@astrale-os/kernel-dsl 0.1.4 → 0.1.5

package/dist/serializer/policies.js

@@ -0,0 +1,837 @@
+import { isEdgeClass, isNode, isNodeClass } from '../grammar/definition/discriminants.js';
+import { SchemaValidationError } from '../schema/error.js';
+import { buildDescriptorMap, findDefTransitive } from '../schema/refs.js';
+import { getRefMeta, getZodDef, getZodTypeName, hasRefTag } from './helpers.js';
+import { PolicyTyping } from './policy-typing.js';
+const PATTERN_BINDING = Symbol('astrale.policy.pattern-binding');
+const PATTERN_EXPRESSION = Symbol('astrale.policy.pattern-expression');
+const CHECK_BINDING = Symbol('astrale.policy.check-binding');
+const CHECK_EXPRESSION = Symbol('astrale.policy.check-expression');
+const LIMITS = Object.freeze({
+    depth: 4,
+    branches: 8,
+    variablesPerExists: 4,
+    edgesPerBranch: 6,
+    repeat: 3,
+    domains: 4,
+    callableLeaves: 8,
+});
+function fail(field, message, expected, received) {
+    throw new SchemaValidationError(message, field, expected, received);
+}
+function isDefinition(value) {
+    return typeof value === 'object' && value !== null && '__kind' in value;
+}
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries
+        .map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`)
+        .join(',')}}`;
+}
+function uniqueSorted(values, key) {
+    const byKey = new Map();
+    for (const value of values)
+        byKey.set(key(value), value);
+    return [...byKey.entries()]
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+        .map(([, value]) => value);
+}
+function permutations(values) {
+    if (values.length <= 1)
+        return [[...values]];
+    const result = [];
+    for (let index = 0; index < values.length; index += 1) {
+        const value = values[index];
+        const rest = [...values.slice(0, index), ...values.slice(index + 1)];
+        for (const tail of permutations(rest))
+            result.push([value, ...tail]);
+    }
+    return result;
+}
+/**
+ * Canonicalize alpha-equivalent exists() binders before assigning public IDs.
+ * Each exists scope has at most four variables, so exhaustively comparing its
+ * 24 possible declaration orders is bounded by the Sirius structural limit.
+ */
+function alphaNormalizePattern(expression, environment = new Map(), depth = 0) {
+    const keyNode = (node) => {
+        if (node.kind !== 'variable')
+            return node;
+        const token = environment.get(node.id);
+        if (!token)
+            fail('policies', `Policy variable ${node.id} has no active declaration`);
+        return { kind: 'variable', id: token };
+    };
+    if ('source' in expression) {
+        return {
+            ir: expression,
+            key: {
+                source: keyNode(expression.source),
+                class: expression.class,
+                target: keyNode(expression.target),
+                ...(expression.repeat ? { repeat: expression.repeat } : {}),
+            },
+        };
+    }
+    if ('exists' in expression) {
+        let best;
+        for (const ordering of permutations(expression.exists.nodes)) {
+            const scoped = new Map(environment);
+            const keyedNodes = ordering.map((node, index) => {
+                const token = `scope-${depth}-variable-${index}`;
+                scoped.set(node.variable.id, token);
+                return { variable: { kind: 'variable', id: token }, class: node.class };
+            });
+            const where = alphaNormalizePattern(expression.exists.where, scoped, depth + 1);
+            const key = { exists: { nodes: keyedNodes, where: where.key } };
+            const candidate = {
+                ir: {
+                    exists: {
+                        nodes: ordering,
+                        where: where.ir,
+                    },
+                },
+                key,
+                encoded: canonicalJson(key),
+            };
+            if (!best || candidate.encoded < best.encoded)
+                best = candidate;
+        }
+        return best;
+    }
+    const operator = 'allOf' in expression ? 'allOf' : 'anyOf';
+    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
+    const canonical = operands.map((operand) => alphaNormalizePattern(operand, environment, depth));
+    const byKey = new Map();
+    for (const operand of canonical)
+        byKey.set(canonicalJson(operand.key), operand);
