@cynodia/axiom-core 0.14.0-alpha.5 → 0.15.0-alpha.2

package/dist/authority.d.ts

@@ -26,6 +26,20 @@ export declare const AUTHORITIES: readonly Authority[];
  * It is bound only where a server evaluates. A client never sees it.
  */
 export declare const PRINCIPAL: NodeId;
+/**
+ * The semantic object an authorization decision is made *about* — a provider record, a
+ * workflow instance, or (for `action.invoke`, where there is no per-record target) a stable
+ * descriptor of the operation's target. Bound only where an authority evaluates an
+ * `AuthorizationPolicyDef` (spec15 §34, §99); like `PRINCIPAL` it is never client-visible.
+ */
+export declare const RESOURCE: NodeId;
+/**
+ * The canonical semantic operation identity an authorization decision is made *for* — one of
+ * `AUTHORIZATION_OPERATIONS` (`'action.invoke'`, `'query.read'`, …). `ref(OPERATION)`
+ * resolves to that string directly. Bound only where an authority evaluates an
+ * `AuthorizationPolicyDef` (spec15 §34, §98).
+ */
+export declare const OPERATION: NodeId;
 /**
  * The authority of a state. Absent metadata means `client`, so every 0.5.x graph keeps
  * executing exactly as it did.

package/dist/authority.js

@@ -16,6 +16,20 @@ export const AUTHORITIES = ['client', 'server'];
  * It is bound only where a server evaluates. A client never sees it.
  */
 export const PRINCIPAL = 'axiom_principal';
+/**
+ * The semantic object an authorization decision is made *about* — a provider record, a
+ * workflow instance, or (for `action.invoke`, where there is no per-record target) a stable
+ * descriptor of the operation's target. Bound only where an authority evaluates an
+ * `AuthorizationPolicyDef` (spec15 §34, §99); like `PRINCIPAL` it is never client-visible.
+ */
+export const RESOURCE = 'axiom_resource';
+/**
+ * The canonical semantic operation identity an authorization decision is made *for* — one of
+ * `AUTHORIZATION_OPERATIONS` (`'action.invoke'`, `'query.read'`, …). `ref(OPERATION)`
+ * resolves to that string directly. Bound only where an authority evaluates an
+ * `AuthorizationPolicyDef` (spec15 §34, §98).
+ */
+export const OPERATION = 'axiom_operation';
 /**
  * The authority of a state. Absent metadata means `client`, so every 0.5.x graph keeps
  * executing exactly as it did.

package/dist/authorization.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Authorization completeness (spec15) — the canonical, portable authorization policy model.
+ *
+ * Authorization in Axiom is **semantic**: whether a principal may perform a semantic
+ * operation is executable meaning, not presentation. It therefore lives in the graph, in
+ * `semanticFingerprint`, in authority compatibility, in the Server IR and in conformance —
+ * never as a host-language callback (spec15 §6, §7).
+ *
+ * There is exactly **one** authorization language: an `AuthorizationPolicyDef` with a single
+ * boolean `allow` expression over a **closed scope** — `ref('PRINCIPAL')` (the canonical
+ * caller), `ref('RESOURCE')` (the semantic object the operation targets, where one exists)
+ * and `ref('OPERATION')` (the canonical operation identity). No `StateDef`, no `QueryDef`,
+ * no `now` / `uuid` / `random`, no ambient runtime state (spec15 §34). `allow` evaluating to
+ * exactly `true` is **ALLOW**; `false`, absence, or any evaluation error is **DENY** — the
+ * safe direction is always refusal (spec15 §8, §123).
+ *
+ * A policy is referenced by id from the surface it protects — `ActionDef.authorizationPolicy`,
+ * `QueryDef.authorizationPolicy`, `WorkflowDef.startPolicy` / `instanceAccessPolicy` — so the
+ * same evaluator and the same decision model apply everywhere (spec15 §5, §96). The legacy
+ * `ActionDef.authorization` boolean expression remains supported and is canonically
+ * equivalent to an inline `allow` over `PRINCIPAL`; `ReadPolicyDef` (spec10) remains the
+ * row-level read mechanism, unified into query authorization by spec15 Phase D.
