@atlasauth/pca-analyzer 0.0.0-stage → 0.2.0

package/dist/field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field.js","sourceRoot":"","sources":["../src/field.ts"],"names":[],"mappings":";;;AA8DA,kCAoFC;AAcD,0CA2CC;AAGD,sCAIC;AASD,sEAOC;AAlOD,wCAAmF;AAEnF;;;;;;;;;;;;;GAaG;AAEH,uGAAuG;AAC1F,QAAA,YAAY,GAAG,6CAA6C,CAAC;AAE1E,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,UAA6B;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,GAAG,GAAa,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,KAAK,oBAAY;QAAE,OAAO,aAAa,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,GAAG,mBAAmB,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,UAAgC;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,kGAAkG;QAClG,2FAA2F;QAC3F,IAAI,CAAC,IAAA,qBAAe,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAClB,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;YACb,KAAK,IAAI,CAAC;YACV,KAAK,IAAI;gBACP,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACnB,YAAY,GAAG,IAAI,CAAC;gBACtB,CAAC;gBACD,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,KAAK;gBACR,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrB,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACjB,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;4BACtB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;4BACnB,YAAY,GAAG,IAAI,CAAC;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,KAAK,CAAC;YACX,KAAK,IAAI,CAAC;YACV,KAAK,KAAK;gBACR,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACnB,YAAY,GAAG,IAAI,CAAC;gBACtB,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ,CAAC;YACd,KAAK,MAAM,CAAC;YACZ,KAAK,SAAS,CAAC;YACf,KAAK,MAAM;gBACT,4FAA4F;gBAC5F,uEAAuE;gBACvE,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjB,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;wBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBACD,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;qBACvC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,KAAK,MAAM,CAAC,IAAI,CAAC;wBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;4BAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1F,MAAM;YACR,KAAK,QAAQ,CAAC;YACd;gBACE,MAAM;QACV,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAU,EAAQ,EAAE;QAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,CAAC,CAAC,CAAC;QACP,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,0EAA0E;IAC1F,CAAC;IACD,GAAG,CAAC,oBAAY,CAAC,CAAC,CAAC,2CAA2C;IAC9D,IAAI,YAAY,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,wCAAwC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWY,QAAA,aAAa,GAAgB,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAElH,wGAAwG;AACxG,SAAgB,eAAe,CAAC,EAAe,EAAE,EAAe,EAAE,KAAc;IAC9E,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,IAAI,GAAgB,EAAE,GAAG,EAAE,EAAE,CAAC;IACpC,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI;YACP,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAC1B,CAAC;YACD,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAC1B,CAAC;YACD,MAAM;QACR,KAAK,KAAK;YACR,6FAA6F;YAC7F,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAC1B,CAAC;YACD,MAAM;QACR,KAAK,IAAI;YACP,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,KAAK;YACR,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAC1B,CAAC;YACD,MAAM;QACR,KAAK,IAAI;YACP,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YAC3B,CAAC;YACD,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAgB,aAAa,CAAC,EAAe;IAC3C,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,UAAgC;IAC5E,IAAI,EAAE,GAAG,qBAAa,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,qBAAe,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS;QACzD,EAAE,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @atlasauth/pca-analyzer — STATIC ANALYZABILITY OF AUTHORITY.
+ *
+ * PCA can prove a quantitative trust-budget bound and verify a single action, but on its own it cannot
+ * statically answer "what can this whole delegated authority EVER do?". This package decides that over
+ * PCA's predicate/caveat policy: reachability, vacuity/totality, delegation-safety subsumption,
+ * disjointness, equivalence, and — the distinct safety check — conformance to a declared intent
+ * envelope (the "$14k renewal under a $10k cap on an approved vendor still violates intent" class).
+ *
+ * The engine is a SOUND, BOUNDED decision procedure (Cedar/SymCC-style, but with no SMT dependency):
+ * it enumerates a finite, distinguishing set of representative actions built from the literals,
+ * thresholds, prefixes, verbs and resource matchers in the policies, and evaluates the REAL
+ * `evaluatePredicates` at each. See README.md for the exact decided fragment and the honest
+ * incompleteness boundary. Soundness rule: a verdict is reported as proven only when the fragment is
+ * fully decided; otherwise it fails safe and is marked `approximate`.
+ */
+import type { Condition } from '@atlasauth/pca';
+import { admits, admitsAction, collectProbes, repToAction, representatives, search, type Rep } from './enumerate';
+import type { AlwaysAllowsResult, AlwaysDeniesResult, AnalyzerAction, DisjointResult, EquivalentResult, Intent, IntentConformanceResult, PolicyInput, ReachableResult, SubsumesResult } from './types';
+export * from './types';
+export { analyzeCaveats } from './caveats';
+export type { CaveatAnalysis } from './caveats';
+export { numericConjunctionSatisfiable, tightenInterval, intervalEmpty, FULL_INTERVAL, type NumInterval, } from './field';
+export { DEFAULT_MAX_COMBINATIONS, toModel, type PolicyModel } from './enumerate';
+export interface AnalyzerOptions {
+    /** Cap on the representative grid size; a larger grid fails safe (`approximate`). */
+    maxCombinations?: number;
+}
+/**
+ * Can any input complete `action` into one the policy ALLOWs? (some predicate matches AND the caveat
+ * set is satisfiable). `verb` and `resource` are taken as given; unspecified `params` / `subject` /
+ * `env` fields are existentially searched. A returned `witness` is a concrete action verified against
+ * the real evaluator, so `reachable: true` is always proven. `reachable: false` is proven only for the
+ * decided fragment; otherwise it fails safe to `reachable: true, approximate: true`.