+    const sorted = [...byKey.entries()]
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+        .map(([, operand]) => operand);
+    const irOperands = sorted.map((operand) => operand.ir);
+    const keyOperands = sorted.map((operand) => operand.key);
+    return operator === 'allOf'
+        ? { ir: { allOf: irOperands }, key: { allOf: keyOperands } }
+        : { ir: { anyOf: irOperands }, key: { anyOf: keyOperands } };
+}
+function makePatternBinding(node) {
+    return Object.freeze({
+        [PATTERN_BINDING]: node,
+    });
+}
+function makePatternExpression(ir) {
+    return Object.freeze({
+        [PATTERN_EXPRESSION]: ir,
+    });
+}
+function getPatternExpression(value, field) {
+    if (typeof value !== 'object' || value === null || !(PATTERN_EXPRESSION in value)) {
+        return fail(field, `Policy builder '${field}' must return an expression created by edge(), exists(), allOf() or anyOf()`, 'closed Policy Pattern expression', typeof value);
+    }
+    return value[PATTERN_EXPRESSION];
+}
+function makeCheckBinding(object, target) {
+    return Object.freeze({
+        [CHECK_BINDING]: { object, target },
+    });
+}
+function makeCheckExpression(ir) {
+    return Object.freeze({
+        [CHECK_EXPRESSION]: ir,
+    });
+}
+function getCheckExpression(value, field) {
+    if (typeof value !== 'object' || value === null || !(CHECK_EXPRESSION in value)) {
+        return fail(field, `Callable Policy '${field}' must return an expression created by check(), allOf() or anyOf()`, 'closed callable Policy expression', typeof value);
+    }
+    return value[CHECK_EXPRESSION];
+}
+function normalizePattern(expression) {
+    if ('source' in expression) {
+        const repeat = expression.repeat;
+        if (repeat?.min === 1 && repeat.max === 1) {
+            const { repeat: _omitted, ...edge } = expression;
+            return edge;
+        }
+        return expression;
+    }
+    if ('exists' in expression) {
+        const nodes = [...expression.exists.nodes].sort((left, right) => left.variable.id - right.variable.id);
+        return {
+            exists: {
+                nodes,
+                where: normalizePattern(expression.exists.where),
+            },
+        };
+    }
+    if ('allOf' in expression) {
+        const operands = [];
+        for (const operand of expression.allOf) {
+            const normalized = normalizePattern(operand);
+            if ('allOf' in normalized)
+                operands.push(...normalized.allOf);
+            else
+                operands.push(normalized);
+        }
+        return {
+            allOf: uniqueSorted(operands, canonicalJson),
+        };
+    }
+    const operands = [];
+    for (const operand of expression.anyOf) {
+        const normalized = normalizePattern(operand);
+        if ('anyOf' in normalized)
+            operands.push(...normalized.anyOf);
+        else
+            operands.push(normalized);
+    }
+    return {
+        anyOf: uniqueSorted(operands, canonicalJson),
+    };
+}
+function normalizeCheck(expression) {
+    if ('check' in expression)
+        return expression;
+    if ('allOf' in expression) {
+        const operands = [];
+        for (const operand of expression.allOf) {
+            const normalized = normalizeCheck(operand);
+            if ('allOf' in normalized)
+                operands.push(...normalized.allOf);
+            else
+                operands.push(normalized);
+        }
+        return {
+            allOf: uniqueSorted(operands, canonicalJson),
+        };
+    }
+    const operands = [];
+    for (const operand of expression.anyOf) {
+        const normalized = normalizeCheck(operand);
+        if ('anyOf' in normalized)
+            operands.push(...normalized.anyOf);
+        else
+            operands.push(normalized);
+    }
+    return {
+        anyOf: uniqueSorted(operands, canonicalJson),
+    };
+}
+function patternDepth(expression) {
+    if ('source' in expression)
+        return 1;
+    if ('exists' in expression)
+        return 1 + patternDepth(expression.exists.where);
+    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
+    return 1 + Math.max(...operands.map(patternDepth));
+}
+function collectPatternDomains(expression, into) {
+    if ('source' in expression) {
+        into.add(expression.class.origin);
+        return;
+    }
+    if ('exists' in expression) {