+ *
+ * This module is portable plain data + `Expression` trees; it carries no enforcement (that
+ * is Phases C–F). The accessors are **total over any input** so a hand-tampered policy fails
+ * closed with a structured diagnostic, never a native exception (spec15 §37).
+ */
+import type { Expression } from './expressions.js';
+import type { NodeId } from './ids.js';
+import type { NodeBase } from './nodes.js';
+/**
+ * The canonical caller. The **same** reserved id `ActionDef.authorization` uses
+ * (`'axiom_principal'`, exported from `authority.ts` as `PRINCIPAL`) — write a policy with
+ * `field(ref(PRINCIPAL), F_ROLE)`, exactly as a legacy authorization expression.
+ */
+export declare const AUTHZ_PRINCIPAL_SCOPE: NodeId;
+/** The semantic object the operation targets (a record, a workflow instance, …), where one exists. */
+export declare const AUTHZ_RESOURCE_SCOPE: NodeId;
+/** The canonical operation identity — `ref(OPERATION)` resolves to an `AuthorizationOperation` string. */
+export declare const AUTHZ_OPERATION_SCOPE: NodeId;
+/** Every id a policy `allow` expression's `ref` may resolve. Nothing else is in scope. */
+export declare const AUTHORIZATION_SCOPE_IDS: readonly string[];
+/** Builtins forbidden in a policy expression — authorization must be deterministic (spec15 §34). */
+export declare const AUTHORIZATION_NONDETERMINISTIC_BUILTINS: ReadonlySet<string>;
+/**
+ * The closed set of canonical semantic operations an authorization decision is made about
+ * (spec15 §98). Policies reason over these, never over transport method names. Enforcement
+ * of each arrives with its phase (C: `action.invoke` / `record.*` / `state.*`; D:
+ * `query.read`; E: `workflow.*`; F: `live.*` / `subscription.*`).
+ */
+export declare const AUTHORIZATION_OPERATIONS: readonly ["action.invoke", "query.read", "record.read", "record.mutate", "state.read", "state.mutate", "workflow.start", "workflow.inspect", "workflow.history", "workflow.cancel", "live.open", "live.resume", "subscription.open", "event.ingress"];
+export type AuthorizationOperation = (typeof AUTHORIZATION_OPERATIONS)[number];
+export interface AuthorizationPolicyDef extends NodeBase {
+    kind: 'authorization-policy';
+    /**
+     * Boolean, closed scope (`PRINCIPAL` / `RESOURCE` / `OPERATION` only). Exactly `true` ⇒
+     * ALLOW; `false` / absent / evaluation error ⇒ DENY (spec15 §8). Deterministic — no
+     * `now` / `uuid` / `random`, no `StateDef` / `QueryDef` (spec15 §34).
+     */
+    allow: Expression;
+}
+/**
+ * What a protected surface does when it has **no** attached policy (spec15 §9). Deliberately
+ * one canonical rule, applied consistently, never left to the runtime:
+ *
+ * - a surface whose *current* (pre-0.15) contract is public — an unrestricted `ActionDef`,
+ *   an unrestricted `QueryDef` — keeps that public contract (`'public'`);
+ * - a surface whose current contract is already restricted — a `WorkflowDef` instance
+ *   operation (0.14 owner-fingerprint), an `ActionDef` with a legacy `authorization`
+ *   expression, a `QueryDef` with a `ReadPolicyDef` — keeps that restriction;
+ * - a *new* privileged surface with no policy fails closed (`'deny'`).
+ *
+ * These constants name the rule so docs, tests and a future independent runtime agree.
