@atlasauth/pca-analyzer 0.0.0-stage → 0.2.0

package/dist/enumerate.js

@@ -0,0 +1,375 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_COMBINATIONS = void 0;
+exports.normalizePolicy = normalizePolicy;
+exports.toModel = toModel;
+exports.collectProbes = collectProbes;
+exports.productSize = productSize;
+exports.representatives = representatives;
+exports.admits = admits;
+exports.admitsAction = admitsAction;
+exports.repToAction = repToAction;
+exports.search = search;
+const pca_1 = require("@atlasauth/pca");
+const caveats_1 = require("./caveats");
+const field_1 = require("./field");
+const types_1 = require("./types");
+/**
+ * The bounded decision engine. It builds a finite set of representative actions ("the grid") from the
+ * literals, thresholds, prefixes, verbs and resource matchers that appear in the policies (and, for
+ * intent conformance, the intent). Because PCA's `where` theory is a boolean combination of
+ * threshold/membership/prefix tests, each policy's admitted region is a union of grid cells, so one
+ * representative per cell is DISTINGUISHING: any two policies that differ on some action also differ on
+ * some representative. Evaluating the REAL `evaluatePredicates` at each representative (plus the static
+ * caveat gate) therefore decides reachability, subsumption, disjointness and equivalence EXACTLY for
+ * the decided fragment, and yields a concrete counterexample whenever a relation fails.
+ *
+ * Out-of-fragment features (`re:` regex resources, cross-field `ref` conditions) and grids larger than
+ * the bound are detected and reported as `approximate`, and every verdict then fails safe.
+ */
+const ABSENT = Symbol('analyzer-absent-field');
+const FRESH_VERB = '\u0000atlas-analyzer::fresh-verb\u0000';
+const FRESH_RESOURCE = '\u0000atlas-analyzer::fresh-resource\u0000';
+/** Default cap on the representative grid size (product of all dimensions). */
+exports.DEFAULT_MAX_COMBINATIONS = 200_000;
+function normalizePolicy(p) {
+    const predicates = Array.isArray(p.predicates) ? p.predicates : [];
+    const caveats = 'caveats' in p && Array.isArray(p.caveats) ? p.caveats : [];
+    return { predicates, caveats };
+}
+/**
+ * Collect over-approximation reasons from one condition tree. Boolean groupings (all_of/any_of/not)
+ * are DECIDED EXACTLY as long as every leaf uses a decidable op — the admitted region stays a boolean
+ * combination of the same per-field cells, so the representative grid remains distinguishing — so the
+ * grouping itself is not undecidable; only its hard leaves are. The genuinely-hard leaf ops
+ * (`like`/`matches`/`is_a`/`member_of`), a cross-field `ref`, and a whole-`action.params` condition
+ * force a conservative over-approximation (verdict fails safe).