+        for (const node of expression.exists.nodes)
+            into.add(node.class.origin);
+        collectPatternDomains(expression.exists.where, into);
+        return;
+    }
+    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
+    for (const operand of operands)
+        collectPatternDomains(operand, into);
+}
+function mergeBranches(left, right) {
+    return {
+        edges: [...left.edges, ...right.edges],
+        variables: new Set([...left.variables, ...right.variables]),
+    };
+}
+function patternBranches(expression, activeVariables = new Set()) {
+    if ('source' in expression) {
+        return [{ edges: [expression], variables: new Set(activeVariables) }];
+    }
+    if ('exists' in expression) {
+        const next = new Set(activeVariables);
+        for (const node of expression.exists.nodes)
+            next.add(node.variable.id);
+        return patternBranches(expression.exists.where, next);
+    }
+    if ('anyOf' in expression) {
+        const result = [];
+        for (const operand of expression.anyOf) {
+            result.push(...patternBranches(operand, activeVariables));
+            if (result.length > LIMITS.branches)
+                return result;
+        }
+        return result;
+    }
+    let result = [{ edges: [], variables: new Set(activeVariables) }];
+    for (const operand of expression.allOf) {
+        const operandBranches = patternBranches(operand, activeVariables);
+        const next = [];
+        for (const left of result) {
+            for (const right of operandBranches) {
+                next.push(mergeBranches(left, right));
+                if (next.length > LIMITS.branches)
+                    return next;
+            }
+        }
+        result = next;
+    }
+    return result;
+}
+function endpointKey(node) {
+    switch (node.kind) {
+        case 'subject':
+            return 'subject';
+        case 'object':
+            return 'object';
+        case 'variable':
+            return `variable:${node.id}`;
+    }
+}
+function validateBranchConnectivity(branch, field) {
+    const adjacency = new Map();
+    const required = new Set(['subject', 'object']);
+    for (const id of branch.variables)
+        required.add(`variable:${id}`);
+    const connect = (left, right) => {
+        const leftSet = adjacency.get(left) ?? new Set();
+        leftSet.add(right);
+        adjacency.set(left, leftSet);
+        const rightSet = adjacency.get(right) ?? new Set();
+        rightSet.add(left);
+        adjacency.set(right, rightSet);
+    };
+    for (const edge of branch.edges) {
+        const source = endpointKey(edge.source);
+        const target = endpointKey(edge.target);
+        required.add(source);
+        required.add(target);
+        connect(source, target);
+    }
+    const visited = new Set();
+    const queue = ['subject'];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (visited.has(current))
+            continue;
+        visited.add(current);
+        for (const adjacent of adjacency.get(current) ?? [])
+            queue.push(adjacent);
+    }
+    const disconnected = [...required].filter((vertex) => !visited.has(vertex));
+    if (disconnected.length > 0) {
+        fail(field, `Every normalized Policy branch must connect subject, object and every scoped variable; disconnected: ${disconnected.join(', ')}`, 'one connected relational proof', 'disconnected Pattern branch');
+    }
+}
+function validateVariableScopes(expression, field, active = new Set(), declared = new Set()) {
+    if ('source' in expression) {
+        for (const endpoint of [expression.source, expression.target]) {
+            if (endpoint.kind === 'variable' && !active.has(endpoint.id)) {
+                fail(field, `Policy variable ${endpoint.id} escaped the exists() callback that declared it`, 'variable used only inside its declaring exists().where', `out-of-scope variable ${endpoint.id}`);
+            }
+        }
+        return;
+    }
+    if ('exists' in expression) {
+        if (expression.exists.nodes.length === 0) {
+            fail(field, 'exists() must declare at least one variable Node');
+        }
+        if (expression.exists.nodes.length > LIMITS.variablesPerExists) {
+            fail(field, `exists() declares ${expression.exists.nodes.length} variables; V1 allows ${LIMITS.variablesPerExists}`);
+        }
+        const next = new Set(active);