+ */
+export declare const AUTHORIZATION_DEFAULT: {
+    /** No policy, previously-public surface ⇒ still public. */
+    readonly PUBLIC_SURFACE: "public";
+    /** No policy, previously-restricted surface ⇒ keep the prior restriction. */
+    readonly KEEP_PRIOR_RESTRICTION: "keep-prior-restriction";
+    /** No policy, new privileged surface ⇒ DENY. */
+    readonly FAIL_CLOSED: "deny";
+};
+/** Every `Expression` a policy embeds — total over malformed input. */
+export declare function authorizationPolicyExpressions(policy: unknown): Expression[];
+export interface AuthorizationPolicyProblem {
+    code: 'AUTHORIZATION_INVALID_POLICY' | 'AUTHORIZATION_INVALID_SCOPE' | 'AUTHORIZATION_NONDETERMINISTIC';
+    message: string;
+}
+export declare function authorizationPolicyProblems(policy: unknown): AuthorizationPolicyProblem[];
+export interface AuthorizationPolicyDependencies {
+    /** Field ids the policy's `allow` expression reads off `PRINCIPAL`. */
+    principalFields: string[];
+    /** Field ids it reads off `RESOURCE`. */
+    resourceFields: string[];
+    /** Whether it references `OPERATION` at all. */
+    readsOperation: boolean;
+    /**
+     * A verdict when `allow` is a constant `literal` (spec15 §8): a literal `true` always
+     * allows, anything else always denies. `null` when the decision depends on the inputs.
+     */
+    constant: 'always-allow' | 'always-deny' | null;
+}
+/**
+ * What an `AuthorizationPolicyDef` depends on — for explainability, static coverage analysis
+ * and AI authoring (spec15 §35, §44). Total over malformed input (empty result). Reports
+ * *structure only*, never a runtime value.
+ */
+export declare function authorizationPolicyDependencies(policy: unknown): AuthorizationPolicyDependencies;
+export declare const AUTHORIZATION_DECISIONS: readonly ["ALLOW", "DENY"];
+export type AuthorizationDecision = (typeof AUTHORIZATION_DECISIONS)[number];
+/** One evaluated boolean input to an authorization decision. `ok: false` ⇒ evaluation failed. */
+export interface AuthorizationCheckPart {
+    ok: boolean;
+    value?: unknown;
+}
+export interface AuthorizationCheckInput {
+    /**
+     * The `AuthorizationPolicyDef.allow` outcome, when a policy is attached. Per spec15 §8 a
+     * policy allows only when it evaluates to **exactly `true`**.
+     */
+    policy?: AuthorizationCheckPart;
+    /**
+     * The legacy `ActionDef.authorization` expression outcome, when that expression is present.
+     * Its historical truthiness rule is kept: a non-empty array or any truthy value allows.
+     */
+    legacy?: AuthorizationCheckPart;
+}
+export interface AuthorizationCheckResult {
+    decision: AuthorizationDecision;
+    reason: 'no-policy' | 'allowed' | 'policy-denied' | 'policy-error' | 'legacy-denied' | 'legacy-error';
+}
+/**
+ * The canonical ALLOW/DENY combination (spec15 §8, §123) — a pure function of already
+ * evaluated inputs, so it is identical on every surface and independently checkable.
+ *
+ * - neither a policy nor a legacy expression ⇒ ALLOW (`no-policy`);
+ * - a policy that failed to evaluate ⇒ DENY (`policy-error`) — an evaluation error never allows;
+ * - a policy whose value is not exactly `true` ⇒ DENY (`policy-denied`);
+ * - a legacy expression that failed to evaluate ⇒ DENY (`legacy-error`);
+ * - a legacy expression that is falsy / an empty collection ⇒ DENY (`legacy-denied`);
+ * - otherwise ALLOW (`allowed`). Both, when present, must pass (conjunction).
+ */
+export declare function decideAuthorization(input: AuthorizationCheckInput): AuthorizationCheckResult;
+/**
+ * The closed scope an `AuthorizationPolicyDef.allow` expression is evaluated against. Each
+ * field is a plain record or `null` (anonymous / no resource); a `field` read of a key that
+ * is not present is **security-scope absence**, not an ordinary `undefined` (spec15pt2 §5-§7).
