@astrale-os/kernel-dsl 0.1.5 → 0.2.0-beta.2

package/dist/serializer/policies.js

@@ -1,837 +0,0 @@
-import { isEdgeClass, isNode, isNodeClass } from '../grammar/definition/discriminants.js';
-import { SchemaValidationError } from '../schema/error.js';
-import { buildDescriptorMap, findDefTransitive } from '../schema/refs.js';
-import { getRefMeta, getZodDef, getZodTypeName, hasRefTag } from './helpers.js';
-import { PolicyTyping } from './policy-typing.js';
-const PATTERN_BINDING = Symbol('astrale.policy.pattern-binding');
-const PATTERN_EXPRESSION = Symbol('astrale.policy.pattern-expression');
-const CHECK_BINDING = Symbol('astrale.policy.check-binding');
-const CHECK_EXPRESSION = Symbol('astrale.policy.check-expression');
-const LIMITS = Object.freeze({
-    depth: 4,
-    branches: 8,
-    variablesPerExists: 4,
-    edgesPerBranch: 6,
-    repeat: 3,
-    domains: 4,
-    callableLeaves: 8,
-});
-function fail(field, message, expected, received) {
-    throw new SchemaValidationError(message, field, expected, received);
-}
-function isDefinition(value) {
-    return typeof value === 'object' && value !== null && '__kind' in value;
-}
-function canonicalJson(value) {
-    if (value === null || typeof value !== 'object')
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(',')}]`;
-    const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-    return `{${entries
-        .map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`)
-        .join(',')}}`;
-}
-function uniqueSorted(values, key) {
-    const byKey = new Map();
-    for (const value of values)
-        byKey.set(key(value), value);
-    return [...byKey.entries()]
-        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
-        .map(([, value]) => value);
-}
-function permutations(values) {
-    if (values.length <= 1)
-        return [[...values]];
-    const result = [];
-    for (let index = 0; index < values.length; index += 1) {
-        const value = values[index];
-        const rest = [...values.slice(0, index), ...values.slice(index + 1)];
-        for (const tail of permutations(rest))
-            result.push([value, ...tail]);
-    }
-    return result;
-}
-/**
- * Canonicalize alpha-equivalent exists() binders before assigning public IDs.
- * Each exists scope has at most four variables, so exhaustively comparing its
- * 24 possible declaration orders is bounded by the Sirius structural limit.
- */
-function alphaNormalizePattern(expression, environment = new Map(), depth = 0) {
-    const keyNode = (node) => {
-        if (node.kind !== 'variable')
-            return node;
-        const token = environment.get(node.id);
-        if (!token)
-            fail('policies', `Policy variable ${node.id} has no active declaration`);
-        return { kind: 'variable', id: token };
-    };
-    if ('source' in expression) {
-        return {
-            ir: expression,
-            key: {
-                source: keyNode(expression.source),
-                class: expression.class,
-                target: keyNode(expression.target),
-                ...(expression.repeat ? { repeat: expression.repeat } : {}),
-            },
-        };
-    }
-    if ('exists' in expression) {
-        let best;
-        for (const ordering of permutations(expression.exists.nodes)) {
-            const scoped = new Map(environment);
-            const keyedNodes = ordering.map((node, index) => {
-                const token = `scope-${depth}-variable-${index}`;
-                scoped.set(node.variable.id, token);
-                return { variable: { kind: 'variable', id: token }, class: node.class };
-            });
-            const where = alphaNormalizePattern(expression.exists.where, scoped, depth + 1);
-            const key = { exists: { nodes: keyedNodes, where: where.key } };
-            const candidate = {
-                ir: {
-                    exists: {
-                        nodes: ordering,
-                        where: where.ir,
-                    },
-                },
-                key,
-                encoded: canonicalJson(key),
-            };
-            if (!best || candidate.encoded < best.encoded)
-                best = candidate;
-        }
-        return best;
-    }
-    const operator = 'allOf' in expression ? 'allOf' : 'anyOf';
-    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
-    const canonical = operands.map((operand) => alphaNormalizePattern(operand, environment, depth));