+        for (const node of expression.exists.nodes) {
+            const id = node.variable.id;
+            if (declared.has(id)) {
+                fail(field, `Policy variable ${id} is declared more than once`);
+            }
+            declared.add(id);
+            next.add(id);
+        }
+        validateVariableScopes(expression.exists.where, field, next, declared);
+        return;
+    }
+    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
+    for (const operand of operands)
+        validateVariableScopes(operand, field, active, declared);
+}
+function rewriteVariableIds(expression, mapping = new Map(), counter = { value: 0 }) {
+    const rewriteNode = (node) => {
+        if (node.kind !== 'variable')
+            return node;
+        const rewritten = mapping.get(node.id);
+        if (rewritten === undefined) {
+            fail('policies', `Policy variable ${node.id} has no active declaration`);
+        }
+        return { kind: 'variable', id: rewritten };
+    };
+    if ('source' in expression) {
+        return {
+            ...expression,
+            source: rewriteNode(expression.source),
+            target: rewriteNode(expression.target),
+        };
+    }
+    if ('exists' in expression) {
+        const scoped = new Map(mapping);
+        const nodes = expression.exists.nodes.map((node) => {
+            const id = counter.value++;
+            scoped.set(node.variable.id, id);
+            return { variable: { kind: 'variable', id }, class: node.class };
+        });
+        return {
+            exists: {
+                nodes,
+                where: rewriteVariableIds(expression.exists.where, scoped, counter),
+            },
+        };
+    }
+    if ('allOf' in expression) {
+        return {
+            allOf: expression.allOf.map((operand) => rewriteVariableIds(operand, mapping, counter)),
+        };
+    }
+    return {
+        anyOf: expression.anyOf.map((operand) => rewriteVariableIds(operand, mapping, counter)),
+    };
+}
+function validatePattern(expression, field, ownerOrigin) {
+    validateVariableScopes(expression, field);
+    const depth = patternDepth(expression);
+    if (depth > LIMITS.depth) {
+        fail(field, `Policy Pattern depth ${depth} exceeds the V1 limit ${LIMITS.depth}`);
+    }
+    const branches = patternBranches(expression);
+    if (branches.length > LIMITS.branches) {
+        fail(field, `Policy Pattern has more than ${LIMITS.branches} normalized branches`);
+    }
+    for (const branch of branches) {
+        if (branch.edges.length > LIMITS.edgesPerBranch) {
+            fail(field, `Policy branch has ${branch.edges.length} edge predicates; V1 allows ${LIMITS.edgesPerBranch}`);
+        }
+        validateBranchConnectivity(branch, field);
+    }
+    const domains = new Set([ownerOrigin]);
+    collectPatternDomains(expression, domains);
+    if (domains.size > LIMITS.domains) {
+        fail(field, `Policy references ${domains.size} Domains; V1 allows ${LIMITS.domains}`);
+    }
+    return {
+        depth,
+        edgeCounts: branches.map((branch) => branch.edges.length),
+        domains,
+    };
+}
+function callableDepth(expression) {
+    if ('check' in expression)
+        return 1;
+    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
+    return 1 + Math.max(...operands.map(callableDepth));
+}
+function callableBranches(expression) {
+    if ('check' in expression)
+        return 1;
+    if ('allOf' in expression) {
+        return expression.allOf.reduce((total, operand) => total * callableBranches(operand), 1);
+    }
+    return expression.anyOf.reduce((total, operand) => total + callableBranches(operand), 0);
+}
+function callableLeaves(expression) {
+    if ('check' in expression)
+        return 1;
+    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
+    return operands.reduce((total, operand) => total + callableLeaves(operand), 0);
+}
+function validateCallable(expression, field) {
+    const depth = callableDepth(expression);
+    const branches = callableBranches(expression);
+    const leaves = callableLeaves(expression);
+    if (depth > LIMITS.depth) {
+        fail(field, `Callable Policy depth ${depth} exceeds the V1 limit ${LIMITS.depth}`);
+    }
+    if (branches > LIMITS.branches) {
+        fail(field, `Callable Policy has ${branches} normalized branches; V1 allows ${LIMITS.branches}`);