+ */
+export interface AuthorizationPolicyScope {
+    principal: Record<string, unknown> | null | undefined;
+    resource: Record<string, unknown> | null | undefined;
+    operation: string;
+}
+/**
+ * spec15pt2 F1 — the **canonical** three-valued `AuthorizationPolicyDef.allow` evaluator,
+ * used by every policy-bearing surface (spec15pt2 §33). Returns the `{ ok, value }` shape
+ * `decideAuthorization` already consumes:
+ *
+ * - `allow` reduces to **exactly `true`** (with every required security input present) ⇒
+ *   `{ ok: true, value: true }` — the only ALLOW;
+ * - `allow` reduces to any other concrete value ⇒ `{ ok: true, value: false }`;
+ * - the truth of `allow` depends on a **missing PRINCIPAL / RESOURCE field**
+ *   (`AbsentSecurityValue`) ⇒ `{ ok: true, value: false }` — absence never creates authority
+ *   through `eq` / `neq` / `not` / `or` (spec15pt2 §8-§12);
+ * - an evaluation error (malformed node reaching the runtime, unsupported builtin) ⇒
+ *   `{ ok: false }`.
+ *
+ * A constant `literal(true)` is `{ ok: true, value: true }` regardless of principal — an
+ * explicitly public policy still admits an anonymous caller (spec15pt2 §13, §14).
+ */
+export declare function evaluateAuthorizationPolicyAllow(allow: unknown, scope: AuthorizationPolicyScope): AuthorizationCheckPart;
+/**
+ * The distinct policy ids a graph node references for authorization — for dependency
+ * analysis and `validateGraph` reference resolution. Total over malformed input.
+ */
+export declare function nodeAuthorizationPolicyRefs(node: unknown): string[];
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.js

@@ -0,0 +1,588 @@
+/**
+ * Authorization completeness (spec15) — the canonical, portable authorization policy model.
+ *
+ * Authorization in Axiom is **semantic**: whether a principal may perform a semantic
+ * operation is executable meaning, not presentation. It therefore lives in the graph, in
+ * `semanticFingerprint`, in authority compatibility, in the Server IR and in conformance —
+ * never as a host-language callback (spec15 §6, §7).
+ *
+ * There is exactly **one** authorization language: an `AuthorizationPolicyDef` with a single
+ * boolean `allow` expression over a **closed scope** — `ref('PRINCIPAL')` (the canonical
+ * caller), `ref('RESOURCE')` (the semantic object the operation targets, where one exists)
+ * and `ref('OPERATION')` (the canonical operation identity). No `StateDef`, no `QueryDef`,
+ * no `now` / `uuid` / `random`, no ambient runtime state (spec15 §34). `allow` evaluating to
+ * exactly `true` is **ALLOW**; `false`, absence, or any evaluation error is **DENY** — the
+ * safe direction is always refusal (spec15 §8, §123).
+ *
+ * A policy is referenced by id from the surface it protects — `ActionDef.authorizationPolicy`,
+ * `QueryDef.authorizationPolicy`, `WorkflowDef.startPolicy` / `instanceAccessPolicy` — so the
+ * same evaluator and the same decision model apply everywhere (spec15 §5, §96). The legacy
+ * `ActionDef.authorization` boolean expression remains supported and is canonically
+ * equivalent to an inline `allow` over `PRINCIPAL`; `ReadPolicyDef` (spec10) remains the
+ * row-level read mechanism, unified into query authorization by spec15 Phase D.
+ *
+ * This module is portable plain data + `Expression` trees; it carries no enforcement (that
+ * is Phases C–F). The accessors are **total over any input** so a hand-tampered policy fails
+ * closed with a structured diagnostic, never a native exception (spec15 §37).
+ */
+import { OPERATION, PRINCIPAL, RESOURCE } from './authority.js';
+import { EXPRESSION_KINDS } from './expressions.js';
+// --------------------------------------------------------------------- reserved scope ids
+/**
+ * The canonical caller. The **same** reserved id `ActionDef.authorization` uses
+ * (`'axiom_principal'`, exported from `authority.ts` as `PRINCIPAL`) — write a policy with
+ * `field(ref(PRINCIPAL), F_ROLE)`, exactly as a legacy authorization expression.