+ */
+function conditionUndecidable(c, reasons) {
+    if (c === null || typeof c !== 'object')
+        return;
+    if ((0, pca_1.isGroupCondition)(c)) {
+        if ('all_of' in c && Array.isArray(c.all_of))
+            for (const x of c.all_of)
+                conditionUndecidable(x, reasons);
+        else if ('any_of' in c && Array.isArray(c.any_of))
+            for (const x of c.any_of)
+                conditionUndecidable(x, reasons);
+        else if ('not' in c)
+            conditionUndecidable(c.not, reasons);
+        return;
+    }
+    if (!(0, pca_1.isLeafCondition)(c))
+        return;
+    if (c.ref !== undefined) {
+        reasons.add('cross-field `ref` condition — the relation between two fields is not resolved');
+    }
+    if (c.field === 'action.params') {
+        reasons.add('condition on the whole `action.params` object is not enumerated precisely');
+    }
+    if (c.op === 'like' || c.op === 'matches' || c.op === 'is_a' || c.op === 'member_of') {
+        reasons.add(`\`${c.op}\` condition — matched by over-approximation, not enumerated exactly`);
+    }
+}
+function detectUndecidable(predicates) {
+    const reasons = new Set();
+    for (const p of predicates) {
+        if (p === null || typeof p !== 'object')
+            continue;
+        const r = p.resource;
+        if (typeof r === 'string' && r.startsWith('re:')) {
+            reasons.add('re: regex resource matcher — resource dimension cannot be soundly enumerated');
+        }
+        if (Array.isArray(p.where))
+            for (const c of p.where)
+                conditionUndecidable(c, reasons);
+    }
+    return [...reasons];
+}
+function toModel(p) {
+    const { predicates, caveats } = normalizePolicy(p);
+    const ca = (0, caveats_1.analyzeCaveats)(caveats);
+    return {
+        predicates,
+        caveats,
+        caveatSat: ca.sat,
+        caveatReason: ca.reason,
+        revCap: ca.revCap,
+        undecidable: detectUndecidable(predicates),
+    };
+}
+function addVerbLiterals(c, into) {
+    const v = c.value;
+    if (c.op === 'eq' || c.op === 'ne' || c.op === 'prefix' || c.op === 'like' || c.op === 'is_a') {
+        if (typeof v === 'string')
+            into.add(v);
+    }
+    else if ((c.op === 'in' || c.op === 'nin') && Array.isArray(v)) {
+        for (const x of v)
+            if (typeof x === 'string')
+                into.add(x);
+    }
+}
+function collectProbes(inputs) {
+    const verbLiterals = new Set(inputs.extraVerbs ?? []);
+    const resourceLiterals = new Set();
+    const fieldConds = new Map();
+    const addFieldCond = (path, c) => {
+        const arr = fieldConds.get(path) ?? [];
+        arr.push(c);
+        fieldConds.set(path, arr);
+    };
+    const classifyResource = (r) => {
+        if (r === undefined || r === '*')
+            return; // universal: FRESH_RESOURCE represents it
+        if (r.startsWith('re:'))
+            return; // undecidable: FRESH_RESOURCE stands in (flagged on the model)
+        if (r.endsWith('*')) {
+            const body = r.slice(0, -1);
+            resourceLiterals.add(body);
+            resourceLiterals.add(body + 'x');
+            return;
+        }
+        resourceLiterals.add(r);
+    };
+    const handleCond = (c) => {
+        if (c === null || typeof c !== 'object')
+            return;
+        // Recurse through boolean groupings and bucket their leaves (keeps the grid distinguishing for
+        // nested boolean logic over decidable ops).
+        if ((0, pca_1.isGroupCondition)(c)) {
+            if ('all_of' in c && Array.isArray(c.all_of))
+                for (const x of c.all_of)
+                    handleCond(x);
+            else if ('any_of' in c && Array.isArray(c.any_of))
+                for (const x of c.any_of)
+                    handleCond(x);
+            else if ('not' in c)
+                handleCond(c.not);
+            return;
+        }
+        if (!(0, pca_1.isLeafCondition)(c))
+            return;
+        if (c.field === 'action.verb') {
+            addVerbLiterals(c, verbLiterals);
+            return;
+        }
+        if (c.field === 'action.resource') {
+            if (c.op === 'prefix' && typeof c.value === 'string')
+                classifyResource(c.value + '*');
+            else if (typeof c.value === 'string')
+                classifyResource(c.value);
+            else if (Array.isArray(c.value))
+                for (const x of c.value)
+                    if (typeof x === 'string')
+                        classifyResource(x);
+            return;