+    }
+    if (leaves > LIMITS.callableLeaves) {
+        fail(field, `Callable Policy has ${leaves} check leaves; V1 allows ${LIMITS.callableLeaves}`);
+    }
+}
+function zodObjectShape(schema) {
+    const def = getZodDef(schema);
+    if (!def || !['ZodObject', 'object'].includes(getZodTypeName(def) ?? ''))
+        return null;
+    const shape = typeof def.shape === 'function' ? def.shape() : def.shape;
+    return shape && typeof shape === 'object' ? shape : null;
+}
+export class PolicyCompiler {
+    schema;
+    localDefs;
+    importedDefs = [];
+    policyNames = new Map();
+    declarations = new Map();
+    measures = new Map();
+    nextVariableId = 0;
+    typing;
+    constructor(schema) {
+        this.schema = schema;
+        this.localDefs = buildDescriptorMap(schema);
+        for (const imported of schema.imports) {
+            this.importedDefs.push({ origin: imported.domain, map: buildDescriptorMap(imported) });
+        }
+        for (const [name, definition] of Object.entries(schema.policies ?? {})) {
+            this.policyNames.set(definition, name);
+        }
+    }
+    get hasStandalonePolicies() {
+        return Object.values(this.schema.functions).some((fn) => Boolean(fn.config.policy));
+    }
+    compileDeclarations() {
+        const result = {};
+        for (const [name] of Object.entries(this.schema.policies ?? {})) {
+            result[name] = this.compileNamed(name, []);
+        }
+        for (const name of Object.keys(result))
+            this.measureNamed(name, []);
+        this.typing = new PolicyTyping(this.schema, result);
+        this.typing.validateDeclarations();
+        return result;
+    }
+    compileNodePolicies(definition, field) {
+        const configured = definition.config.policies;
+        if (!configured)
+            return undefined;
+        if (!configured.read)
+            return {};
+        const ref = this.resolvePolicyRef(configured.read, `${field}.read`);
+        this.policyTyping().assertAccepts(ref, this.policyTyping().contractOf(definition, `${field}.read`), `${field}.read`);
+        return { read: ref };
+    }
+    compileMethodPolicy(definition, owner, field) {
+        const callback = definition.config.policy;
+        if (!callback)
+            return undefined;
+        if (!isNode(owner)) {
+            return fail(field, `Application Policies are supported on Node Methods only; '${owner.__kind}' is not a Node definition`);
+        }
+        const params = this.buildInputBindings(definition.config.params ?? {}, `${field}.input`);
+        const builder = {
+            input: params,
+            params,
+            ...this.callableOperators(field),
+        };
+        if (!definition.config.static) {
+            builder.self = makeCheckBinding({ kind: 'self' }, owner);
+        }
+        let built;
+        try {
+            built = callback(builder);
+        }
+        catch (error) {
+            if (error instanceof SchemaValidationError)
+                throw error;
+            return fail(field, `Failed to build callable Policy '${field}': ${String(error)}`);
+        }
+        const normalized = normalizeCheck(getCheckExpression(built, field));
+        validateCallable(normalized, field);
+        return normalized;
+    }
+    compileFunctionPolicy(definition, field) {
+        const callback = definition.config.policy;
+        if (!callback)
+            return undefined;
+        const shape = zodObjectShape(definition.config.input);
+        if (!shape) {
+            return fail(`${field}.input`, `A standalone Function with a Policy must use one direct Zod object input`, 'z.object({...})', 'non-object input');
+        }
+        const builder = {
+            input: this.buildInputBindings(shape, `${field}.input`),
+            ...this.callableOperators(field),
+        };
+        let built;
+        try {
+            built = callback(builder);
+        }
+        catch (error) {
+            if (error instanceof SchemaValidationError)
+                throw error;
+            return fail(field, `Failed to build callable Policy '${field}': ${String(error)}`);
+        }
+        const normalized = normalizeCheck(getCheckExpression(built, field));
+        validateCallable(normalized, field);
+        return normalized;
+    }
+    compileNamed(name, stack) {
+        const cached = this.declarations.get(name);