+ */
+export const AUTHZ_PRINCIPAL_SCOPE = PRINCIPAL;
+/** The semantic object the operation targets (a record, a workflow instance, …), where one exists. */
+export const AUTHZ_RESOURCE_SCOPE = RESOURCE;
+/** The canonical operation identity — `ref(OPERATION)` resolves to an `AuthorizationOperation` string. */
+export const AUTHZ_OPERATION_SCOPE = OPERATION;
+/** Every id a policy `allow` expression's `ref` may resolve. Nothing else is in scope. */
+export const AUTHORIZATION_SCOPE_IDS = [
+    AUTHZ_PRINCIPAL_SCOPE,
+    AUTHZ_RESOURCE_SCOPE,
+    AUTHZ_OPERATION_SCOPE,
+];
+/** Builtins forbidden in a policy expression — authorization must be deterministic (spec15 §34). */
+export const AUTHORIZATION_NONDETERMINISTIC_BUILTINS = new Set([
+    'now',
+    'uuid',
+    'random',
+]);
+// ----------------------------------------------------------------------- operation identity
+/**
+ * The closed set of canonical semantic operations an authorization decision is made about
+ * (spec15 §98). Policies reason over these, never over transport method names. Enforcement
+ * of each arrives with its phase (C: `action.invoke` / `record.*` / `state.*`; D:
+ * `query.read`; E: `workflow.*`; F: `live.*` / `subscription.*`).
+ */
+export const AUTHORIZATION_OPERATIONS = [
+    'action.invoke',
+    'query.read',
+    'record.read',
+    'record.mutate',
+    'state.read',
+    'state.mutate',
+    'workflow.start',
+    'workflow.inspect',
+    'workflow.history',
+    'workflow.cancel',
+    'live.open',
+    'live.resume',
+    'subscription.open',
+    'event.ingress',
+];
+// --------------------------------------------------------------------------- default rule
+/**
+ * What a protected surface does when it has **no** attached policy (spec15 §9). Deliberately
+ * one canonical rule, applied consistently, never left to the runtime:
+ *
+ * - a surface whose *current* (pre-0.15) contract is public — an unrestricted `ActionDef`,
+ *   an unrestricted `QueryDef` — keeps that public contract (`'public'`);
+ * - a surface whose current contract is already restricted — a `WorkflowDef` instance
+ *   operation (0.14 owner-fingerprint), an `ActionDef` with a legacy `authorization`
+ *   expression, a `QueryDef` with a `ReadPolicyDef` — keeps that restriction;
+ * - a *new* privileged surface with no policy fails closed (`'deny'`).
+ *
+ * These constants name the rule so docs, tests and a future independent runtime agree.
+ */
+export const AUTHORIZATION_DEFAULT = {
+    /** No policy, previously-public surface ⇒ still public. */
+    PUBLIC_SURFACE: 'public',
+    /** No policy, previously-restricted surface ⇒ keep the prior restriction. */
+    KEEP_PRIOR_RESTRICTION: 'keep-prior-restriction',
+    /** No policy, new privileged surface ⇒ DENY. */
+    FAIL_CLOSED: 'deny',
+};
+// -------------------------------------------------------------------------------- accessors
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/** Every `Expression` a policy embeds — total over malformed input. */
+export function authorizationPolicyExpressions(policy) {
+    if (!isPlainObject(policy))
+        return [];
+    const allow = policy.allow;
+    return isPlainObject(allow) ? [allow] : [];
+}
+/** Walk an expression tree collecting every scope `ref` id and every nondeterministic call. */
+function walkPolicyExpression(expression, refs, nondeterministic, seen = new Set()) {
+    if (!isPlainObject(expression) || seen.has(expression))
+        return;
+    seen.add(expression);
+    if (expression.kind === 'ref' && expression.targetId !== undefined) {
+        refs.add(String(expression.targetId));
+    }
+    if (expression.kind === 'call' &&
+        typeof expression.function === 'string' &&
+        AUTHORIZATION_NONDETERMINISTIC_BUILTINS.has(expression.function)) {
+        nondeterministic.add(expression.function);
+    }
+    if (expression.kind === 'literal')
+        return;
+    for (const value of Object.values(expression)) {
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                walkPolicyExpression(entry, refs, nondeterministic, seen);
+        }
+        else if (isPlainObject(value)) {
+            walkPolicyExpression(value, refs, nondeterministic, seen);
+        }
+    }
+}
+/**
+ * A **total** structural + scope check on an `AuthorizationPolicyDef` value — for any input,
+ * including a hand-tampered Server IR where the policy is the wrong shape entirely (spec15
+ * §37). Cross-node reference resolution (does an `authorizationPolicy` id point at a real
+ * policy) is `validateGraph`'s job, not this function's.