+ */
+export declare function reachable(policy: PolicyInput, action: AnalyzerAction, opts?: AnalyzerOptions): ReachableResult;
+/**
+ * Is the policy vacuous — does it deny everything (optionally restricted to `verb`)? Proven only for
+ * the decided fragment; any undecidable feature or grid overflow fails safe to `alwaysDenies: false`
+ * (assume it can admit something).
+ */
+export declare function alwaysDenies(policy: PolicyInput, verb?: string, opts?: AnalyzerOptions): AlwaysDeniesResult;
+/**
+ * Is the policy total for `verb` — does it admit EVERY action of that verb (any resource, any params)?
+ * Proven only for the decided fragment; any undecidable feature or grid overflow fails safe to
+ * `alwaysAllows: false`.
+ */
+export declare function alwaysAllows(policy: PolicyInput, verb: string, opts?: AnalyzerOptions): AlwaysAllowsResult;
+/**
+ * Does policy `a` permit everything `b` permits (admitted(b) ⊆ admitted(a))? This is the
+ * delegation-safety check: a child capability must be subsumed by its parent. A counterexample is an
+ * action `b` admits that `a` denies. Proven only for the decided fragment; any undecidable feature in
+ * either policy, or grid overflow, fails safe to `subsumes: false`.
+ */
+export declare function subsumes(a: PolicyInput, b: PolicyInput, opts?: AnalyzerOptions): SubsumesResult;
+/**
+ * Are the two policies' admitted sets disjoint (no action both admit)? A witness is an action both
+ * admit. Proven only for the decided fragment; otherwise fails safe to `disjoint: false`.
+ */
+export declare function disjoint(a: PolicyInput, b: PolicyInput, opts?: AnalyzerOptions): DisjointResult;
+/**
+ * Do the two policies admit exactly the same actions? A counterexample is an action admitted by one
+ * but not the other. Proven only for the decided fragment; otherwise fails safe to `equivalent: false`.
+ */
+export declare function equivalent(a: PolicyInput, b: PolicyInput, opts?: AnalyzerOptions): EquivalentResult;
+/**
+ * Does the policy admit ONLY actions inside the declared `intent` envelope (allowed verbs + resource
+ * scopes + an amount ceiling)? This is the key safety check distinct from the runtime trust-budget: an
+ * action can pass the policy's predicates and stay under budget yet still fall outside what the
+ * principal intended — e.g. a $14k renewal admitted under a $10k intent cap because the policy's own
+ * ceiling is higher (or absent). Each reported violation is a concrete admitted action outside the
+ * envelope, so `conforms: false` with violations is always proven. `conforms: true` is proven only for
+ * the decided fragment; an undecidable policy feature, a `re:` intent scope, or grid overflow fails
+ * safe to `conforms: false, approximate: true` with no violations listed.
+ */
+export declare function intentConformance(policy: PolicyInput, intent: Intent, opts?: AnalyzerOptions): IntentConformanceResult;
+/** Concrete, exact admission check for a fully-specified action (no existential search). */
+export declare function admitsConcrete(policy: PolicyInput, action: AnalyzerAction): boolean;
+/**
+ * Whether a predicate's own numeric `where` conjunction is satisfiable (an explicit use of the interval
+ * engine; e.g. `amount >= 100 AND amount <= 10` is not). Non-numeric / `ref` conditions are ignored.
+ */
+export declare function predicateNumericSatisfiable(where: readonly Condition[] | undefined): boolean;
+export { admits, admitsAction, collectProbes, representatives, repToAction, search, type Rep };

package/dist/index.js

@@ -0,0 +1,374 @@
+"use strict";
+/**
+ * @atlasauth/pca-analyzer — STATIC ANALYZABILITY OF AUTHORITY.
+ *
+ * PCA can prove a quantitative trust-budget bound and verify a single action, but on its own it cannot
+ * statically answer "what can this whole delegated authority EVER do?". This package decides that over
+ * PCA's predicate/caveat policy: reachability, vacuity/totality, delegation-safety subsumption,
+ * disjointness, equivalence, and — the distinct safety check — conformance to a declared intent
+ * envelope (the "$14k renewal under a $10k cap on an approved vendor still violates intent" class).