+        if (cached)
+            return cached;
+        if (stack.includes(name)) {
+            return fail(`policies.${name}`, `Named Policy composition cycle: ${[...stack, name].join(' -> ')}`);
+        }
+        const definition = this.schema.policies?.[name];
+        if (!definition)
+            return fail(`policies.${name}`, `Unknown local Policy '${name}'`);
+        const config = definition.input;
+        let declaration;
+        if ('match' in config) {
+            this.nextVariableId = 0;
+            let built;
+            try {
+                built = config.match(this.patternBuilder(`policies.${name}.match`));
+            }
+            catch (error) {
+                if (error instanceof SchemaValidationError)
+                    throw error;
+                return fail(`policies.${name}.match`, `Failed to build Policy '${name}': ${String(error)}`);
+            }
+            const raw = getPatternExpression(built, `policies.${name}.match`);
+            const normalized = normalizePattern(raw);
+            validateVariableScopes(normalized, `policies.${name}.match`);
+            const alphaNormalized = alphaNormalizePattern(normalized).ir;
+            const canonical = normalizePattern(rewriteVariableIds(alphaNormalized));
+            this.measures.set(name, validatePattern(canonical, `policies.${name}.match`, this.schema.domain));
+            declaration =
+                config.description !== undefined
+                    ? { description: config.description, match: canonical }
+                    : { match: canonical };
+        }
+        else if (config.__type === 'policy-composition') {
+            if (config.policies.length === 0) {
+                return fail(`policies.${name}`, `Named Policy composition must be non-empty`);
+            }
+            const refs = config.policies.map((operand) => {
+                const ref = this.resolvePolicyRef(operand, `policies.${name}.${config.operator}`);
+                this.compileNamed(ref.name, [...stack, name]);
+                return ref;
+            });
+            const normalized = uniqueSorted(refs, (ref) => `${ref.origin}\u0000${ref.kind}\u0000${ref.name}`);
+            declaration = config.operator === 'allOf' ? { allOf: normalized } : { anyOf: normalized };
+        }
+        else {
+            return fail(`policies.${name}`, `Policy '${name}' must contain exactly one match or named composition expression`);
+        }
+        this.declarations.set(name, declaration);
+        return declaration;
+    }
+    measureNamed(name, stack) {
+        const cached = this.measures.get(name);
+        if (cached)
+            return cached;
+        if (stack.includes(name)) {
+            return fail(`policies.${name}`, `Named Policy composition cycle at '${name}'`);
+        }
+        const declaration = this.declarations.get(name) ?? this.compileNamed(name, stack);
+        if ('match' in declaration)
+            return this.measures.get(name);
+        const operator = 'allOf' in declaration ? 'allOf' : 'anyOf';
+        const refs = 'allOf' in declaration ? declaration.allOf : declaration.anyOf;
+        const operands = refs.map((ref) => this.measureNamed(ref.name, [...stack, name]));
+        const depth = 1 + Math.max(...operands.map((operand) => operand.depth));
+        let edgeCounts;
+        if (operator === 'anyOf') {
+            edgeCounts = operands.flatMap((operand) => operand.edgeCounts);
+        }
+        else {
+            edgeCounts = [0];
+            for (const operand of operands) {
+                edgeCounts = edgeCounts.flatMap((left) => operand.edgeCounts.map((right) => left + right));
+                if (edgeCounts.length > LIMITS.branches)
+                    break;
+            }
+        }
+        const domains = new Set([this.schema.domain]);
+        for (const operand of operands) {
+            for (const origin of operand.domains)
+                domains.add(origin);
+        }
+        if (depth > LIMITS.depth) {
+            fail(`policies.${name}`, `Expanded named Policy depth ${depth} exceeds the V1 limit ${LIMITS.depth}`);
+        }
+        if (edgeCounts.length > LIMITS.branches) {
+            fail(`policies.${name}`, `Expanded named Policy has more than ${LIMITS.branches} normalized branches`);
+        }
+        if (Math.max(...edgeCounts) > LIMITS.edgesPerBranch) {
