@contractspec/lib.contracts 1.61.0 → 1.63.0

package/dist/policy/opa-adapter.d.ts

@@ -1,42 +0,0 @@
-import type { PolicyDecision } from '../types';
-import type { PolicySpec, ConsentDefinition } from './spec';
-import type { DecisionContext } from './engine';
-export interface OPAClient {
-    evaluate<T>(decisionPath: string, input: unknown): Promise<T>;
-}
-export interface OPAEvaluationResult {
-    effect?: 'allow' | 'deny';
-    reason?: string;
-    fieldDecisions?: PolicyDecision['fieldDecisions'];
-    requiredConsents?: string[];
-}
-export interface OPAAdapterOptions<Result = OPAEvaluationResult | null> {
-    /**
-     * Path fed to the OPA client (e.g., "sigil/authz/allow").
-     */
-    decisionPath: string;
-    /**
-     * Optional mapper when the OPA client returns a non-standard payload.
-     */
-    mapResult?: (value: unknown) => Result;
-}
-export declare class OPAPolicyAdapter<Result = OPAEvaluationResult | null> {
-    private readonly client;
-    private readonly options;
-    constructor(client: OPAClient, options: OPAAdapterOptions<Result>);
-    evaluate(context: DecisionContext, policies: PolicySpec[], engineDecision: PolicyDecision): Promise<PolicyDecision>;
-}
-export declare function buildOPAInput(context: DecisionContext, policies: PolicySpec[], engineDecision: PolicyDecision): {
-    context: DecisionContext;
-    decision: PolicyDecision;
-    policies: {
-        meta: import("./spec").PolicyMeta;
-        rules: import("./spec").PolicyRule[];
-        fieldPolicies: import("./spec").FieldPolicyRule[] | undefined;
-        pii: import("./spec").PIIPolicy | undefined;
-        relationships: import("./spec").RelationshipDefinition[] | undefined;
-        consents: ConsentDefinition[] | undefined;
-        rateLimits: import("./spec").RateLimitDefinition[] | undefined;
-    }[];
-};
-//# sourceMappingURL=opa-adapter.d.ts.map

package/dist/policy/opa-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"opa-adapter.d.ts","sourceRoot":"","sources":["../../src/policy/opa-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAClD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB,CAAC,MAAM,GAAG,mBAAmB,GAAG,IAAI;IACpE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CACxC;AAED,qBAAa,gBAAgB,CAAC,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAE7D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC;IAG/C,QAAQ,CACZ,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,UAAU,EAAE,EACtB,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,cAAc,CAAC;CAmC3B;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,UAAU,EAAE,EACtB,cAAc,EAAE,cAAc;;;;;;;;;;;;EAe/B"}