-    const byKey = new Map();
-    for (const operand of canonical)
-        byKey.set(canonicalJson(operand.key), operand);
-    const sorted = [...byKey.entries()]
-        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
-        .map(([, operand]) => operand);
-    const irOperands = sorted.map((operand) => operand.ir);
-    const keyOperands = sorted.map((operand) => operand.key);
-    return operator === 'allOf'
-        ? { ir: { allOf: irOperands }, key: { allOf: keyOperands } }
-        : { ir: { anyOf: irOperands }, key: { anyOf: keyOperands } };
-}
-function makePatternBinding(node) {
-    return Object.freeze({
-        [PATTERN_BINDING]: node,
-    });
-}
-function makePatternExpression(ir) {
-    return Object.freeze({
-        [PATTERN_EXPRESSION]: ir,
-    });
-}
-function getPatternExpression(value, field) {
-    if (typeof value !== 'object' || value === null || !(PATTERN_EXPRESSION in value)) {
-        return fail(field, `Policy builder '${field}' must return an expression created by edge(), exists(), allOf() or anyOf()`, 'closed Policy Pattern expression', typeof value);
-    }
-    return value[PATTERN_EXPRESSION];
-}
-function makeCheckBinding(object, target) {
-    return Object.freeze({
-        [CHECK_BINDING]: { object, target },
-    });
-}
-function makeCheckExpression(ir) {
-    return Object.freeze({
-        [CHECK_EXPRESSION]: ir,
-    });
-}
-function getCheckExpression(value, field) {
-    if (typeof value !== 'object' || value === null || !(CHECK_EXPRESSION in value)) {
-        return fail(field, `Callable Policy '${field}' must return an expression created by check(), allOf() or anyOf()`, 'closed callable Policy expression', typeof value);
-    }
-    return value[CHECK_EXPRESSION];
-}
-function normalizePattern(expression) {
-    if ('source' in expression) {
-        const repeat = expression.repeat;
-        if (repeat?.min === 1 && repeat.max === 1) {
-            const { repeat: _omitted, ...edge } = expression;
-            return edge;
-        }
-        return expression;
-    }
-    if ('exists' in expression) {
-        const nodes = [...expression.exists.nodes].sort((left, right) => left.variable.id - right.variable.id);
-        return {
-            exists: {
-                nodes,
-                where: normalizePattern(expression.exists.where),
-            },
-        };
-    }
-    if ('allOf' in expression) {
-        const operands = [];
-        for (const operand of expression.allOf) {
-            const normalized = normalizePattern(operand);
-            if ('allOf' in normalized)
-                operands.push(...normalized.allOf);
-            else
-                operands.push(normalized);
-        }
-        return {
-            allOf: uniqueSorted(operands, canonicalJson),
-        };
-    }
-    const operands = [];
-    for (const operand of expression.anyOf) {
-        const normalized = normalizePattern(operand);
-        if ('anyOf' in normalized)
-            operands.push(...normalized.anyOf);
-        else
-            operands.push(normalized);
-    }
-    return {
-        anyOf: uniqueSorted(operands, canonicalJson),
-    };
-}
-function normalizeCheck(expression) {
-    if ('check' in expression)
-        return expression;
-    if ('allOf' in expression) {
-        const operands = [];
-        for (const operand of expression.allOf) {
-            const normalized = normalizeCheck(operand);
-            if ('allOf' in normalized)
-                operands.push(...normalized.allOf);
-            else
-                operands.push(normalized);
-        }
-        return {
-            allOf: uniqueSorted(operands, canonicalJson),
-        };
-    }
-    const operands = [];
-    for (const operand of expression.anyOf) {
-        const normalized = normalizeCheck(operand);
-        if ('anyOf' in normalized)
-            operands.push(...normalized.anyOf);
-        else
-            operands.push(normalized);
-    }
-    return {
-        anyOf: uniqueSorted(operands, canonicalJson),
-    };
-}
-function patternDepth(expression) {
-    if ('source' in expression)
-        return 1;
-    if ('exists' in expression)
-        return 1 + patternDepth(expression.exists.where);
-    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
-    return 1 + Math.max(...operands.map(patternDepth));
-}
-function collectPatternDomains(expression, into) {