+            fail(`policies.${name}`, `Expanded named Policy exceeds ${LIMITS.edgesPerBranch} edge predicates in one branch`);
+        }
+        if (domains.size > LIMITS.domains) {
+            fail(`policies.${name}`, `Expanded named Policy references ${domains.size} Domains; V1 allows ${LIMITS.domains}`);
+        }
+        const measure = { depth, edgeCounts, domains };
+        this.measures.set(name, measure);
+        return measure;
+    }
+    patternBuilder(field) {
+        const subject = makePatternBinding({ kind: 'subject' });
+        const object = makePatternBinding({ kind: 'object' });
+        const edge = (input) => {
+            if (!input || typeof input !== 'object')
+                return fail(field, 'edge() expects an object');
+            const edgeClass = this.resolveLazyDefinition(input.class, `${field}.edge.class`);
+            if (!isDefinition(edgeClass) || !isEdgeClass(edgeClass)) {
+                return fail(`${field}.edge.class`, `Policy edge() requires an exact Edge Class`);
+            }
+            let repeat = input.repeat;
+            if (repeat) {
+                const valid = Number.isInteger(repeat.min) &&
+                    Number.isInteger(repeat.max) &&
+                    repeat.min >= 0 &&
+                    repeat.min <= repeat.max &&
+                    repeat.max <= LIMITS.repeat;
+                if (!valid) {
+                    return fail(`${field}.edge.repeat`, `Policy repeat must satisfy 0 <= min <= max <= ${LIMITS.repeat}`);
+                }
+                if (repeat.min === 1 && repeat.max === 1)
+                    repeat = undefined;
+            }
+            return makePatternExpression({
+                source: this.patternEndpoint(input.source, `${field}.edge.source`),
+                class: this.resolveDefinitionRef(edgeClass, 'edge-class', `${field}.edge.class`),
+                target: this.patternEndpoint(input.target, `${field}.edge.target`),
+                ...(repeat ? { repeat } : {}),
+            });
+        };
+        const allOf = (first, ...rest) => makePatternExpression({
+            allOf: [first, ...rest].map((value) => getPatternExpression(value, field)),
+        });
+        const anyOf = (first, ...rest) => makePatternExpression({
+            anyOf: [first, ...rest].map((value) => getPatternExpression(value, field)),
+        });
+        const exists = (build) => {
+            if (typeof build !== 'function')
+                return fail(`${field}.exists`, 'exists() expects a callback');
+            const nodes = [];
+            const where = build({
+                node: (definition) => {
+                    const nodeClass = this.resolveLazyDefinition(definition, `${field}.exists.node`);
+                    if (!isDefinition(nodeClass) || !isNodeClass(nodeClass)) {
+                        return fail(`${field}.exists.node`, `exists().node() requires an exact Node Class`);
+                    }
+                    if (nodes.length >= LIMITS.variablesPerExists) {
+                        return fail(`${field}.exists.nodes`, `exists() may declare at most ${LIMITS.variablesPerExists} variable Nodes`);
+                    }
+                    const variable = { kind: 'variable', id: this.nextVariableId++ };
+                    nodes.push({
+                        variable,
+                        class: this.resolveDefinitionRef(nodeClass, 'node-class', `${field}.exists.node`),
+                    });
+                    return makePatternBinding(variable);
+                },
+            });
+            if (nodes.length === 0) {
+                return fail(`${field}.exists`, `exists() must declare at least one variable Node`);
+            }
+            return makePatternExpression({
+                exists: {
+                    nodes: nodes,
+                    where: getPatternExpression(where, `${field}.exists.where`),
+                },
+            });
+        };
+        return Object.freeze({ subject, object, edge, exists, allOf, anyOf });
+    }
+    patternEndpoint(value, field) {
+        if (typeof value === 'object' && value !== null && PATTERN_BINDING in value) {
+            return value[PATTERN_BINDING];
+        }
+        return fail(field, `Policy edge endpoint must be subject, object, or an exists() variable`);
+    }
+    callableOperators(field) {