package/dist/policy/opa-adapter.js

@@ -1,110 +0,0 @@
-// @bun
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __moduleCache = /* @__PURE__ */ new WeakMap;
-var __toCommonJS = (from) => {
-  var entry = __moduleCache.get(from), desc;
-  if (entry)
-    return entry;
-  entry = __defProp({}, "__esModule", { value: true });
-  if (from && typeof from === "object" || typeof from === "function")
-    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    }));
-  __moduleCache.set(from, entry);
-  return entry;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: (newValue) => all[name] = () => newValue
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
-
-// src/policy/opa-adapter.ts
-class OPAPolicyAdapter {
-  client;
-  options;
-  constructor(client, options) {
-    this.client = client;
-    this.options = options;
-  }
-  async evaluate(context, policies, engineDecision) {
-    const input = buildOPAInput(context, policies, engineDecision);
-    const raw = await this.client.evaluate(this.options.decisionPath, input);
-    const resolved = this.options.mapResult ? this.options.mapResult(raw) : raw;
-    if (!resolved) {
-      return {
-        ...engineDecision,
-        evaluatedBy: engineDecision.evaluatedBy ?? "engine"
-      };
-    }
-    const opaResult = resolved;
-    const mergedRequiredConsents = mergeRequiredConsents(policies, engineDecision.requiredConsents ?? [], opaResult.requiredConsents ?? []);
-    return {
-      ...engineDecision,
-      effect: opaResult.effect ?? engineDecision.effect,
-      reason: opaResult.reason ?? engineDecision.reason,
-      fieldDecisions: opaResult.fieldDecisions ?? engineDecision.fieldDecisions,
-      requiredConsents: mergedRequiredConsents.length ? mergedRequiredConsents : undefined,
-      evaluatedBy: "opa"
-    };
-  }
-}
-function buildOPAInput(context, policies, engineDecision) {
-  return {
-    context,
-    decision: engineDecision,
-    policies: policies.map((policy) => ({
-      meta: policy.meta,
-      rules: policy.rules,
-      fieldPolicies: policy.fieldPolicies,
-      pii: policy.pii,
-      relationships: policy.relationships,
-      consents: policy.consents,
-      rateLimits: policy.rateLimits
-    }))
-  };
-}
-function mergeRequiredConsents(policies, existing, incomingIds) {
-  if (incomingIds.length === 0)
-    return existing;
-  const existingIds = new Set(existing.map((consent) => consent.id));
-  const merged = [...existing];
-  for (const id of incomingIds) {
-    if (existingIds.has(id))
-      continue;
-    const resolved = resolveConsentAcrossPolicies(policies, id);
-    if (resolved) {
-      merged.push(resolved);
-      existingIds.add(resolved.id);
-    }
-  }
-  return merged;
-}
-function resolveConsentAcrossPolicies(policies, id) {
-  for (const policy of policies) {
-    const match = policy.consents?.find((consent) => consent.id === id);
-    if (match)
-      return match;
-  }
-  return {
-    id,
-    scope: "unspecified",
-    purpose: "unspecified",
-    description: `Consent "${id}" returned by OPA`,
-    required: true
-  };
-}
-export {
-  buildOPAInput,
-  OPAPolicyAdapter
-};

package/dist/policy/opa-adapter.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=opa-adapter.test.d.ts.map

package/dist/policy/opa-adapter.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"opa-adapter.test.d.ts","sourceRoot":"","sources":["../../src/policy/opa-adapter.test.ts"],"names":[],"mappings":""}

package/dist/policy/registry.d.ts

@@ -1,6 +0,0 @@
-import { SpecContractRegistry } from '../registry';
-import type { PolicySpec } from './spec';
-export declare class PolicyRegistry extends SpecContractRegistry<'policy', PolicySpec> {
-    constructor(items?: PolicySpec[]);
-}
-//# sourceMappingURL=registry.d.ts.map

package/dist/policy/registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/policy/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,qBAAa,cAAe,SAAQ,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC;gBACzD,KAAK,CAAC,EAAE,UAAU,EAAE;CAGxC"}