-    if ('source' in expression) {
-        into.add(expression.class.origin);
-        return;
-    }
-    if ('exists' in expression) {
-        for (const node of expression.exists.nodes)
-            into.add(node.class.origin);
-        collectPatternDomains(expression.exists.where, into);
-        return;
-    }
-    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
-    for (const operand of operands)
-        collectPatternDomains(operand, into);
-}
-function mergeBranches(left, right) {
-    return {
-        edges: [...left.edges, ...right.edges],
-        variables: new Set([...left.variables, ...right.variables]),
-    };
-}
-function patternBranches(expression, activeVariables = new Set()) {
-    if ('source' in expression) {
-        return [{ edges: [expression], variables: new Set(activeVariables) }];
-    }
-    if ('exists' in expression) {
-        const next = new Set(activeVariables);
-        for (const node of expression.exists.nodes)
-            next.add(node.variable.id);
-        return patternBranches(expression.exists.where, next);
-    }
-    if ('anyOf' in expression) {
-        const result = [];
-        for (const operand of expression.anyOf) {
-            result.push(...patternBranches(operand, activeVariables));
-            if (result.length > LIMITS.branches)
-                return result;
-        }
-        return result;
-    }
-    let result = [{ edges: [], variables: new Set(activeVariables) }];
-    for (const operand of expression.allOf) {
-        const operandBranches = patternBranches(operand, activeVariables);
-        const next = [];
-        for (const left of result) {
-            for (const right of operandBranches) {
-                next.push(mergeBranches(left, right));
-                if (next.length > LIMITS.branches)
-                    return next;
-            }
-        }
-        result = next;
-    }
-    return result;
-}
-function endpointKey(node) {
-    switch (node.kind) {
-        case 'subject':
-            return 'subject';
-        case 'object':
-            return 'object';
-        case 'variable':
-            return `variable:${node.id}`;
-    }
-}
-function validateBranchConnectivity(branch, field) {
-    const adjacency = new Map();
-    const required = new Set(['subject', 'object']);
-    for (const id of branch.variables)
-        required.add(`variable:${id}`);
-    const connect = (left, right) => {
-        const leftSet = adjacency.get(left) ?? new Set();
-        leftSet.add(right);
-        adjacency.set(left, leftSet);
-        const rightSet = adjacency.get(right) ?? new Set();
-        rightSet.add(left);
-        adjacency.set(right, rightSet);
-    };
-    for (const edge of branch.edges) {
-        const source = endpointKey(edge.source);
-        const target = endpointKey(edge.target);
-        required.add(source);
-        required.add(target);
-        connect(source, target);
-    }
-    const visited = new Set();
-    const queue = ['subject'];
-    while (queue.length > 0) {
-        const current = queue.shift();
-        if (visited.has(current))
-            continue;
-        visited.add(current);
-        for (const adjacent of adjacency.get(current) ?? [])
-            queue.push(adjacent);
-    }
-    const disconnected = [...required].filter((vertex) => !visited.has(vertex));
-    if (disconnected.length > 0) {
-        fail(field, `Every normalized Policy branch must connect subject, object and every scoped variable; disconnected: ${disconnected.join(', ')}`, 'one connected relational proof', 'disconnected Pattern branch');
-    }
-}
-function validateVariableScopes(expression, field, active = new Set(), declared = new Set()) {
-    if ('source' in expression) {
-        for (const endpoint of [expression.source, expression.target]) {
-            if (endpoint.kind === 'variable' && !active.has(endpoint.id)) {
-                fail(field, `Policy variable ${endpoint.id} escaped the exists() callback that declared it`, 'variable used only inside its declaring exists().where', `out-of-scope variable ${endpoint.id}`);
-            }
-        }
-        return;
-    }
-    if ('exists' in expression) {
-        if (expression.exists.nodes.length === 0) {
-            fail(field, 'exists() must declare at least one variable Node');
-        }
-        if (expression.exists.nodes.length > LIMITS.variablesPerExists) {