+ *
+ * The engine is a SOUND, BOUNDED decision procedure (Cedar/SymCC-style, but with no SMT dependency):
+ * it enumerates a finite, distinguishing set of representative actions built from the literals,
+ * thresholds, prefixes, verbs and resource matchers in the policies, and evaluates the REAL
+ * `evaluatePredicates` at each. See README.md for the exact decided fragment and the honest
+ * incompleteness boundary. Soundness rule: a verdict is reported as proven only when the fragment is
+ * fully decided; otherwise it fails safe and is marked `approximate`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.search = exports.repToAction = exports.representatives = exports.collectProbes = exports.admitsAction = exports.admits = exports.toModel = exports.DEFAULT_MAX_COMBINATIONS = exports.FULL_INTERVAL = exports.intervalEmpty = exports.tightenInterval = exports.numericConjunctionSatisfiable = exports.analyzeCaveats = void 0;
+exports.reachable = reachable;
+exports.alwaysDenies = alwaysDenies;
+exports.alwaysAllows = alwaysAllows;
+exports.subsumes = subsumes;
+exports.disjoint = disjoint;
+exports.equivalent = equivalent;
+exports.intentConformance = intentConformance;
+exports.admitsConcrete = admitsConcrete;
+exports.predicateNumericSatisfiable = predicateNumericSatisfiable;
+const enumerate_1 = require("./enumerate");
+Object.defineProperty(exports, "admits", { enumerable: true, get: function () { return enumerate_1.admits; } });
+Object.defineProperty(exports, "admitsAction", { enumerable: true, get: function () { return enumerate_1.admitsAction; } });
+Object.defineProperty(exports, "collectProbes", { enumerable: true, get: function () { return enumerate_1.collectProbes; } });
+Object.defineProperty(exports, "repToAction", { enumerable: true, get: function () { return enumerate_1.repToAction; } });
+Object.defineProperty(exports, "representatives", { enumerable: true, get: function () { return enumerate_1.representatives; } });
+Object.defineProperty(exports, "search", { enumerable: true, get: function () { return enumerate_1.search; } });
+const field_1 = require("./field");
+const types_1 = require("./types");
+__exportStar(require("./types"), exports);
+var caveats_1 = require("./caveats");
+Object.defineProperty(exports, "analyzeCaveats", { enumerable: true, get: function () { return caveats_1.analyzeCaveats; } });
+var field_2 = require("./field");
+Object.defineProperty(exports, "numericConjunctionSatisfiable", { enumerable: true, get: function () { return field_2.numericConjunctionSatisfiable; } });
+Object.defineProperty(exports, "tightenInterval", { enumerable: true, get: function () { return field_2.tightenInterval; } });
+Object.defineProperty(exports, "intervalEmpty", { enumerable: true, get: function () { return field_2.intervalEmpty; } });
+Object.defineProperty(exports, "FULL_INTERVAL", { enumerable: true, get: function () { return field_2.FULL_INTERVAL; } });
+var enumerate_2 = require("./enumerate");
+Object.defineProperty(exports, "DEFAULT_MAX_COMBINATIONS", { enumerable: true, get: function () { return enumerate_2.DEFAULT_MAX_COMBINATIONS; } });
+Object.defineProperty(exports, "toModel", { enumerable: true, get: function () { return enumerate_2.toModel; } });
+function reversibilityIndex(cls) {
+    if (cls === undefined)
+        return -1;
+    return types_1.REVERSIBILITY_ORDER.indexOf(cls);
+}
+// ---- reachable ------------------------------------------------------------------------------------
+/**
+ * Can any input complete `action` into one the policy ALLOWs? (some predicate matches AND the caveat
+ * set is satisfiable). `verb` and `resource` are taken as given; unspecified `params` / `subject` /
+ * `env` fields are existentially searched. A returned `witness` is a concrete action verified against
+ * the real evaluator, so `reachable: true` is always proven. `reachable: false` is proven only for the
+ * decided fragment; otherwise it fails safe to `reachable: true, approximate: true`.
+ */
+function reachable(policy, action, opts = {}) {
+    const model = (0, enumerate_1.toModel)(policy);
+    const max = opts.maxCombinations ?? enumerate_1.DEFAULT_MAX_COMBINATIONS;
+    if (!model.caveatSat) {
+        return { reachable: false, reason: `caveats unsatisfiable: ${model.caveatReason ?? 'unknown'}` };
+    }
+    if (action.reversibilityClass !== undefined && model.revCap !== undefined) {
+        const idx = reversibilityIndex(action.reversibilityClass);
+        if (idx < 0 || idx > model.revCap) {
+            return { reachable: false, reason: `reversibility class '${action.reversibilityClass}' exceeds the caveat cap` };
+        }
+    }
+    // Fast path: the action is already concrete enough to decide directly.
+    if ((0, enumerate_1.admitsAction)(model, action)) {
+        return { reachable: true, witness: action };
+    }
+    // Existential search over free fields, with verb/resource fixed and provided params pinned.