package/dist/policy/registry.js

@@ -1,221 +0,0 @@
-// @bun
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __moduleCache = /* @__PURE__ */ new WeakMap;
-var __toCommonJS = (from) => {
-  var entry = __moduleCache.get(from), desc;
-  if (entry)
-    return entry;
-  entry = __defProp({}, "__esModule", { value: true });
-  if (from && typeof from === "object" || typeof from === "function")
-    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    }));
-  __moduleCache.set(from, entry);
-  return entry;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: (newValue) => all[name] = () => newValue
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
-
-// src/registry-utils.ts
-var exports_registry_utils = {};
-__export(exports_registry_utils, {
-  groupByToArray: () => groupByToArray,
-  groupByMultiple: () => groupByMultiple,
-  groupBy: () => groupBy,
-  getUniqueTags: () => getUniqueTags,
-  getUniqueOwners: () => getUniqueOwners,
-  getUniqueDomains: () => getUniqueDomains,
-  filterBy: () => filterBy,
-  GroupingStrategies: () => GroupingStrategies
-});
-function filterBy(items, filter) {
-  return items.filter((item) => {
-    if (filter.tags?.length) {
-      const hasMatchingTag = filter.tags.some((tag) => item.meta.tags?.includes(tag));
-      if (!hasMatchingTag)
-        return false;
-    }
-    if (filter.owners?.length) {
-      const hasMatchingOwner = filter.owners.some((owner) => item.meta.owners?.includes(owner));
-      if (!hasMatchingOwner)
-        return false;
-    }
-    if (filter.stability?.length) {
-      if (!filter.stability.includes(item.meta.stability ?? "stable")) {
-        return false;
-      }
-    }
-    if (filter.domain) {
-      const itemDomain = GroupingStrategies.byDomain(item);
-      if (itemDomain !== filter.domain)
-        return false;
-    }
-    if (filter.keyPattern) {
-      const name = item.meta.key ?? item.meta.key ?? "";
-      const pattern = filter.keyPattern.replace(/\*/g, ".*").replace(/\?/g, ".");
-      const regex = new RegExp(`^${pattern}$`, "i");
-      if (!regex.test(name))
-        return false;
-    }
-    return true;
-  });
-}
-function groupBy(items, keyFn) {
-  const groups = new Map;
-  for (const item of items) {
-    const key = keyFn(item);
-    const existing = groups.get(key);
-    if (existing) {
-      existing.push(item);
-    } else {
-      groups.set(key, [item]);
-    }
-  }
-  return groups;
-}
-function groupByToArray(items, keyFn) {
-  const map = groupBy(items, keyFn);
-  return Array.from(map.entries()).map(([key, items2]) => ({ key, items: items2 }));
-}
-function groupByMultiple(items, keysFn) {
-  const groups = new Map;
-  for (const item of items) {
-    const keys = keysFn(item);
-    for (const key of keys) {
-      const existing = groups.get(key);
-      if (existing) {
-        existing.push(item);
-      } else {
-        groups.set(key, [item]);
-      }
-    }
-  }
-  return groups;
-}
-function getUniqueTags(items) {
-  const tags = new Set;
-  for (const item of items) {
-    for (const tag of item.meta.tags ?? []) {
-      tags.add(tag);
-    }
-  }
-  return Array.from(tags).sort();
-}
-function getUniqueOwners(items) {
-  const owners = new Set;
-  for (const item of items) {
-    for (const owner of item.meta.owners ?? []) {
-      owners.add(owner);
-    }
-  }
-  return Array.from(owners).sort();
-}
-function getUniqueDomains(items) {
-  const domains = new Set;
-  for (const item of items) {
-    domains.add(GroupingStrategies.byDomain(item));
-  }
-  return Array.from(domains).sort();
-}
-var GroupingStrategies;
-var init_registry_utils = __esm(() => {
-  GroupingStrategies = {
-    byTag: (item) => item.meta.tags?.[0] ?? "untagged",
-    byAllTags: (item) => item.meta.tags?.length ? item.meta.tags : ["untagged"],
-    byOwner: (item) => item.meta.owners?.[0] ?? "unowned",
-    byDomain: (item) => {
-      const name = item.meta.key ?? item.meta.key ?? "";
-      return name.split(".")[0] ?? "default";
-    },
-    byStability: (item) => item.meta.stability ?? "stable",
-    byUrlPath: (level) => (item) => {
-      if (!item.path)
-        return "root";
-      const segments = item.path.split("/").filter(Boolean);
-      return segments.slice(0, level).join("/") || "root";
-    }
-  };
-});
-
-// src/registry.ts
-init_registry_utils();
-import { compareVersions } from "compare-versions";
-var keyOfSpecContract = (spec) => `${spec.meta.key}.v${spec.meta.version}`;
-
-class SpecContractRegistry {
-  contractType;
-  items = new Map;
-  constructor(contractType, items) {
-    this.contractType = contractType;
-    if (items) {
-      items.forEach((p) => this.register(p));
-    }
-  }
-  register(p) {
-    const key = keyOfSpecContract(p);
-    if (this.items.has(key))
-      throw new Error(`Duplicate contract \`${this.contractType}\` ${key}`);
-    this.items.set(key, p);
-    return this;
-  }
-  count() {
-    return this.items.size;
-  }
-  list() {
-    return [...this.items.values()];
-  }
-  get(key, version) {
-    if (version != null)
-      return this.items.get(`${key}.v${version}`);
-    let candidate;
-    for (const [k, p] of this.items.entries()) {
-      if (!k.startsWith(`${key}.v`))
-        continue;
-      if (!candidate || compareVersions(p.meta.version, candidate.meta.version) > 0) {
-        candidate = p;
-      }
-    }
-    return candidate;
-  }
-  has(key, version) {
-    return !!this.get(key, version);
-  }
-  filter(criteria) {
-    return filterBy(this.list(), criteria);
-  }
-  listByTag(tag) {
-    return this.list().filter((p) => p.meta.tags?.includes(tag));
-  }
-  listByOwner(owner) {
-    return this.list().filter((p) => p.meta.owners?.includes(owner));
-  }
-  groupBy(keyFn) {
-    return groupBy(this.list(), keyFn);
-  }
-  getUniqueTags() {
-    return getUniqueTags(this.list());
-  }
-}
-
-// src/policy/registry.ts
-class PolicyRegistry extends SpecContractRegistry {
-  constructor(items) {
-    super("policy", items);
-  }
-}
-export {
-  PolicyRegistry
-};