-            fail(field, `exists() declares ${expression.exists.nodes.length} variables; V1 allows ${LIMITS.variablesPerExists}`);
-        }
-        const next = new Set(active);
-        for (const node of expression.exists.nodes) {
-            const id = node.variable.id;
-            if (declared.has(id)) {
-                fail(field, `Policy variable ${id} is declared more than once`);
-            }
-            declared.add(id);
-            next.add(id);
-        }
-        validateVariableScopes(expression.exists.where, field, next, declared);
-        return;
-    }
-    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
-    for (const operand of operands)
-        validateVariableScopes(operand, field, active, declared);
-}
-function rewriteVariableIds(expression, mapping = new Map(), counter = { value: 0 }) {
-    const rewriteNode = (node) => {
-        if (node.kind !== 'variable')
-            return node;
-        const rewritten = mapping.get(node.id);
-        if (rewritten === undefined) {
-            fail('policies', `Policy variable ${node.id} has no active declaration`);
-        }
-        return { kind: 'variable', id: rewritten };
-    };
-    if ('source' in expression) {
-        return {
-            ...expression,
-            source: rewriteNode(expression.source),
-            target: rewriteNode(expression.target),
-        };
-    }
-    if ('exists' in expression) {
-        const scoped = new Map(mapping);
-        const nodes = expression.exists.nodes.map((node) => {
-            const id = counter.value++;
-            scoped.set(node.variable.id, id);
-            return { variable: { kind: 'variable', id }, class: node.class };
-        });
-        return {
-            exists: {
-                nodes,
-                where: rewriteVariableIds(expression.exists.where, scoped, counter),
-            },
-        };
-    }
-    if ('allOf' in expression) {
-        return {
-            allOf: expression.allOf.map((operand) => rewriteVariableIds(operand, mapping, counter)),
-        };
-    }
-    return {
-        anyOf: expression.anyOf.map((operand) => rewriteVariableIds(operand, mapping, counter)),
-    };
-}
-function validatePattern(expression, field, ownerOrigin) {
-    validateVariableScopes(expression, field);
-    const depth = patternDepth(expression);
-    if (depth > LIMITS.depth) {
-        fail(field, `Policy Pattern depth ${depth} exceeds the V1 limit ${LIMITS.depth}`);
-    }
-    const branches = patternBranches(expression);
-    if (branches.length > LIMITS.branches) {
-        fail(field, `Policy Pattern has more than ${LIMITS.branches} normalized branches`);
-    }
-    for (const branch of branches) {
-        if (branch.edges.length > LIMITS.edgesPerBranch) {
-            fail(field, `Policy branch has ${branch.edges.length} edge predicates; V1 allows ${LIMITS.edgesPerBranch}`);
-        }
-        validateBranchConnectivity(branch, field);
-    }
-    const domains = new Set([ownerOrigin]);
-    collectPatternDomains(expression, domains);
-    if (domains.size > LIMITS.domains) {
-        fail(field, `Policy references ${domains.size} Domains; V1 allows ${LIMITS.domains}`);
-    }
-    return {
-        depth,
-        edgeCounts: branches.map((branch) => branch.edges.length),
-        domains,
-    };
-}
-function callableDepth(expression) {
-    if ('check' in expression)
-        return 1;
-    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
-    return 1 + Math.max(...operands.map(callableDepth));
-}
-function callableBranches(expression) {
-    if ('check' in expression)
-        return 1;
-    if ('allOf' in expression) {
-        return expression.allOf.reduce((total, operand) => total * callableBranches(operand), 1);
-    }
-    return expression.anyOf.reduce((total, operand) => total + callableBranches(operand), 0);
-}
-function callableLeaves(expression) {
-    if ('check' in expression)
-        return 1;
-    const operands = 'allOf' in expression ? expression.allOf : expression.anyOf;
-    return operands.reduce((total, operand) => total + callableLeaves(operand), 0);
-}
-function validateCallable(expression, field) {
-    const depth = callableDepth(expression);
-    const branches = callableBranches(expression);
-    const leaves = callableLeaves(expression);
-    if (depth > LIMITS.depth) {
-        fail(field, `Callable Policy depth ${depth} exceeds the V1 limit ${LIMITS.depth}`);
-    }