+    const base = (0, enumerate_1.collectProbes)({ predicateSets: [model.predicates], varyReversibility: model.revCap !== undefined });
+    const provided = action.params ?? {};
+    const fields = base.fields.map((f) => {
+        if (f.path.startsWith('action.params.')) {
+            const key = f.path.slice('action.params.'.length);
+            if (Object.prototype.hasOwnProperty.call(provided, key)) {
+                return { path: f.path, values: [provided[key]] };
+            }
+        }
+        return f;
+    });
+    const revClasses = action.reversibilityClass !== undefined
+        ? [action.reversibilityClass]
+        : model.revCap !== undefined
+            ? [...types_1.REVERSIBILITY_ORDER]
+            : [undefined];
+    const pr = { verbs: [action.verb], resources: [action.resource], revClasses, fields };
+    const outcome = (0, enumerate_1.search)(pr, (rep) => (0, enumerate_1.admits)(model, rep), max);
+    if (outcome.hit !== undefined) {
+        const witness = mergeWitness((0, enumerate_1.repToAction)(outcome.hit), action);
+        return { reachable: true, witness };
+    }
+    if (outcome.overflow) {
+        return { reachable: true, approximate: true, reason: 'representative grid exceeded the bound; could not prove unreachable' };
+    }
+    if (model.undecidable.length > 0) {
+        return {
+            reachable: true,
+            approximate: true,
+            reason: `over-approximated (${model.undecidable.join('; ')}); could not construct a witness but cannot prove unreachable`,
+        };
+    }
+    return { reachable: false, reason: 'no predicate admits this action for any input (proven over the decided fragment)' };
+}
+function mergeWitness(witness, provided) {
+    const params = { ...(witness.params ?? {}), ...(provided.params ?? {}) };
+    const out = { verb: provided.verb, resource: provided.resource, params };
+    const rc = provided.reversibilityClass ?? witness.reversibilityClass;
+    if (rc !== undefined)
+        out.reversibilityClass = rc;
+    if (witness.subject !== undefined)
+        out.subject = witness.subject;
+    if (witness.env !== undefined)
+        out.env = witness.env;
+    return out;
+}
+// ---- alwaysDenies / alwaysAllows ------------------------------------------------------------------
+/**
+ * Is the policy vacuous — does it deny everything (optionally restricted to `verb`)? Proven only for
+ * the decided fragment; any undecidable feature or grid overflow fails safe to `alwaysDenies: false`
+ * (assume it can admit something).
+ */
+function alwaysDenies(policy, verb, opts = {}) {
+    const model = (0, enumerate_1.toModel)(policy);
+    const max = opts.maxCombinations ?? enumerate_1.DEFAULT_MAX_COMBINATIONS;
+    if (!model.caveatSat) {
+        return { alwaysDenies: true, reason: `caveats unsatisfiable: ${model.caveatReason ?? 'unknown'}` };
+    }
+    const pr = probesFor([model], verb);
+    const outcome = (0, enumerate_1.search)(pr, (rep) => (0, enumerate_1.admits)(model, rep), max);
+    if (outcome.hit !== undefined) {
+        return { alwaysDenies: false, witness: (0, enumerate_1.repToAction)(outcome.hit) };
+    }
+    if (outcome.overflow) {
+        return { alwaysDenies: false, approximate: true, reason: 'grid exceeded the bound; cannot prove vacuity' };
+    }
+    if (model.undecidable.length > 0) {
+        return { alwaysDenies: false, approximate: true, reason: `over-approximated (${model.undecidable.join('; ')}); cannot prove vacuity` };
+    }
+    return { alwaysDenies: true };
+}
+/**
+ * Is the policy total for `verb` — does it admit EVERY action of that verb (any resource, any params)?
+ * Proven only for the decided fragment; any undecidable feature or grid overflow fails safe to
+ * `alwaysAllows: false`.
+ */
+function alwaysAllows(policy, verb, opts = {}) {
+    const model = (0, enumerate_1.toModel)(policy);
+    const max = opts.maxCombinations ?? enumerate_1.DEFAULT_MAX_COMBINATIONS;
+    if (!model.caveatSat) {
+        return { alwaysAllows: false, reason: `caveats unsatisfiable: ${model.caveatReason ?? 'unknown'}` };
+    }
+    const pr = probesFor([model], verb);
+    const outcome = (0, enumerate_1.search)(pr, (rep) => !(0, enumerate_1.admits)(model, rep), max);
+    if (outcome.hit !== undefined) {
+        return { alwaysAllows: false, counterexample: (0, enumerate_1.repToAction)(outcome.hit) };
+    }
+    if (outcome.overflow) {
+        return { alwaysAllows: false, approximate: true, reason: 'grid exceeded the bound; cannot prove totality' };
+    }
+    if (model.undecidable.length > 0) {
+        return { alwaysAllows: false, approximate: true, reason: `over-approximated (${model.undecidable.join('; ')}); cannot prove totality` };
+    }
+    return { alwaysAllows: true };
+}
+function probesFor(models, verb) {
+    const anyRev = models.some((m) => m.revCap !== undefined);
+    const pr = (0, enumerate_1.collectProbes)({ predicateSets: models.map((m) => m.predicates), varyReversibility: anyRev });
+    if (verb !== undefined)
+        pr.verbs = [verb];
+    return pr;
+}
+// ---- subsumes / disjoint / equivalent -------------------------------------------------------------
+/**
+ * Does policy `a` permit everything `b` permits (admitted(b) ⊆ admitted(a))? This is the
+ * delegation-safety check: a child capability must be subsumed by its parent. A counterexample is an
+ * action `b` admits that `a` denies. Proven only for the decided fragment; any undecidable feature in
+ * either policy, or grid overflow, fails safe to `subsumes: false`.
