP;YACE,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAY,EAAE,IAAgB,EAAE,SAAiB;IACpF,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACxB,gBAAgB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACxC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AAChC,CAAC"}

package/dist/auth/expression/zod.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Zod schemas for identity expression trees.
+ *
+ * Bridges the existing runtime assertion (`validateUnresolvedExpr` in
+ * `grant-decoder.ts`) into a Zod schema so it can be used in ParamShape
+ * declarations on syscalls that accept expression params.
+ *
+ * Two schemas:
+ * - `unresolvedIdentityExprSchema` — accepts the full grammar including
+ *   `Cred(...)` leaves. Use for delegation params.
+ * - `selfIdentityExprSchema` — narrower; rejects any `credential` leaf in
+ *   the tree. Use for attestation and any field that must not chain
+ *   credentials through other identities.
+ */
+import { z } from 'zod';
+import type { SelfIdentityExpr, UnresolvedIdentityExpr } from './types';
+export declare const unresolvedIdentityExprSchema: z.ZodCustom<UnresolvedIdentityExpr, UnresolvedIdentityExpr>;
+export declare const selfIdentityExprSchema: z.ZodCustom<SelfIdentityExpr, SelfIdentityExpr>;
+//# sourceMappingURL=zod.d.ts.map

package/dist/auth/expression/zod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod.d.ts","sourceRoot":"","sources":["../../../auth/expression/zod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA;AAyBvE,eAAO,MAAM,4BAA4B,6DAUxC,CAAA;AAED,eAAO,MAAM,sBAAsB,iDAWlC,CAAA"}

package/dist/auth/expression/zod.js

@@ -0,0 +1,58 @@
+/**
+ * Zod schemas for identity expression trees.
+ *
+ * Bridges the existing runtime assertion (`validateUnresolvedExpr` in
+ * `grant-decoder.ts`) into a Zod schema so it can be used in ParamShape
+ * declarations on syscalls that accept expression params.
+ *
+ * Two schemas:
+ * - `unresolvedIdentityExprSchema` — accepts the full grammar including
+ *   `Cred(...)` leaves. Use for delegation params.
+ * - `selfIdentityExprSchema` — narrower; rejects any `credential` leaf in
+ *   the tree. Use for attestation and any field that must not chain
+ *   credentials through other identities.
+ */
+import { z } from 'zod';
+import { validateUnresolvedExpr } from '#auth/grants/grant-decoder';
+function assertNoCredentialLeaves(expr) {
+    switch (expr.kind) {
+        case 'identity':
+            if ('credential' in expr) {
+                throw new Error('SelfIdentityExpr cannot contain credential leaves — use UnresolvedIdentityExpr for delegation chains');
+            }
+            return;
+        case 'scope':
+            assertNoCredentialLeaves(expr.expr);
+            return;
+        case 'union':
+        case 'intersect':
+            for (const op of expr.operands)
+                assertNoCredentialLeaves(op);
+            return;
+        case 'exclude':
+            assertNoCredentialLeaves(expr.base);
+            for (const ex of expr.excluded)
+                assertNoCredentialLeaves(ex);
+            return;
+    }
+}
+export const unresolvedIdentityExprSchema = z.custom((val) => {
+    try {
+        validateUnresolvedExpr(val, 'expr');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, { message: 'Invalid UnresolvedIdentityExpr' });
+export const selfIdentityExprSchema = z.custom((val) => {
+    try {
+        validateUnresolvedExpr(val, 'expr');
+        assertNoCredentialLeaves(val);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, { message: 'Invalid SelfIdentityExpr (must not contain credential leaves)' });
+//# sourceMappingURL=zod.js.map

package/dist/auth/expression/zod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod.js","sourceRoot":"","sources":["../../../auth/expression/zod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAInE,SAAS,wBAAwB,CAAC,IAA4B;IAC5D,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAA;YACH,CAAC;YACD,OAAM;QACR,KAAK,OAAO;YACV,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,OAAM;QACR,KAAK,OAAO,CAAC;QACb,KAAK,WAAW;YACd,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ;gBAAE,wBAAwB,CAAC,EAAE,CAAC,CAAA;YAC5D,OAAM;QACR,KAAK,SAAS;YACZ,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ;gBAAE,wBAAwB,CAAC,EAAE,CAAC,CAAA;YAC5D,OAAM;IACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAClD,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAC9C,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,wBAAwB,CAAC,GAA6B,CAAC,CAAA;QACvD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAC7E,CAAA"}