-    if (branches > LIMITS.branches) {
-        fail(field, `Callable Policy has ${branches} normalized branches; V1 allows ${LIMITS.branches}`);
-    }
-    if (leaves > LIMITS.callableLeaves) {
-        fail(field, `Callable Policy has ${leaves} check leaves; V1 allows ${LIMITS.callableLeaves}`);
-    }
-}
-function zodObjectShape(schema) {
-    const def = getZodDef(schema);
-    if (!def || !['ZodObject', 'object'].includes(getZodTypeName(def) ?? ''))
-        return null;
-    const shape = typeof def.shape === 'function' ? def.shape() : def.shape;
-    return shape && typeof shape === 'object' ? shape : null;
-}
-export class PolicyCompiler {
-    schema;
-    localDefs;
-    importedDefs = [];
-    policyNames = new Map();
-    declarations = new Map();
-    measures = new Map();
-    nextVariableId = 0;
-    typing;
-    constructor(schema) {
-        this.schema = schema;
-        this.localDefs = buildDescriptorMap(schema);
-        for (const imported of schema.imports) {
-            this.importedDefs.push({ origin: imported.domain, map: buildDescriptorMap(imported) });
-        }
-        for (const [name, definition] of Object.entries(schema.policies ?? {})) {
-            this.policyNames.set(definition, name);
-        }
-    }
-    get hasStandalonePolicies() {
-        return Object.values(this.schema.functions).some((fn) => Boolean(fn.config.policy));
-    }
-    compileDeclarations() {
-        const result = {};
-        for (const [name] of Object.entries(this.schema.policies ?? {})) {
-            result[name] = this.compileNamed(name, []);
-        }
-        for (const name of Object.keys(result))
-            this.measureNamed(name, []);
-        this.typing = new PolicyTyping(this.schema, result);
-        this.typing.validateDeclarations();
-        return result;
-    }
-    compileNodePolicies(definition, field) {
-        const configured = definition.config.policies;
-        if (!configured)
-            return undefined;
-        if (!configured.read)
-            return {};
-        const ref = this.resolvePolicyRef(configured.read, `${field}.read`);
-        this.policyTyping().assertAccepts(ref, this.policyTyping().contractOf(definition, `${field}.read`), `${field}.read`);
-        return { read: ref };
-    }
-    compileMethodPolicy(definition, owner, field) {
-        const callback = definition.config.policy;
-        if (!callback)
-            return undefined;
-        if (!isNode(owner)) {
-            return fail(field, `Application Policies are supported on Node Methods only; '${owner.__kind}' is not a Node definition`);
-        }
-        const params = this.buildInputBindings(definition.config.params ?? {}, `${field}.input`);
-        const builder = {
-            input: params,
-            params,
-            ...this.callableOperators(field),
-        };
-        if (!definition.config.static) {
-            builder.self = makeCheckBinding({ kind: 'self' }, owner);
-        }
-        let built;
-        try {
-            built = callback(builder);
-        }
-        catch (error) {
-            if (error instanceof SchemaValidationError)
-                throw error;
-            return fail(field, `Failed to build callable Policy '${field}': ${String(error)}`);
-        }
-        const normalized = normalizeCheck(getCheckExpression(built, field));
-        validateCallable(normalized, field);
-        return normalized;
-    }
-    compileFunctionPolicy(definition, field) {
-        const callback = definition.config.policy;
-        if (!callback)
-            return undefined;
-        const shape = zodObjectShape(definition.config.input);
-        if (!shape) {
-            return fail(`${field}.input`, `A standalone Function with a Policy must use one direct Zod object input`, 'z.object({...})', 'non-object input');
-        }
-        const builder = {
-            input: this.buildInputBindings(shape, `${field}.input`),
-            ...this.callableOperators(field),
-        };
-        let built;
-        try {
-            built = callback(builder);
-        }
-        catch (error) {
-            if (error instanceof SchemaValidationError)
-                throw error;
-            return fail(field, `Failed to build callable Policy '${field}': ${String(error)}`);
-        }
-        const normalized = normalizeCheck(getCheckExpression(built, field));
-        validateCallable(normalized, field);