+ */
+function subsumes(a, b, opts = {}) {
+    const ma = (0, enumerate_1.toModel)(a);
+    const mb = (0, enumerate_1.toModel)(b);
+    const max = opts.maxCombinations ?? enumerate_1.DEFAULT_MAX_COMBINATIONS;
+    const pr = probesFor([ma, mb]);
+    const outcome = (0, enumerate_1.search)(pr, (rep) => (0, enumerate_1.admits)(mb, rep) && !(0, enumerate_1.admits)(ma, rep), max);
+    if (outcome.hit !== undefined) {
+        return { subsumes: false, counterexample: (0, enumerate_1.repToAction)(outcome.hit) };
+    }
+    const note = approxNote([ma, mb], outcome.overflow);
+    if (note !== undefined)
+        return { subsumes: false, approximate: true, reason: note };
+    return { subsumes: true };
+}
+/**
+ * Are the two policies' admitted sets disjoint (no action both admit)? A witness is an action both
+ * admit. Proven only for the decided fragment; otherwise fails safe to `disjoint: false`.
+ */
+function disjoint(a, b, opts = {}) {
+    const ma = (0, enumerate_1.toModel)(a);
+    const mb = (0, enumerate_1.toModel)(b);
+    const max = opts.maxCombinations ?? enumerate_1.DEFAULT_MAX_COMBINATIONS;
+    const pr = probesFor([ma, mb]);
+    const outcome = (0, enumerate_1.search)(pr, (rep) => (0, enumerate_1.admits)(ma, rep) && (0, enumerate_1.admits)(mb, rep), max);
+    if (outcome.hit !== undefined) {
+        return { disjoint: false, witness: (0, enumerate_1.repToAction)(outcome.hit) };
+    }
+    const note = approxNote([ma, mb], outcome.overflow);
+    if (note !== undefined)
+        return { disjoint: false, approximate: true, reason: note };
+    return { disjoint: true };
+}
+/**
+ * Do the two policies admit exactly the same actions? A counterexample is an action admitted by one
+ * but not the other. Proven only for the decided fragment; otherwise fails safe to `equivalent: false`.
+ */
+function equivalent(a, b, opts = {}) {
+    const ma = (0, enumerate_1.toModel)(a);
+    const mb = (0, enumerate_1.toModel)(b);
+    const max = opts.maxCombinations ?? enumerate_1.DEFAULT_MAX_COMBINATIONS;
+    const pr = probesFor([ma, mb]);
+    const outcome = (0, enumerate_1.search)(pr, (rep) => (0, enumerate_1.admits)(ma, rep) !== (0, enumerate_1.admits)(mb, rep), max);
+    if (outcome.hit !== undefined) {
+        return { equivalent: false, counterexample: (0, enumerate_1.repToAction)(outcome.hit) };
+    }
+    const note = approxNote([ma, mb], outcome.overflow);
+    if (note !== undefined)
+        return { equivalent: false, approximate: true, reason: note };
+    return { equivalent: true };
+}
+function approxNote(models, overflow) {
+    if (overflow)
+        return 'representative grid exceeded the bound; cannot prove the relation';
+    const reasons = models.flatMap((m) => m.undecidable);
+    if (reasons.length > 0)
+        return `over-approximated (${[...new Set(reasons)].join('; ')}); cannot prove the relation`;
+    return undefined;
+}
+// ---- intentConformance ----------------------------------------------------------------------------
+/**
+ * Does the policy admit ONLY actions inside the declared `intent` envelope (allowed verbs + resource
+ * scopes + an amount ceiling)? This is the key safety check distinct from the runtime trust-budget: an
+ * action can pass the policy's predicates and stay under budget yet still fall outside what the
+ * principal intended — e.g. a $14k renewal admitted under a $10k intent cap because the policy's own
+ * ceiling is higher (or absent). Each reported violation is a concrete admitted action outside the
+ * envelope, so `conforms: false` with violations is always proven. `conforms: true` is proven only for
+ * the decided fragment; an undecidable policy feature, a `re:` intent scope, or grid overflow fails
+ * safe to `conforms: false, approximate: true` with no violations listed.
+ */
+function intentConformance(policy, intent, opts = {}) {
+    const model = (0, enumerate_1.toModel)(policy);
+    const max = opts.maxCombinations ?? enumerate_1.DEFAULT_MAX_COMBINATIONS;
+    const amountField = intent.amountField ?? 'amount';
+    const minAmount = intent.minAmount ?? 0;
+    if (!model.caveatSat) {
+        // Admits nothing, so it trivially admits only within-intent actions.