+        }
+        addFieldCond(c.field, c);
+    };
+    for (const list of inputs.predicateSets) {
+        for (const p of list) {
+            if (p === null || typeof p !== 'object')
+                continue;
+            if (typeof p.verb === 'string') {
+                if (p.verb !== '*')
+                    verbLiterals.add(p.verb);
+            }
+            else if (Array.isArray(p.verb)) {
+                for (const v of p.verb)
+                    if (typeof v === 'string' && v !== '*')
+                        verbLiterals.add(v);
+            }
+            classifyResource(p.resource);
+            if (Array.isArray(p.where))
+                for (const c of p.where)
+                    handleCond(c);
+        }
+    }
+    for (const r of inputs.extraResources ?? [])
+        classifyResource(r);
+    for (const ec of inputs.extraFieldConditions ?? [])
+        handleCond({ ...ec.cond, field: ec.path });
+    const fields = [...fieldConds.entries()].map(([path, conds]) => ({
+        path,
+        values: [...(0, field_1.fieldProbes)(conds), ABSENT],
+    }));
+    return {
+        verbs: [...verbLiterals, FRESH_VERB],
+        resources: [...resourceLiterals, FRESH_RESOURCE],
+        revClasses: inputs.varyReversibility ? [...types_1.REVERSIBILITY_ORDER] : [undefined],
+        fields,
+    };
+}
+function productSize(pr) {
+    let n = pr.verbs.length * pr.resources.length * pr.revClasses.length;
+    for (const f of pr.fields)
+        n *= f.values.length;
+    return n;
+}
+function* enumerateFields(fields, i, acc) {
+    if (i >= fields.length) {
+        yield new Map(acc);
+        return;
+    }
+    const f = fields[i];
+    if (f === undefined) {
+        yield new Map(acc);
+        return;
+    }
+    for (const v of f.values) {
+        if (v === ABSENT) {
+            acc.delete(f.path);
+        }
+        else {
+            acc.set(f.path, v);
+        }
+        yield* enumerateFields(fields, i + 1, acc);
+    }
+    acc.delete(f.path);
+}
+function* representatives(pr) {
+    for (const verb of pr.verbs) {
+        for (const resource of pr.resources) {
+            for (const revClass of pr.revClasses) {
+                for (const assignments of enumerateFields(pr.fields, 0, new Map())) {
+                    yield { verb, resource, revClass, assignments };
+                }
+            }
+        }
+    }
+}
+function branch() {
+    return { leaf: false, children: new Map() };
+}
+function insert(root, segs, value) {
+    let node = root;
+    for (let i = 0; i < segs.length - 1; i++) {
+        const key = segs[i];
+        if (key === undefined || node.leaf)
+            return;
+        const next = node.children.get(key);
+        if (next === undefined || next.leaf) {
+            const created = branch();
+            node.children.set(key, created);
+            node = created;
+        }
+        else {
+            node = next;
+        }
+    }
+    const last = segs[segs.length - 1];
+    if (last !== undefined && !node.leaf)
+        node.children.set(last, { leaf: true, value });
+}
+function materialize(node) {
+    const out = {};
+    if (node.leaf)
+        return out;
+    for (const [key, child] of node.children) {
+        out[key] = child.leaf ? child.value : materialize(child);
+    }
+    return out;
+}
+function buildRoots(rep) {
+    const roots = new Map([
+        ['action', branch()],
+        ['subject', branch()],
+        ['env', branch()],
+    ]);
+    for (const [path, value] of rep.assignments) {
+        const segs = path.split('.');
+        const first = segs[0];
+        if (first === undefined || segs.length < 2)
+            continue;
+        const root = roots.get(first);
+        if (root === undefined)
+            continue; // only action / subject / env roots are addressable
+        insert(root, segs.slice(1), value);
+    }
+    const actionTree = roots.get('action');
+    const subjectTree = roots.get('subject');
+    const envTree = roots.get('env');
+    const action = { verb: rep.verb, resource: rep.resource, params: {} };
+    if (actionTree !== undefined && !actionTree.leaf) {
+        for (const [key, child] of actionTree.children) {
+            if (key === 'verb' || key === 'resource')
+                continue; // fixed from the rep
+            if (key === 'params') {
+                // `action.params.*` branches materialize to a typed record; a whole-`params` leaf is flagged
+                // undecidable upstream, so it is safe to ignore here (params stays an empty, present object).