+        const check = (policy, object) => {
+            if (typeof object !== 'object' || object === null || !(CHECK_BINDING in object)) {
+                return fail(`${field}.check`, `check() object must be self or one direct ref() input field`);
+            }
+            const binding = object[CHECK_BINDING];
+            this.assertDirectNode(binding.target, `${field}.check.object`);
+            const ref = this.resolvePolicyRef(policy, `${field}.check`);
+            this.policyTyping().assertAccepts(ref, this.policyTyping().contractOf(binding.target, `${field}.check.object`), `${field}.check`);
+            return makeCheckExpression({
+                check: ref,
+                object: binding.object,
+            });
+        };
+        const allOf = (first, ...rest) => makeCheckExpression({
+            allOf: [first, ...rest].map((value) => getCheckExpression(value, field)),
+        });
+        const anyOf = (first, ...rest) => makeCheckExpression({
+            anyOf: [first, ...rest].map((value) => getCheckExpression(value, field)),
+        });
+        return { check, allOf, anyOf };
+    }
+    buildInputBindings(shape, field) {
+        const result = {};
+        for (const [name, schema] of Object.entries(shape)) {
+            if (!hasRefTag(schema))
+                continue;
+            const meta = getRefMeta(schema);
+            if (!meta)
+                continue;
+            const target = this.assertDirectNode(meta.target, `${field}.${name}`);
+            result[name] = makeCheckBinding({ kind: 'input', field: name }, target);
+        }
+        return Object.freeze(result);
+    }
+    assertDirectNode(value, field) {
+        if (!('__kind' in value) || !isNode(value)) {
+            return fail(field, `Callable Policy objects must be direct ref() values to Node definitions`);
+        }
+        const definition = value;
+        this.resolveAnyDefinition(definition, field);
+        return definition;
+    }
+    resolvePolicyRef(input, field) {
+        const definition = this.resolveLazyPolicy(input, field);
+        const name = this.policyNames.get(definition);
+        if (!name) {
+            return fail(field, `Policy uses must reference a named Policy registered in this schema`, 'local named Policy', 'unregistered or foreign Policy');
+        }
+        return { origin: this.schema.domain, kind: 'policy', name };
+    }
+    resolveLazyPolicy(input, field) {
+        const value = this.resolveLazyDefinition(input, field);
+        if (typeof value !== 'object' || value === null || value.__type !== 'policy') {
+            return fail(field, `Policy reference must resolve to a value created by definePolicy()`);
+        }
+        return value;
+    }
+    resolveLazyDefinition(input, field) {
+        if (typeof input !== 'function')
+            return input;
+        try {
+            return input();
+        }
+        catch (error) {
+            return fail(field, `Failed to resolve lazy Policy reference: ${String(error)}`);
+        }
+    }
+    policyTyping() {
+        return (this.typing ?? fail('policies', 'Policy declarations must compile before Policy use sites'));
+    }
+    resolveDefinitionRef(definition, kind, field) {
+        if (definition.__kind !== kind) {
+            return fail(field, `Expected ${kind}, received ${definition.__kind}`);
+        }
+        const resolved = this.resolveAnyDefinition(definition, field);
+        return { origin: resolved.origin, kind, name: resolved.descriptor.name };
+    }
+    resolveAnyDefinition(definition, field) {
+        const local = this.localDefs.get(definition);
+        if (local)
+            return { origin: this.schema.domain, descriptor: local };
+        for (const imported of this.importedDefs) {
+            const descriptor = imported.map.get(definition);
+            if (descriptor)
+                return { origin: imported.origin, descriptor };
+        }
+        const transitive = findDefTransitive(this.schema, definition);
+        if (transitive) {
+            return fail(field, `Policy relation refs may use only the owning Domain or an exact direct dependency; '${transitive.origin}' is transitive via ${transitive.path.join(' -> ')}`);
+        }
+        return fail(field, `Policy references a definition not registered in this schema or its imports`);
+    }
+}
+//# sourceMappingURL=policies.js.map