+        return { conforms: true, violations: [] };
+    }
+    const extraFieldConditions = [];
+    if (intent.maxAmount !== undefined) {
+        const path = `action.params.${amountField}`;
+        extraFieldConditions.push({ path, cond: { field: path, op: 'lte', value: intent.maxAmount } });
+        extraFieldConditions.push({ path, cond: { field: path, op: 'gte', value: minAmount } });
+    }
+    const pr = (0, enumerate_1.collectProbes)({
+        predicateSets: [model.predicates],
+        extraVerbs: intent.verbs.filter((v) => v !== '*'),
+        extraResources: intent.resourceScopes ?? [],
+        extraFieldConditions,
+        varyReversibility: model.revCap !== undefined,
+    });
+    if (pr.verbs.length * pr.resources.length * pr.revClasses.length * fieldProduct(pr.fields) > max) {
+        return { conforms: false, approximate: true, violations: [], reason: 'grid exceeded the bound; cannot prove conformance' };
+    }
+    const violations = [];
+    const maxViolations = 16;
+    for (const rep of (0, enumerate_1.representatives)(pr)) {
+        if (!(0, enumerate_1.admits)(model, rep))
+            continue;
+        const action = (0, enumerate_1.repToAction)(rep);
+        const kinds = intentViolationKinds(action, intent, amountField, minAmount);
+        if (kinds.length > 0) {
+            violations.push({ action, kinds });
+            if (violations.length >= maxViolations)
+                break;
+        }
+    }
+    if (violations.length > 0) {
+        return { conforms: false, violations };
+    }
+    const intentRegex = (intent.resourceScopes ?? []).some((s) => s.startsWith('re:'));
+    if (model.undecidable.length > 0 || intentRegex) {
+        const reasons = [...model.undecidable];
+        if (intentRegex)
+            reasons.push('re: intent resource scope not enumerated soundly');
+        return { conforms: false, approximate: true, violations: [], reason: `over-approximated (${reasons.join('; ')}); cannot prove conformance` };
+    }
+    return { conforms: true, violations: [] };
+}
+function fieldProduct(fields) {
+    let n = 1;
+    for (const f of fields)
+        n *= f.values.length;
+    return n;
+}
+function scopeMatches(scope, resource) {
+    if (scope === '*')
+        return true;
+    if (scope.startsWith('re:')) {
+        try {
+            return new RegExp('^(?:' + scope.slice(3) + ')$').test(resource);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (scope.endsWith('*'))
+        return resource.startsWith(scope.slice(0, -1));
+    return scope === resource;
+}
+function intentViolationKinds(action, intent, amountField, minAmount) {
+    const kinds = [];
+    if (!(intent.verbs.includes('*') || intent.verbs.includes(action.verb)))
+        kinds.push('off-verb');
+    const scopes = intent.resourceScopes ?? [];
+    if (scopes.length > 0 && !scopes.some((s) => scopeMatches(s, action.resource)))
+        kinds.push('off-scope');
+    if (intent.maxAmount !== undefined) {
+        const amt = (action.params ?? {})[amountField];
+        if (typeof amt === 'number' && Number.isFinite(amt)) {
+            if (amt > intent.maxAmount)
+                kinds.push('over-amount');
+            else if (amt < minAmount)
+                kinds.push('under-amount');
+        }
+    }
+    return kinds;
+}
+// ---- convenience ----------------------------------------------------------------------------------
+/** Concrete, exact admission check for a fully-specified action (no existential search). */
+function admitsConcrete(policy, action) {
+    return (0, enumerate_1.admitsAction)((0, enumerate_1.toModel)(policy), action);
+}
+/**
+ * Whether a predicate's own numeric `where` conjunction is satisfiable (an explicit use of the interval
+ * engine; e.g. `amount >= 100 AND amount <= 10` is not). Non-numeric / `ref` conditions are ignored.