+                if (!child.leaf)
+                    action.params = materialize(child);
+            }
+            else {
+                action[key] = child.leaf ? child.value : materialize(child);
+            }
+        }
+    }
+    if (rep.revClass !== undefined)
+        action.reversibility_class = rep.revClass;
+    const subject = subjectTree === undefined || subjectTree.leaf ? {} : materialize(subjectTree);
+    const env = envTree === undefined || envTree.leaf ? {} : materialize(envTree);
+    return { action, subject, env };
+}
+function contextFromRoots(roots) {
+    return { action: roots.action, subject: roots.subject, env: roots.env };
+}
+function reversibilityOk(model, revClass) {
+    if (model.revCap === undefined)
+        return true;
+    if (revClass === undefined)
+        return false; // a reversibility_max caveat denies an action with no class
+    const idx = types_1.REVERSIBILITY_ORDER.indexOf(revClass);
+    return idx >= 0 && idx <= model.revCap;
+}
+/** Does the policy admit this representative action? (predicate match AND static caveat gate.) */
+function admits(model, rep) {
+    if (!model.caveatSat)
+        return false;
+    if (!reversibilityOk(model, rep.revClass))
+        return false;
+    const ctx = contextFromRoots(buildRoots(rep));
+    return (0, pca_1.evaluatePredicates)(model.predicates, ctx).allowed;
+}
+/** Concrete admission of a fully-specified action (used by reachable's fast path; exact). */
+function admitsAction(model, action) {
+    if (!model.caveatSat)
+        return false;
+    if (!reversibilityOk(model, action.reversibilityClass))
+        return false;
+    const act = { verb: action.verb, resource: action.resource, params: { ...(action.params ?? {}) } };
+    if (action.reversibilityClass !== undefined)
+        act.reversibility_class = action.reversibilityClass;
+    const ctx = {
+        action: act,
+        subject: { ...(action.subject ?? {}) },
+        env: { ...(action.env ?? {}) },
+    };
+    return (0, pca_1.evaluatePredicates)(model.predicates, ctx).allowed;
+}
+function repToAction(rep) {
+    const roots = buildRoots(rep);
+    const action = { verb: rep.verb, resource: rep.resource, params: { ...roots.action.params } };
+    if (rep.revClass !== undefined)
+        action.reversibilityClass = rep.revClass;
+    if (Object.keys(roots.subject).length > 0)
+        action.subject = roots.subject;
+    if (Object.keys(roots.env).length > 0)
+        action.env = roots.env;
+    return action;
+}
+/**
+ * Walk the representative grid, stopping at the first rep for which `predicate` is true. Returns
+ * `overflow: true` (without walking) when the grid is larger than `max`.