package/dist/policy/spec.d.ts

@@ -1,103 +0,0 @@
-import type { OwnerShipMeta } from '../ownership';
-import type { VersionedSpecRef } from '../versioning';
-/** Effect of a policy rule: allow or deny access. */
-export type PolicyEffect = 'allow' | 'deny';
-export interface RelationshipDefinition {
-    subjectType: string;
-    relation: string;
-    objectType: string;
-    description?: string;
-    transitive?: boolean;
-}
-export interface RelationshipMatcher {
-    relation: string;
-    objectType?: string;
-    objectId?: string;
-}
-export interface ConsentDefinition {
-    id: string;
-    scope: string;
-    purpose: string;
-    description?: string;
-    lawfulBasis?: 'consent' | 'contract' | 'legal_obligation' | 'legitimate_interest';
-    expiresInDays?: number;
-    required?: boolean;
-}
-export interface RateLimitDefinition {
-    id: string;
-    rpm: number;
-    key?: string;
-    windowSeconds?: number;
-    burst?: number;
-}
-export interface PolicyOPAConfig {
-    /** Fully-qualified package, e.g. "sigil.authz" */
-    package: string;
-    /** Optional rule within package (defaults to "allow") */
-    decision?: string;
-}
-export interface PolicyMeta extends OwnerShipMeta {
-    /** Optional scope hint used for discovery. */
-    scope?: 'global' | 'feature' | 'operation';
-}
-export interface AttributeMatcher {
-    equals?: unknown;
-    oneOf?: unknown[];
-    exists?: boolean;
-}
-export interface SubjectMatcher {
-    roles?: string[];
-    attributes?: Record<string, AttributeMatcher>;
-}
-export interface ResourceMatcher {
-    type: string;
-    fields?: string[];
-    attributes?: Record<string, AttributeMatcher>;
-}
-export interface PolicyCondition {
-    /** Simple expression evaluated against { subject, resource, context }. */
-    expression: string;
-}
-export interface PolicyRule {
-    effect: PolicyEffect;
-    actions: string[];
-    subject?: SubjectMatcher;
-    resource?: ResourceMatcher;
-    relationships?: RelationshipMatcher[];
-    requiresConsent?: string[];
-    flags?: string[];
-    rateLimit?: string | RateLimitDefinition;
-    escalate?: 'human_review' | null;
-    conditions?: PolicyCondition[];
-    reason?: string;
-}
-export interface FieldPolicyRule {
-    effect: PolicyEffect;
-    field: string;
-    actions: ('read' | 'write')[];
-    subject?: SubjectMatcher;
-    resource?: ResourceMatcher;
-    conditions?: PolicyCondition[];
-    reason?: string;
-}
-export interface PIIPolicy {
-    fields: string[];
-    consentRequired?: boolean;
-    retentionDays?: number;
-}
-export interface PolicySpec {
-    meta: PolicyMeta;
-    rules: PolicyRule[];
-    fieldPolicies?: FieldPolicyRule[];
-    pii?: PIIPolicy;
-    relationships?: RelationshipDefinition[];
-    consents?: ConsentDefinition[];
-    rateLimits?: RateLimitDefinition[];
-    opa?: PolicyOPAConfig;
-}
-/**
- * Reference to a policy spec.
- * Uses key and version to identify a specific policy.
- */
-export type PolicyRef = VersionedSpecRef;
-//# sourceMappingURL=spec.d.ts.map