+ */
+/**
+ * spec15pt2 §39-§41 (F2) — a **total** structural check on an `allow` expression tree.
+ * Every node must be a plain object whose `kind` is a real `EXPRESSION_KINDS` member and
+ * whose per-kind required children are present and themselves structurally valid. Returns a
+ * short reason on the first problem, `null` when the tree is well-formed. Never throws.
+ */
+function malformedExpressionReason(expression, seen = new Set()) {
+    if (!isPlainObject(expression))
+        return 'a policy expression node is not an object';
+    if (seen.has(expression))
+        return 'a policy expression contains a cycle';
+    seen.add(expression);
+    const kind = expression.kind;
+    if (typeof kind !== 'string' || !EXPRESSION_KINDS.includes(kind)) {
+        return `unknown expression kind ${JSON.stringify(kind)}`;
+    }
+    const child = (name) => malformedExpressionReason(expression[name], seen);
+    const list = (name) => {
+        const arr = expression[name];
+        if (!Array.isArray(arr))
+            return `${kind}.${name} is not an array`;
+        for (const entry of arr) {
+            const r = malformedExpressionReason(entry, seen);
+            if (r)
+                return r;
+        }
+        return null;
+    };
+    switch (kind) {
+        case 'literal':
+            return 'value' in expression ? null : 'literal has no value';
+        case 'ref':
+            return typeof expression.targetId === 'string' ? null : 'ref has no targetId';
+        case 'field':
+            return (typeof expression.fieldId === 'string' ? null : 'field has no fieldId') ?? child('source');
+        case 'unary':
+            return (typeof expression.operator === 'string' ? null : 'unary has no operator') ?? child('operand');
+        case 'binary':
+            return (typeof expression.operator === 'string' ? null : 'binary has no operator') ?? child('left') ?? child('right');
+        case 'call':
+            return (typeof expression.function === 'string' ? null : 'call has no function') ?? list('arguments');
+        case 'conditional':
+            return child('condition') ?? child('whenTrue') ?? child('whenFalse');
+        case 'object': {
+            const entries = expression.entries;
+            if (!Array.isArray(entries))
+                return 'object has no entries array';
+            for (const e of entries) {
+                if (!isPlainObject(e) || typeof e.fieldId !== 'string')
+                    return 'an object entry is malformed';
+                const r = malformedExpressionReason(e.value, seen);
+                if (r)
+                    return r;
+            }
+            return null;
+        }
+        case 'filter':
+        case 'find':
+        case 'every':
+        case 'some':
+            return child('source') ?? child('predicate');
+        case 'map':
+            return child('source') ?? child('projection');
+        case 'sort':
+        case 'group':
+            return child('source') ?? child('by');
+        case 'flatten':
+            return child('source');
+        case 'expression-ref':
+            return typeof expression.targetId === 'string' ? null : 'expression-ref has no targetId';
+        default:
+            return `unsupported expression kind ${kind}`;
+    }
+}
+export function authorizationPolicyProblems(policy) {
+    const problems = [];
+    const pid = isPlainObject(policy) ? String(policy.id ?? '<unknown>') : '<unknown>';
+    if (!isPlainObject(policy)) {
+        return [{ code: 'AUTHORIZATION_INVALID_POLICY', message: `Authorization policy ${pid} is not an object` }];
+    }
+    if (!isPlainObject(policy.allow)) {
+        problems.push({
+            code: 'AUTHORIZATION_INVALID_POLICY',
+            message: `Authorization policy ${pid} has no boolean 'allow' expression`,
+        });
+        return problems;
+    }
+    // spec15pt2 F2 — a malformed `allow` tree is rejected structurally here, before compile,
+    // rather than surviving to a native exception at evaluation.