-        return normalized;
-    }
-    compileNamed(name, stack) {
-        const cached = this.declarations.get(name);
-        if (cached)
-            return cached;
-        if (stack.includes(name)) {
-            return fail(`policies.${name}`, `Named Policy composition cycle: ${[...stack, name].join(' -> ')}`);
-        }
-        const definition = this.schema.policies?.[name];
-        if (!definition)
-            return fail(`policies.${name}`, `Unknown local Policy '${name}'`);
-        const config = definition.input;
-        let declaration;
-        if ('match' in config) {
-            this.nextVariableId = 0;
-            let built;
-            try {
-                built = config.match(this.patternBuilder(`policies.${name}.match`));
-            }
-            catch (error) {
-                if (error instanceof SchemaValidationError)
-                    throw error;
-                return fail(`policies.${name}.match`, `Failed to build Policy '${name}': ${String(error)}`);
-            }
-            const raw = getPatternExpression(built, `policies.${name}.match`);
-            const normalized = normalizePattern(raw);
-            validateVariableScopes(normalized, `policies.${name}.match`);
-            const alphaNormalized = alphaNormalizePattern(normalized).ir;
-            const canonical = normalizePattern(rewriteVariableIds(alphaNormalized));
-            this.measures.set(name, validatePattern(canonical, `policies.${name}.match`, this.schema.domain));
-            declaration =
-                config.description !== undefined
-                    ? { description: config.description, match: canonical }
-                    : { match: canonical };
-        }
-        else if (config.__type === 'policy-composition') {
-            if (config.policies.length === 0) {
-                return fail(`policies.${name}`, `Named Policy composition must be non-empty`);
-            }
-            const refs = config.policies.map((operand) => {
-                const ref = this.resolvePolicyRef(operand, `policies.${name}.${config.operator}`);
-                this.compileNamed(ref.name, [...stack, name]);
-                return ref;
-            });
-            const normalized = uniqueSorted(refs, (ref) => `${ref.origin}\u0000${ref.kind}\u0000${ref.name}`);
-            declaration = config.operator === 'allOf' ? { allOf: normalized } : { anyOf: normalized };
-        }
-        else {
-            return fail(`policies.${name}`, `Policy '${name}' must contain exactly one match or named composition expression`);
-        }
-        this.declarations.set(name, declaration);
-        return declaration;
-    }
-    measureNamed(name, stack) {
-        const cached = this.measures.get(name);
-        if (cached)
-            return cached;
-        if (stack.includes(name)) {
-            return fail(`policies.${name}`, `Named Policy composition cycle at '${name}'`);
-        }
-        const declaration = this.declarations.get(name) ?? this.compileNamed(name, stack);
-        if ('match' in declaration)
-            return this.measures.get(name);
-        const operator = 'allOf' in declaration ? 'allOf' : 'anyOf';
-        const refs = 'allOf' in declaration ? declaration.allOf : declaration.anyOf;
-        const operands = refs.map((ref) => this.measureNamed(ref.name, [...stack, name]));
-        const depth = 1 + Math.max(...operands.map((operand) => operand.depth));
-        let edgeCounts;
-        if (operator === 'anyOf') {
-            edgeCounts = operands.flatMap((operand) => operand.edgeCounts);
-        }
-        else {
-            edgeCounts = [0];
-            for (const operand of operands) {
-                edgeCounts = edgeCounts.flatMap((left) => operand.edgeCounts.map((right) => left + right));
-                if (edgeCounts.length > LIMITS.branches)
-                    break;
-            }
-        }
-        const domains = new Set([this.schema.domain]);
-        for (const operand of operands) {
-            for (const origin of operand.domains)
-                domains.add(origin);
-        }
-        if (depth > LIMITS.depth) {
-            fail(`policies.${name}`, `Expanded named Policy depth ${depth} exceeds the V1 limit ${LIMITS.depth}`);
-        }
-        if (edgeCounts.length > LIMITS.branches) {
-            fail(`policies.${name}`, `Expanded named Policy has more than ${LIMITS.branches} normalized branches`);