+ */
+function predicateNumericSatisfiable(where) {
+    if (!Array.isArray(where))
+        return true;
+    return (0, field_1.numericConjunctionSatisfiable)(where);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;;;;;AA+DH,8BAsDC;AAmBD,oCAkBC;AAOD,oCAkBC;AAiBD,4BAYC;AAMD,4BAYC;AAMD,gCAYC;AAqBD,8CAmDC;AA4CD,wCAEC;AAMD,kEAGC;AAhXD,2CAWqB;AAwWZ,uFAjXP,kBAAM,OAiXO;AAAE,6FAhXf,wBAAY,OAgXe;AAAE,8FA/W7B,yBAAa,OA+W6B;AAAmB,4FA9W7D,uBAAW,OA8W6D;AAA5B,gGA7W5C,2BAAe,OA6W4C;AAAe,uFA5W1E,kBAAM,OA4W0E;AAvWlF,mCAAwD;AACxD,mCAA8C;AAgB9C,0CAAwB;AACxB,qCAA2C;AAAlC,yGAAA,cAAc,OAAA;AAEvB,iCAMiB;AALf,sHAAA,6BAA6B,OAAA;AAC7B,wGAAA,eAAe,OAAA;AACf,sGAAA,aAAa,OAAA;AACb,sGAAA,aAAa,OAAA;AAGf,yCAAkF;AAAzE,qHAAA,wBAAwB,OAAA;AAAE,oGAAA,OAAO,OAAA;AAO1C,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC;IACjC,OAAQ,2BAAyC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,sGAAsG;AAEtG;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,MAAmB,EAAE,MAAsB,EAAE,OAAwB,EAAE;IAC/F,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,oCAAwB,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,KAAK,CAAC,YAAY,IAAI,SAAS,EAAE,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC1D,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,kBAAkB,0BAA0B,EAAE,CAAC;QACnH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAA,wBAAY,EAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,4FAA4F;IAC5F,MAAM,IAAI,GAAG,IAAA,yBAAa,EAAC,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GACd,MAAM,CAAC,kBAAkB,KAAK,SAAS;QACrC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC7B,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,CAAC,GAAG,2BAAmB,CAAC;YAC1B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAEtF,MAAM,OAAO,GAAG,IAAA,kBAAM,EAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,kBAAM,EAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAA,uBAAW,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;IAC/H,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,sBAAsB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D;SAC1H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAC;AAC1H,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB,EAAE,QAAwB;IACrE,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;IACzE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACzF,MAAM,EAAE,GAAG,QAAQ,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IACrE,IAAI,EAAE,KAAK,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AAEtG;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAAmB,EAAE,IAAa,EAAE,OAAwB,EAAE;IACzF,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,oCAAwB,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,KAAK,CAAC,YAAY,IAAI,SAAS,EAAE,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAA,kBAAM,EAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,kBAAM,EAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,IAAA,uBAAW,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;IACzI,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAAmB,EAAE,IAAY,EAAE,OAAwB,EAAE;IACxF,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,oCAAwB,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,KAAK,CAAC,YAAY,IAAI,SAAS,EAAE,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAA,kBAAM,EAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAM,EAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,IAAA,uBAAW,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC;IAC1I,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,MAAqB,EAAE,IAAa;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,IAAA,yBAAa,EAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;IACxG,IAAI,IAAI,KAAK,SAAS;QAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sGAAsG;AAEtG;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,CAAc,EAAE,CAAc,EAAE,OAAwB,EAAE;IACjF,MAAM,EAAE,GAAG,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,oCAAwB,CAAC;IAC7D,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,kBAAM,EAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,kBAAM,EAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAA,kBAAM,EAAC,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAA,uBAAW,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,CAAc,EAAE,CAAc,EAAE,OAAwB,EAAE;IACjF,MAAM,EAAE,GAAG,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,oCAAwB,CAAC;IAC7D,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,kBAAM,EAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,kBAAM,EAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAA,kBAAM,EAAC,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAA,uBAAW,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,CAAc,EAAE,CAAc,EAAE,OAAwB,EAAE;IACnF,MAAM,EAAE,GAAG,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,oCAAwB,CAAC;IAC7D,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,kBAAM,EAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,kBAAM,EAAC,EAAE,EAAE,GAAG,CAAC,KAAK,IAAA,kBAAM,EAAC,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,IAAA,uBAAW,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,QAAiB;IAC1D,IAAI,QAAQ;QAAE,OAAO,mEAAmE,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,sBAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACpH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sGAAsG;AAEtG;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,MAAmB,EAAE,MAAc,EAAE,OAAwB,EAAE;IAC/F,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,oCAAwB,CAAC;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,qEAAqE;QACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,oBAAoB,GAAwC,EAAE,CAAC;IACrE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,iBAAiB,WAAW,EAAE,CAAC;QAC5C,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,yBAAa,EAAC;QACvB,aAAa,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;QACjC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC;QACjD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAC3C,oBAAoB;QACpB,iBAAiB,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;KAC9C,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QACjG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IAC7H,CAAC;IAED,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAA,2BAAe,EAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAA,kBAAM,EAAC,KAAK,EAAE,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,IAAA,uBAAW,EAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACnC,IAAI,UAAU,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM;QAChD,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;IAC/I,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAgB;IACnD,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAsB,EACtB,MAAc,EACd,WAAmB,EACnB,SAAiB;IAEjB,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;iBACjD,IAAI,GAAG,GAAG,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sGAAsG;AAEtG,4FAA4F;AAC5F,SAAgB,cAAc,CAAC,MAAmB,EAAE,MAAsB;IACxE,OAAO,IAAA,wBAAY,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,KAAuC;IACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAA,qCAA6B,EAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,109 @@
+import type { Caveat, CompiledPolicy, Predicate } from '@atlasauth/pca';
+/**
+ * Public types for the PCA authority analyzer.
+ *
+ * The analyzer decides static questions over PCA's predicate/caveat policy — "what can this whole
+ * delegated authority EVER do?" — independently of any single runtime action. See README.md for the
+ * exact decided fragment and the honest incompleteness boundary.