+    const malformed = malformedExpressionReason(policy.allow);
+    if (malformed) {
+        return [{ code: 'AUTHORIZATION_INVALID_POLICY', message: `Authorization policy ${pid} has a malformed 'allow' expression: ${malformed}` }];
+    }
+    const refs = new Set();
+    const nondeterministic = new Set();
+    walkPolicyExpression(policy.allow, refs, nondeterministic);
+    for (const id of refs) {
+        if (!AUTHORIZATION_SCOPE_IDS.includes(id)) {
+            problems.push({
+                code: 'AUTHORIZATION_INVALID_SCOPE',
+                message: `Authorization policy ${pid} references ${id}, which is not in the policy scope (PRINCIPAL / RESOURCE / OPERATION)`,
+            });
+        }
+    }
+    for (const fn of nondeterministic) {
+        problems.push({
+            code: 'AUTHORIZATION_NONDETERMINISTIC',
+            message: `Authorization policy ${pid} calls ${fn}(), which is not deterministic and not allowed in a policy expression`,
+        });
+    }
+    return problems;
+}
+function collectScopeFieldReads(expression, principal, resource, operation, seen = new Set()) {
+    if (!isPlainObject(expression) || seen.has(expression))
+        return;
+    seen.add(expression);
+    if (expression.kind === 'ref' && String(expression.targetId) === AUTHZ_OPERATION_SCOPE) {
+        operation.seen = true;
+    }
+    if (expression.kind === 'field' &&
+        isPlainObject(expression.source) &&
+        expression.source.kind === 'ref' &&
+        expression.fieldId !== undefined) {
+        const target = String(expression.source.targetId);
+        if (target === AUTHZ_PRINCIPAL_SCOPE)
+            principal.add(String(expression.fieldId));
+        else if (target === AUTHZ_RESOURCE_SCOPE)
+            resource.add(String(expression.fieldId));
+    }
+    if (expression.kind === 'literal')
+        return;
+    for (const value of Object.values(expression)) {
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                collectScopeFieldReads(entry, principal, resource, operation, seen);
+        }
+        else if (isPlainObject(value)) {
+            collectScopeFieldReads(value, principal, resource, operation, seen);
+        }
+    }
+}
+/**
+ * What an `AuthorizationPolicyDef` depends on — for explainability, static coverage analysis
+ * and AI authoring (spec15 §35, §44). Total over malformed input (empty result). Reports
+ * *structure only*, never a runtime value.
+ */
+export function authorizationPolicyDependencies(policy) {
+    const principal = new Set();
+    const resource = new Set();
+    const operation = { seen: false };
+    const allow = isPlainObject(policy) ? policy.allow : undefined;
+    if (isPlainObject(allow)) {
+        collectScopeFieldReads(allow, principal, resource, operation);
+    }
+    let constant = null;
+    if (isPlainObject(allow) && allow.kind === 'literal') {
+        constant = allow.value === true ? 'always-allow' : 'always-deny';
+    }
+    return {
+        principalFields: [...principal].sort(),
+        resourceFields: [...resource].sort(),
+        readsOperation: operation.seen,
+        constant,
+    };
+}
+// --------------------------------------------------------------- the decision (spec15 §8)
+export const AUTHORIZATION_DECISIONS = ['ALLOW', 'DENY'];
+/**
+ * The canonical ALLOW/DENY combination (spec15 §8, §123) — a pure function of already
+ * evaluated inputs, so it is identical on every surface and independently checkable.
+ *
+ * - neither a policy nor a legacy expression ⇒ ALLOW (`no-policy`);
+ * - a policy that failed to evaluate ⇒ DENY (`policy-error`) — an evaluation error never allows;
+ * - a policy whose value is not exactly `true` ⇒ DENY (`policy-denied`);
+ * - a legacy expression that failed to evaluate ⇒ DENY (`legacy-error`);
+ * - a legacy expression that is falsy / an empty collection ⇒ DENY (`legacy-denied`);
+ * - otherwise ALLOW (`allowed`). Both, when present, must pass (conjunction).
