@cynodia/axiom-compiler 0.14.0-alpha.5 → 0.15.0-alpha.2

package/dist/server.js

@@ -1,4 +1,4 @@
-import { actionAuthority, actionGuards, authorityContext, expressionDefsIn, isObservable, maxContract, requiredServerContract, schemaFingerprint, stripAuthoringMetadata, serverIRExpressions, serverStateClosure, stateAuthority, usesExternalIOVocabulary, usesIntegrationVocabulary, usesInvocationVocabulary, usesMigrationVocabulary, usesQueryVocabulary, usesWorkflowVocabulary, usesV4Semantics, validateGraph, } from '@cynodia/axiom-core';
+import { actionAuthority, actionGuards, authorityContext, expressionDefsIn, isObservable, maxContract, requiredServerContract, schemaFingerprint, stripAuthoringMetadata, serverIRExpressions, serverStateClosure, stateAuthority, usesExternalIOVocabulary, usesIntegrationVocabulary, usesInvocationVocabulary, usesMigrationVocabulary, usesQueryVocabulary, usesWorkflowVocabulary, usesAuthorizationVocabulary, usesV4Semantics, validateGraph, } from '@cynodia/axiom-core';
 import { GraphValidationError } from './normalize.js';
 /**
  * Compiles the authoritative half of a graph.
@@ -33,6 +33,7 @@ export function compileToServerIR(graph, options = {}) {
     const queries = [];
     const relationships = [];
     const readPolicies = [];
+    const authorizationPolicies = [];
     const migrations = [];
     const workflows = [];
     for (const node of nodes) {
@@ -77,6 +78,13 @@ export function compileToServerIR(graph, options = {}) {
         else if (node.kind === 'read-policy') {
             readPolicies.push(node);
         }
+        else if (node.kind === 'authorization-policy') {
+            // An authorization policy is authority-side by construction: the decision is made on
+            // the authority with the server-computed principal; a client never receives the rule
+            // and can never satisfy it by claiming to (spec15 §3, §65). Authoring markers stripped
+            // like any other trust-boundary payload.
+            authorizationPolicies.push(stripAuthoringMetadata(node));
+        }
         else if (node.kind === 'workflow') {
             // A workflow is authority-side by construction: only the authoritative runtime owns
             // durable orchestration state, leases and fencing (spec14 §87). It never reaches a
@@ -175,6 +183,7 @@ export function compileToServerIR(graph, options = {}) {
         ...(queries.length > 0 ? { queries } : {}),
         ...(relationships.length > 0 ? { relationships } : {}),
         ...(readPolicies.length > 0 ? { readPolicies } : {}),
+        ...(authorizationPolicies.length > 0 ? { authorizationPolicies } : {}),
         ...(workflows.length > 0 ? { workflows } : {}),
     };
     // Only the definitions the authority's own rules reach. A calculation used by the client
@@ -208,6 +217,7 @@ export function compileToServerIR(graph, options = {}) {
         usesQueryVocabulary(document) ? 'axiom.server.v6' : 'axiom.server.v1',
         usesMigrationVocabulary(document) ? 'axiom.server.v7' : 'axiom.server.v1',
         usesWorkflowVocabulary(document) ? 'axiom.server.v8' : 'axiom.server.v1',
+        usesAuthorizationVocabulary(document) ? 'axiom.server.v9' : 'axiom.server.v1',
     ];
     const contract = contractCandidates.reduce(maxContract);
     return { contract, ...document };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-compiler",
-  "version": "0.14.0-alpha.5",
+  "version": "0.15.0-alpha.2",
   "description": "Normalizes an Axiom application graph and emits a self-contained page.",
   "license": "MIT",
   "author": "AskTech AS",
@@ -31,8 +31,8 @@
     }
   },
   "dependencies": {
-    "@cynodia/axiom-core": "0.14.0-alpha.5",
-    "@cynodia/axiom-runtime": "0.14.0-alpha.5"
+    "@cynodia/axiom-core": "0.15.0-alpha.2",
+    "@cynodia/axiom-runtime": "0.15.0-alpha.2"
   },
   "scripts": {
     "build": "tsc -b tsconfig.json tsconfig.test.json",