-        }
-        if (Math.max(...edgeCounts) > LIMITS.edgesPerBranch) {
-            fail(`policies.${name}`, `Expanded named Policy exceeds ${LIMITS.edgesPerBranch} edge predicates in one branch`);
-        }
-        if (domains.size > LIMITS.domains) {
-            fail(`policies.${name}`, `Expanded named Policy references ${domains.size} Domains; V1 allows ${LIMITS.domains}`);
-        }
-        const measure = { depth, edgeCounts, domains };
-        this.measures.set(name, measure);
-        return measure;
-    }
-    patternBuilder(field) {
-        const subject = makePatternBinding({ kind: 'subject' });
-        const object = makePatternBinding({ kind: 'object' });
-        const edge = (input) => {
-            if (!input || typeof input !== 'object')
-                return fail(field, 'edge() expects an object');
-            const edgeClass = this.resolveLazyDefinition(input.class, `${field}.edge.class`);
-            if (!isDefinition(edgeClass) || !isEdgeClass(edgeClass)) {
-                return fail(`${field}.edge.class`, `Policy edge() requires an exact Edge Class`);
-            }
-            let repeat = input.repeat;
-            if (repeat) {
-                const valid = Number.isInteger(repeat.min) &&
-                    Number.isInteger(repeat.max) &&
-                    repeat.min >= 0 &&
-                    repeat.min <= repeat.max &&
-                    repeat.max <= LIMITS.repeat;
-                if (!valid) {
-                    return fail(`${field}.edge.repeat`, `Policy repeat must satisfy 0 <= min <= max <= ${LIMITS.repeat}`);
-                }
-                if (repeat.min === 1 && repeat.max === 1)
-                    repeat = undefined;
-            }
-            return makePatternExpression({
-                source: this.patternEndpoint(input.source, `${field}.edge.source`),
-                class: this.resolveDefinitionRef(edgeClass, 'edge-class', `${field}.edge.class`),
-                target: this.patternEndpoint(input.target, `${field}.edge.target`),
-                ...(repeat ? { repeat } : {}),
-            });
-        };
-        const allOf = (first, ...rest) => makePatternExpression({
-            allOf: [first, ...rest].map((value) => getPatternExpression(value, field)),
-        });
-        const anyOf = (first, ...rest) => makePatternExpression({
-            anyOf: [first, ...rest].map((value) => getPatternExpression(value, field)),
-        });
-        const exists = (build) => {
-            if (typeof build !== 'function')
-                return fail(`${field}.exists`, 'exists() expects a callback');
-            const nodes = [];
-            const where = build({
-                node: (definition) => {
-                    const nodeClass = this.resolveLazyDefinition(definition, `${field}.exists.node`);
-                    if (!isDefinition(nodeClass) || !isNodeClass(nodeClass)) {
-                        return fail(`${field}.exists.node`, `exists().node() requires an exact Node Class`);
-                    }
-                    if (nodes.length >= LIMITS.variablesPerExists) {
-                        return fail(`${field}.exists.nodes`, `exists() may declare at most ${LIMITS.variablesPerExists} variable Nodes`);
-                    }
-                    const variable = { kind: 'variable', id: this.nextVariableId++ };
-                    nodes.push({
-                        variable,
-                        class: this.resolveDefinitionRef(nodeClass, 'node-class', `${field}.exists.node`),
-                    });
-                    return makePatternBinding(variable);
-                },
-            });
-            if (nodes.length === 0) {
-                return fail(`${field}.exists`, `exists() must declare at least one variable Node`);
-            }
-            return makePatternExpression({
-                exists: {
-                    nodes: nodes,
-                    where: getPatternExpression(where, `${field}.exists.where`),
-                },
-            });
-        };
-        return Object.freeze({ subject, object, edge, exists, allOf, anyOf });
-    }
-    patternEndpoint(value, field) {
-        if (typeof value === 'object' && value !== null && PATTERN_BINDING in value) {
-            return value[PATTERN_BINDING];
-        }
-        return fail(field, `Policy edge endpoint must be subject, object, or an exists() variable`);
-    }