+ */
+function search(pr, predicate, max) {
+    if (productSize(pr) > max)
+        return { overflow: true };
+    for (const rep of representatives(pr)) {
+        if (predicate(rep))
+            return { hit: rep, overflow: false };
+    }
+    return { overflow: false };
+}
+//# sourceMappingURL=enumerate.js.map

package/dist/enumerate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate.js","sourceRoot":"","sources":["../src/enumerate.ts"],"names":[],"mappings":";;;AAyCA,0CAIC;AA2CD,0BAWC;AA8BD,sCAyEC;AAED,kCAIC;AAqCD,0CAUC;AAwGD,wBAKC;AAGD,oCAWC;AAED,kCAOC;AAeD,wBAMC;AAxZD,wCAAuF;AAEvF,uCAA2C;AAC3C,mCAAsC;AACtC,mCAA8C;AAG9C;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,GAAkB,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAG9D,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAC5D,MAAM,cAAc,GAAG,4CAA4C,CAAC;AAEpE,+EAA+E;AAClE,QAAA,wBAAwB,GAAG,OAAO,CAAC;AAahD,SAAgB,eAAe,CAAC,CAAc;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,CAAY,EAAE,OAAoB;IAC9D,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO;IAChD,IAAI,IAAA,sBAAgB,EAAC,CAAC,CAAC,EAAE,CAAC;QACxB,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;aACpG,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;aACzG,IAAI,KAAK,IAAI,CAAC;YAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAA,qBAAe,EAAC,CAAC,CAAC;QAAE,OAAO;IAChC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,sEAAsE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAgC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,OAAO,CAAC,CAAc;IACpC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IACnC,OAAO;QACL,UAAU;QACV,OAAO;QACP,SAAS,EAAE,EAAE,CAAC,GAAG;QACjB,YAAY,EAAE,EAAE,CAAC,MAAM;QACvB,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,WAAW,EAAE,iBAAiB,CAAC,UAAU,CAAC;KAC3C,CAAC;AACJ,CAAC;AAqBD,SAAS,eAAe,CAAC,CAAgB,EAAE,IAAiB;IAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QAC9F,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,MAAmB;IAC/C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEtD,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,CAAgB,EAAQ,EAAE;QAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,CAAqB,EAAQ,EAAE;QACvD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,0CAA0C;QACpF,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,+DAA+D;QAChG,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5B,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAY,EAAQ,EAAE;QACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO;QAChD,+FAA+F;QAC/F,4CAA4C;QAC5C,IAAI,IAAA,sBAAgB,EAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;oBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;iBACjF,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;oBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;iBACtF,IAAI,KAAK,IAAI,CAAC;gBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAA,qBAAe,EAAC,CAAC,CAAC;YAAE,OAAO;QAChC,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAC9B,eAAe,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;iBACjF,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;iBAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QACD,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAClD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;oBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,GAAG;wBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;oBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE;QAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,oBAAoB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAE/F,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI;QACJ,MAAM,EAAE,CAAC,GAAG,IAAA,mBAAW,EAAC,KAAK,CAAC,EAAE,MAAM,CAAW;KAClD,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,YAAY,EAAE,UAAU,CAAC;QACpC,SAAS,EAAE,CAAC,GAAG,gBAAgB,EAAE,cAAc,CAAC;QAChD,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,2BAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAgB,WAAW,CAAC,EAAU;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM;QAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAChD,OAAO,CAAC,CAAC;AACX,CAAC;AAYD,QAAQ,CAAC,CAAC,eAAe,CACvB,MAAwB,EACxB,CAAS,EACT,GAAyB;IAEzB,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,QAAe,CAAC,CAAC,eAAe,CAAC,EAAU;IACzC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACpC,KAAK,MAAM,QAAQ,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;gBACrC,KAAK,MAAM,WAAW,IAAI,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;oBACnE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAoBD,SAAS,MAAM;IACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,IAAc,EAAE,IAAuB,EAAE,KAAc;IACrE,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAmB;QACtC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QACrB,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,oDAAoD;QACtF,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrF,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU;gBAAE,SAAS,CAAC,qBAAqB;YACzE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,6FAA6F;gBAC7F,8FAA8F;gBAC9F,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,mBAAmB,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1E,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAIzB;IACC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,eAAe,CAAC,KAAkB,EAAE,QAA4B;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,4DAA4D;IACtG,MAAM,GAAG,GAAI,2BAAyC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,kGAAkG;AAClG,SAAgB,MAAM,CAAC,KAAkB,EAAE,GAAQ;IACjD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAA,wBAAkB,EAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,6FAA6F;AAC7F,SAAgB,YAAY,CAAC,KAAkB,EAAE,MAAsB;IACrE,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,MAAM,GAAG,GAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;IAClH,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,GAAG,CAAC,mBAAmB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACjG,MAAM,GAAG,GAAkB;QACzB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QACtC,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;KAC/B,CAAC;IACF,OAAO,IAAA,wBAAkB,EAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,SAAgB,WAAW,CAAC,GAAQ;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9G,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,QAAQ,CAAC;IACzE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;GAGG;AACH,SAAgB,MAAM,CAAC,EAAU,EAAE,SAAgC,EAAE,GAAW;IAC9E,IAAI,WAAW,CAAC,EAAE,CAAC,GAAG,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/field.d.ts

@@ -0,0 +1,42 @@
+import { type Condition, type ConditionOp } from '@atlasauth/pca';
+/**
+ * The interval + finite-set engine for a single `where` field.