+ */
+/** Reversibility classes in increasing severity (mirrors @atlasauth/pca's `REVERSIBILITY_ORDER`). */
+export declare const REVERSIBILITY_ORDER: readonly ["reversible", "rate_limited", "irreversible"];
+export type ReversibilityClass = (typeof REVERSIBILITY_ORDER)[number];
+/**
+ * A policy to analyze: either a full `CompiledPolicy` (from `compilePolicy`/`agent().policy`) or a
+ * bare predicate set with an optional caveat set. A chain's acting authority is the leaf's cumulative
+ * (append-only) caveat list plus the grant's predicates.
+ */
+export type PolicyInput = CompiledPolicy | {
+    predicates: Predicate[];
+    caveats?: Caveat[];
+};
+/**
+ * A concrete (or partially-concrete) action in the query/answer vocabulary. `params` are the
+ * `action.params.*` inputs; `subject`/`env` carry witness assignments to `subject.*` / `env.*` fields
+ * that a predicate's `where` may reference.
+ */
+export interface AnalyzerAction {
+    verb: string;
+    resource: string;
+    params?: Record<string, unknown>;
+    /** Reversibility class of the action (checked against a `reversibility_max` caveat). */
+    reversibilityClass?: string;
+    /** Witness assignment to `subject.*` fields (only populated when a witness needs them). */
+    subject?: Record<string, unknown>;
+    /** Witness assignment to `env.*` fields (only populated when a witness needs them). */
+    env?: Record<string, unknown>;
+}
+/**
+ * `true` on a result means the verdict is SOUND but could not be decided EXACTLY (it was
+ * over-approximated / failed safe): e.g. a `re:` regex resource matcher, a cross-field `ref`
+ * condition, or a representative grid larger than the configured bound. A fail-safe verdict never
+ * claims the "safe" answer (subsumed / always-deny / disjoint / equivalent / conforms) without proof.
+ */
+export interface Approx {
+    approximate?: boolean;
+}
+export interface ReachableResult extends Approx {
+    reachable: boolean;
+    /** A concrete action proving reachability (verified against the real evaluator). */
+    witness?: AnalyzerAction;
+    reason?: string;
+}
+export interface AlwaysDeniesResult extends Approx {
+    alwaysDenies: boolean;
+    /** When `false`: a concrete action the policy admits (proving it is not vacuous). */
+    witness?: AnalyzerAction;
+    reason?: string;
+}
+export interface AlwaysAllowsResult extends Approx {
+    alwaysAllows: boolean;
+    /** When `false`: a concrete action of the verb the policy denies. */
+    counterexample?: AnalyzerAction;
+    reason?: string;
+}
+export interface SubsumesResult extends Approx {
+    subsumes: boolean;
+    /** When `false`: an action `b` admits that `a` does not (a delegation-safety violation). */
+    counterexample?: AnalyzerAction;
+    reason?: string;
+}
+export interface DisjointResult extends Approx {
+    disjoint: boolean;
+    /** When `false`: an action both policies admit. */
+    witness?: AnalyzerAction;
+    reason?: string;
+}
+export interface EquivalentResult extends Approx {
+    equivalent: boolean;
+    /** When `false`: an action admitted by exactly one of the two policies. */
+    counterexample?: AnalyzerAction;
+    reason?: string;
+}
+/**
+ * A declared intent envelope — the authority the principal MEANT to grant, distinct from the runtime
+ * limits the policy happens to encode. `intentConformance` checks the policy admits ONLY actions
+ * inside this envelope.
+ */
+export interface Intent {
+    /** Allowed verbs. Include `'*'` to allow any verb. */
+    verbs: string[];
+    /** Allowed resource matchers (exact / `'*'` / trailing-`*` prefix / `re:`). Omitted/empty = any. */
+    resourceScopes?: string[];
+    /** Upper ceiling on the action's monetary amount, if any. */
+    maxAmount?: number;
+    /** Lower floor on the amount (default 0 when `maxAmount` is set). */
+    minAmount?: number;
+    /** The `action.params.<field>` that carries the amount (default `'amount'`). */
+    amountField?: string;
+}
+export type IntentViolationKind = 'off-verb' | 'off-scope' | 'over-amount' | 'under-amount';
+export interface IntentViolation {
+    action: AnalyzerAction;
+    kinds: IntentViolationKind[];
+}
+export interface IntentConformanceResult extends Approx {
+    conforms: boolean;
+    /** Concrete actions the policy admits that fall OUTSIDE the intent envelope. */
+    violations: IntentViolation[];
+    reason?: string;
+}

package/dist/types.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REVERSIBILITY_ORDER = void 0;
+/**
+ * Public types for the PCA authority analyzer.
+ *
+ * The analyzer decides static questions over PCA's predicate/caveat policy — "what can this whole
+ * delegated authority EVER do?" — independently of any single runtime action. See README.md for the
+ * exact decided fragment and the honest incompleteness boundary.
+ */
+/** Reversibility classes in increasing severity (mirrors @atlasauth/pca's `REVERSIBILITY_ORDER`). */
+exports.REVERSIBILITY_ORDER = ['reversible', 'rate_limited', 'irreversible'];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AAEH,qGAAqG;AACxF,QAAA,mBAAmB,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,cAAc,CAAU,CAAC"}