package/dist/policy/spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/policy/spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EACR,SAAS,GACT,UAAU,GACV,kBAAkB,GAClB,qBAAqB,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,8CAA8C;IAC9C,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,aAAa,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACzC,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,aAAa,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACzC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACnC,GAAG,CAAC,EAAE,eAAe,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,gBAAgB,CAAC"}

package/dist/policy/spec.js

@@ -1 +0,0 @@
-// @bun

package/dist/policy/validation.d.ts

@@ -1,85 +0,0 @@
-/**
- * Policy validation utilities.
- *
- * Provides functions to validate policy specs for consistency,
- * completeness, and cross-registry relationships.
- *
- * @module policy/validation
- *
- * @example
- * ```typescript
- * import { validatePolicySpec, validatePolicyConsistency } from '@contractspec/lib.contracts';
- *
- * // Validate a single policy spec
- * const issues = validatePolicySpec(myPolicy);
- *
- * // Validate across registries
- * const crossIssues = validatePolicyConsistency({
- *   policies: policyRegistry,
- *   operations: operationRegistry,
- * });
- * ```
- */
-import type { PolicySpec } from './spec';
-import type { PolicyRegistry } from './registry';
-import type { OperationSpecRegistry } from '../operations/registry';
-export type PolicyValidationLevel = 'error' | 'warning' | 'info';
-export interface PolicyValidationIssue {
-    level: PolicyValidationLevel;
-    message: string;
-    path?: string;
-    context?: Record<string, unknown>;
-}
-export interface PolicyValidationResult {
-    valid: boolean;
-    issues: PolicyValidationIssue[];
-}
-/**
- * Validate a policy spec for internal consistency.
- *
- * @param spec - Policy spec to validate
- * @returns Validation result with any issues found
- *
- * @example
- * ```typescript
- * const result = validatePolicySpec(myPolicy);
- * if (!result.valid) {
- *   console.log('Issues:', result.issues);
- * }
- * ```
- */
-export declare function validatePolicySpec(spec: PolicySpec): PolicyValidationResult;
-export interface PolicyConsistencyDeps {
-    policies: PolicyRegistry;
-    operations?: OperationSpecRegistry;
-}
-/**
- * Validate policy consistency across registries.
- *
- * Checks that:
- * - Operations reference valid policies
- * - Policy actions align with operation kinds
- *
- * @param deps - Registry dependencies
- * @returns Validation result
- */
-export declare function validatePolicyConsistency(deps: PolicyConsistencyDeps): PolicyValidationResult;
-export declare class PolicyValidationError extends Error {
-    readonly issues: PolicyValidationIssue[];
-    constructor(message: string, issues: PolicyValidationIssue[]);
-}
-/**
- * Assert that a policy spec is valid, throwing if not.
- *
- * @param spec - Policy spec to validate
- * @throws {PolicyValidationError} If validation fails
- */
-export declare function assertPolicySpecValid(spec: PolicySpec): void;
-/**
- * Assert policy consistency across registries.
- *
- * @param deps - Registry dependencies
- * @throws {PolicyValidationError} If validation fails
- */
-export declare function assertPolicyConsistency(deps: PolicyConsistencyDeps): void;
-//# sourceMappingURL=validation.d.ts.map

package/dist/policy/validation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/policy/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAA+B,MAAM,QAAQ,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAMpE,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,qBAAqB,EAAE,CAAC;CACjC;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,sBAAsB,CAyB3E;AAgWD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,qBAAqB,GAC1B,sBAAsB,CAkDxB;AAMD,qBAAa,qBAAsB,SAAQ,KAAK;aAG5B,MAAM,EAAE,qBAAqB,EAAE;gBAD/C,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,qBAAqB,EAAE;CAKlD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAQzE"}