+ *
+ * PCA's `where` conditions over one field are a conjunction of threshold tests (lt/lte/gt/gte/eq on
+ * numbers), membership tests (eq/ne/in/nin over finite values) and string-prefix tests. Any such
+ * conjunction partitions the value line into finitely many CELLS on which every condition is constant,
+ * bounded by the literals that appear. Picking one representative value per cell is therefore a SOUND
+ * AND COMPLETE probe set for the decided fragment: two policies agree on all actions iff they agree on
+ * all actions drawn from these representatives (the finite-distinguishing-value property that makes the
+ * relational queries decidable by enumeration — see enumerate.ts).
+ *
+ * `ref` conditions (operand is another field) are NOT a single-field constraint; they are flagged
+ * upstream as undecidable and skipped here.
+ */
+/** A sentinel string guaranteed not to equal, be a prefix of, or be prefixed by any policy literal. */
+export declare const FRESH_STRING = "\0atlas-analyzer::fresh-unmatched\0";
+/**
+ * Compute the representative probe values for one field from the conjunction of `where` conditions on
+ * it. The result is finite and distinguishing for the decided fragment. The caller adds an `absent`
+ * representative separately (to probe `exists` and the params-absent fail-closed semantics).
+ */
+export declare function fieldProbes(conditions: readonly Condition[]): unknown[];
+export interface NumInterval {
+    lo: number;
+    loInclusive: boolean;
+    hi: number;
+    hiInclusive: boolean;
+}
+export declare const FULL_INTERVAL: NumInterval;
+/** Tighten an interval by one numeric condition. Returns the same interval for non-numeric operands. */
+export declare function tightenInterval(iv: NumInterval, op: ConditionOp, value: unknown): NumInterval;
+/** An interval is empty iff lo > hi, or lo == hi with either bound exclusive. */
+export declare function intervalEmpty(iv: NumInterval): boolean;
+/**
+ * Decide whether the numeric subset of a field's `where` conjunction is satisfiable. Detects, e.g.,
+ * `amount >= 100 AND amount <= 10` as unsatisfiable (empty interval). Conditions with non-numeric or
+ * `ref` operands, and boolean groupings (all_of/any_of/not), do not participate (they are decided by
+ * the finite-set / enumeration path); ignoring them only ever widens the interval, so a satisfiable
+ * verdict here is sound as a necessary condition.
+ */
+export declare function numericConjunctionSatisfiable(conditions: readonly Condition[]): boolean;

package/dist/field.js

@@ -0,0 +1,232 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FULL_INTERVAL = exports.FRESH_STRING = void 0;
+exports.fieldProbes = fieldProbes;
+exports.tightenInterval = tightenInterval;
+exports.intervalEmpty = intervalEmpty;
+exports.numericConjunctionSatisfiable = numericConjunctionSatisfiable;
+const pca_1 = require("@atlasauth/pca");
+/**
+ * The interval + finite-set engine for a single `where` field.
+ *
+ * PCA's `where` conditions over one field are a conjunction of threshold tests (lt/lte/gt/gte/eq on
+ * numbers), membership tests (eq/ne/in/nin over finite values) and string-prefix tests. Any such
+ * conjunction partitions the value line into finitely many CELLS on which every condition is constant,
+ * bounded by the literals that appear. Picking one representative value per cell is therefore a SOUND
+ * AND COMPLETE probe set for the decided fragment: two policies agree on all actions iff they agree on
+ * all actions drawn from these representatives (the finite-distinguishing-value property that makes the
+ * relational queries decidable by enumeration — see enumerate.ts).