-    callableOperators(field) {
-        const check = (policy, object) => {
-            if (typeof object !== 'object' || object === null || !(CHECK_BINDING in object)) {
-                return fail(`${field}.check`, `check() object must be self or one direct ref() input field`);
-            }
-            const binding = object[CHECK_BINDING];
-            this.assertDirectNode(binding.target, `${field}.check.object`);
-            const ref = this.resolvePolicyRef(policy, `${field}.check`);
-            this.policyTyping().assertAccepts(ref, this.policyTyping().contractOf(binding.target, `${field}.check.object`), `${field}.check`);
-            return makeCheckExpression({
-                check: ref,
-                object: binding.object,
-            });
-        };
-        const allOf = (first, ...rest) => makeCheckExpression({
-            allOf: [first, ...rest].map((value) => getCheckExpression(value, field)),
-        });
-        const anyOf = (first, ...rest) => makeCheckExpression({
-            anyOf: [first, ...rest].map((value) => getCheckExpression(value, field)),
-        });
-        return { check, allOf, anyOf };
-    }
-    buildInputBindings(shape, field) {
-        const result = {};
-        for (const [name, schema] of Object.entries(shape)) {
-            if (!hasRefTag(schema))
-                continue;
-            const meta = getRefMeta(schema);
-            if (!meta)
-                continue;
-            const target = this.assertDirectNode(meta.target, `${field}.${name}`);
-            result[name] = makeCheckBinding({ kind: 'input', field: name }, target);
-        }
-        return Object.freeze(result);
-    }
-    assertDirectNode(value, field) {
-        if (!('__kind' in value) || !isNode(value)) {
-            return fail(field, `Callable Policy objects must be direct ref() values to Node definitions`);
-        }
-        const definition = value;
-        this.resolveAnyDefinition(definition, field);
-        return definition;
-    }
-    resolvePolicyRef(input, field) {
-        const definition = this.resolveLazyPolicy(input, field);
-        const name = this.policyNames.get(definition);
-        if (!name) {
-            return fail(field, `Policy uses must reference a named Policy registered in this schema`, 'local named Policy', 'unregistered or foreign Policy');
-        }
-        return { origin: this.schema.domain, kind: 'policy', name };
-    }
-    resolveLazyPolicy(input, field) {
-        const value = this.resolveLazyDefinition(input, field);
-        if (typeof value !== 'object' || value === null || value.__type !== 'policy') {
-            return fail(field, `Policy reference must resolve to a value created by definePolicy()`);
-        }
-        return value;
-    }
-    resolveLazyDefinition(input, field) {
-        if (typeof input !== 'function')
-            return input;
-        try {
-            return input();
-        }
-        catch (error) {
-            return fail(field, `Failed to resolve lazy Policy reference: ${String(error)}`);
-        }
-    }
-    policyTyping() {
-        return (this.typing ?? fail('policies', 'Policy declarations must compile before Policy use sites'));
-    }
-    resolveDefinitionRef(definition, kind, field) {
-        if (definition.__kind !== kind) {
-            return fail(field, `Expected ${kind}, received ${definition.__kind}`);
-        }
-        const resolved = this.resolveAnyDefinition(definition, field);
-        return { origin: resolved.origin, kind, name: resolved.descriptor.name };
-    }
-    resolveAnyDefinition(definition, field) {
-        const local = this.localDefs.get(definition);
-        if (local)
-            return { origin: this.schema.domain, descriptor: local };
-        for (const imported of this.importedDefs) {
-            const descriptor = imported.map.get(definition);
-            if (descriptor)
-                return { origin: imported.origin, descriptor };
-        }
-        const transitive = findDefTransitive(this.schema, definition);
-        if (transitive) {
-            return fail(field, `Policy relation refs may use only the owning Domain or an exact direct dependency; '${transitive.origin}' is transitive via ${transitive.path.join(' -> ')}`);
-        }
-        return fail(field, `Policy references a definition not registered in this schema or its imports`);
-    }
-}
-//# sourceMappingURL=policies.js.map