+ *
+ * `ref` conditions (operand is another field) are NOT a single-field constraint; they are flagged
+ * upstream as undecidable and skipped here.
+ */
+/** A sentinel string guaranteed not to equal, be a prefix of, or be prefixed by any policy literal. */
+exports.FRESH_STRING = '\u0000atlas-analyzer::fresh-unmatched\u0000';
+function isFiniteNumber(v) {
+    return typeof v === 'number' && Number.isFinite(v);
+}
+/**
+ * Representatives of a numeric threshold arrangement: below the min, each threshold exactly, the open
+ * interval between each pair of consecutive thresholds (its midpoint), and above the max. This is the
+ * minimal set on which every `x {lt,lte,gt,gte,eq} t` built from these thresholds is constant per cell.
+ */
+function numericCellReps(thresholds) {
+    const sorted = [...new Set(thresholds)].filter(Number.isFinite).sort((a, b) => a - b);
+    if (sorted.length === 0)
+        return [];
+    const first = sorted[0];
+    const last = sorted[sorted.length - 1];
+    if (first === undefined || last === undefined)
+        return [];
+    const out = [first - 1];
+    for (let i = 0; i < sorted.length; i++) {
+        const ti = sorted[i];
+        if (ti === undefined)
+            continue;
+        out.push(ti);
+        const tn = sorted[i + 1];
+        if (tn !== undefined)
+            out.push((ti + tn) / 2);
+    }
+    out.push(last + 1);
+    return out;
+}
+/** A stable key for de-duplicating representative values of mixed type. */
+function valueKey(x) {
+    if (x === exports.FRESH_STRING)
+        return 's:__fresh__';
+    try {
+        return typeof x + ':' + JSON.stringify(x);
+    }
+    catch {
+        return typeof x + ':<unserializable>';
+    }
+}
+/**
+ * Compute the representative probe values for one field from the conjunction of `where` conditions on
+ * it. The result is finite and distinguishing for the decided fragment. The caller adds an `absent`
+ * representative separately (to probe `exists` and the params-absent fail-closed semantics).
+ */
+function fieldProbes(conditions) {
+    const literals = [];
+    const thresholds = [];
+    const prefixes = [];
+    let hasNumericOp = false;
+    for (const c of conditions) {
+        // Group conditions (all_of/any_of/not) are flattened to their leaves upstream by `collectProbes`;
+        // a cross-field `ref` relation is undecidable and also handled upstream. Skip either here.
+        if (!(0, pca_1.isLeafCondition)(c) || c.ref !== undefined)
+            continue;
+        const v = c.value;
+        switch (c.op) {
+            case 'eq':
+            case 'ne':
+                literals.push(v);
+                if (isFiniteNumber(v)) {
+                    thresholds.push(v);
+                    hasNumericOp = true;
+                }
+                break;
+            case 'in':
+            case 'nin':
+                if (Array.isArray(v)) {
+                    for (const x of v) {
+                        literals.push(x);
+                        if (isFiniteNumber(x)) {
+                            thresholds.push(x);
+                            hasNumericOp = true;
+                        }
+                    }
+                }
+                break;
+            case 'lt':
+            case 'lte':
+            case 'gt':
+            case 'gte':
+                if (isFiniteNumber(v)) {
+                    thresholds.push(v);
+                    hasNumericOp = true;
+                }
+                break;
+            case 'prefix':
+            case 'like':
+            case 'matches':
+            case 'is_a':
+                // The literal and a strictly-extending variant give the enumerator something to hit; the op
+                // itself is flagged undecidable, so the verdict fails safe regardless.
+                if (typeof v === 'string') {
+                    literals.push(v);
+                    if (c.op === 'prefix')
+                        prefixes.push(v);
+                }
+                break;
+            case 'member_of':
+                if (typeof v === 'string')
+                    literals.push(v);
+                else if (Array.isArray(v))
+                    for (const x of v)
+                        if (typeof x === 'string')
+                            literals.push(x);
+                break;
+            case 'exists':
+            default:
+                break;
+        }
+    }
+    const out = [];
+    const seen = new Set();
+    const add = (x) => {
+        const k = valueKey(x);
+        if (!seen.has(k)) {
+            seen.add(k);
+            out.push(x);
+        }
+    };
+    for (const l of literals)
+        add(l);
+    for (const n of numericCellReps(thresholds))
+        add(n);
+    for (const p of prefixes) {
+        add(p);
+        add(p + 'x'); // a value strictly extending the prefix (distinguishes prefix from exact)
+    }
+    add(exports.FRESH_STRING); // a value matching no eq/in/prefix literal
+    if (hasNumericOp && thresholds.length > 0) {
+        const mx = Math.max(...thresholds);
+        if (Number.isFinite(mx))
+            add(mx + 1); // a value above every numeric threshold
+    }
+    return out;
+}
+exports.FULL_INTERVAL = { lo: -Infinity, loInclusive: false, hi: Infinity, hiInclusive: false };
+/** Tighten an interval by one numeric condition. Returns the same interval for non-numeric operands. */
+function tightenInterval(iv, op, value) {
+    if (!isFiniteNumber(value))
+        return iv;
+    const next = { ...iv };
+    switch (op) {
+        case 'eq':
+            if (value > next.lo || (value === next.lo && !next.loInclusive)) {
+                next.lo = value;
+                next.loInclusive = true;
+            }
+            if (value < next.hi || (value === next.hi && !next.hiInclusive)) {
+                next.hi = value;
+                next.hiInclusive = true;
+            }
+            break;
+        case 'gte':
+            // A stricter existing lower bound (gt at the same value) is kept; only a higher value binds.
+            if (value > next.lo) {
+                next.lo = value;
+                next.loInclusive = true;
+            }
+            break;
+        case 'gt':
+            if (value > next.lo || (value === next.lo && next.loInclusive)) {
+                next.lo = value;
+                next.loInclusive = false;
+            }
+            break;
+        case 'lte':
+            if (value < next.hi) {
+                next.hi = value;
+                next.hiInclusive = true;
+            }
+            break;
+        case 'lt':
+            if (value < next.hi || (value === next.hi && next.hiInclusive)) {
+                next.hi = value;
+                next.hiInclusive = false;
+            }
+            break;
+        default:
+            break;
+    }
+    return next;
+}
+/** An interval is empty iff lo > hi, or lo == hi with either bound exclusive. */
+function intervalEmpty(iv) {
+    if (iv.lo > iv.hi)
+        return true;
+    if (iv.lo === iv.hi)
+        return !(iv.loInclusive && iv.hiInclusive);
+    return false;
+}
+/**
+ * Decide whether the numeric subset of a field's `where` conjunction is satisfiable. Detects, e.g.,
+ * `amount >= 100 AND amount <= 10` as unsatisfiable (empty interval). Conditions with non-numeric or
+ * `ref` operands, and boolean groupings (all_of/any_of/not), do not participate (they are decided by
+ * the finite-set / enumeration path); ignoring them only ever widens the interval, so a satisfiable
+ * verdict here is sound as a necessary condition.
+ */
+function numericConjunctionSatisfiable(conditions) {
+    let iv = exports.FULL_INTERVAL;
+    for (const c of conditions) {
+        if (!(0, pca_1.isLeafCondition)(c) || c.ref !== undefined)
+            continue;
+        iv = tightenInterval(iv, c.op, c.value);
+    }
+    return !intervalEmpty(iv);
+}
+//# sourceMappingURL=field.js.map