+ */
+export function decideAuthorization(input) {
+    const { policy, legacy } = input;
+    if (!policy && !legacy)
+        return { decision: 'ALLOW', reason: 'no-policy' };
+    if (policy) {
+        if (!policy.ok)
+            return { decision: 'DENY', reason: 'policy-error' };
+        if (policy.value !== true)
+            return { decision: 'DENY', reason: 'policy-denied' };
+    }
+    if (legacy) {
+        if (!legacy.ok)
+            return { decision: 'DENY', reason: 'legacy-error' };
+        const permitted = Array.isArray(legacy.value) ? legacy.value.length > 0 : Boolean(legacy.value);
+        if (!permitted)
+            return { decision: 'DENY', reason: 'legacy-denied' };
+    }
+    return { decision: 'ALLOW', reason: 'allowed' };
+}
+const U = { t: 'u' };
+const E = { t: 'e' };
+const C = (v) => ({ t: 'c', v });
+function asBool(v) {
+    return v === true ? true : v === false ? false : Boolean(v);
+}
+function deepEq(a, b) {
+    if (a === b)
+        return true;
+    try {
+        return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether an expression tree reads only through `field` / `ref` rooted at PRINCIPAL / RESOURCE. */
+function isSecurityRooted(expression) {
+    if (!isPlainObject(expression))
+        return false;
+    if (expression.kind === 'ref') {
+        const t = String(expression.targetId);
+        return t === AUTHZ_PRINCIPAL_SCOPE || t === AUTHZ_RESOURCE_SCOPE;
+    }
+    if (expression.kind === 'field')
+        return isSecurityRooted(expression.source);
+    return false;
+}
+function evalAuthz(expression, scope, seen) {
+    if (!isPlainObject(expression) || seen.has(expression))
+        return E;
+    seen.add(expression);
+    switch (expression.kind) {
+        case 'literal':
+            return C(expression.value);
+        case 'ref': {
+            const t = String(expression.targetId);
+            if (t === AUTHZ_PRINCIPAL_SCOPE)
+                return C(scope.principal ?? null);
+            if (t === AUTHZ_RESOURCE_SCOPE)
+                return C(scope.resource ?? null);
+            if (t === AUTHZ_OPERATION_SCOPE)
+                return C(scope.operation);
+            return E; // out of the closed scope — validation rejects it; be total
+        }
+        case 'field': {
+            const src = evalAuthz(expression.source, scope, seen);
+            if (src.t === 'e')
+                return E;
+            if (src.t === 'u')
+                return U;
+            const key = String(expression.fieldId);
+            const rooted = isSecurityRooted(expression.source);
+            const obj = src.v;
+            if (obj === null || obj === undefined || typeof obj !== 'object') {
+                return rooted ? U : C(null);
+            }
+            const present = Object.prototype.hasOwnProperty.call(obj, key) && obj[key] !== undefined;
+            if (!present)
+                return rooted ? U : C(null);
+            return C(obj[key]);
+        }
+        case 'unary': {
+            const operand = evalAuthz(expression.operand, scope, seen);
+            if (operand.t !== 'c')
+                return operand; // NOT unknown ⇒ unknown; NOT error ⇒ error (§9, §12)
+            return expression.operator === 'not' ? C(!asBool(operand.v)) : C(-Number(operand.v));
+        }
+        case 'binary': {
+            const op = String(expression.operator);
+            if (op === 'and') {
+                const l = evalAuthz(expression.left, scope, seen);
+                if (l.t === 'c' && !asBool(l.v))
+                    return C(false); // FALSE AND _ ⇒ FALSE (short-circuit-independent)
+                const r = evalAuthz(expression.right, scope, seen);
+                if (l.t === 'e' || r.t === 'e')
+                    return E;
+                if (r.t === 'c' && !asBool(r.v))
+                    return C(false);
+                if (l.t === 'c' && r.t === 'c')
+                    return C(true); // both concrete-true
+                return U;
+            }
+            if (op === 'or') {
+                const l = evalAuthz(expression.left, scope, seen);
+                if (l.t === 'c' && asBool(l.v))
+                    return C(true); // TRUE OR _ ⇒ TRUE
+                const r = evalAuthz(expression.right, scope, seen);
+                if (l.t === 'e' || r.t === 'e')
+                    return E;
+                if (r.t === 'c' && asBool(r.v))
+                    return C(true);
+                if (l.t === 'c' && r.t === 'c')
+                    return C(false); // both concrete-false
+                return U;
+            }
+            const l = evalAuthz(expression.left, scope, seen);
+            const r = evalAuthz(expression.right, scope, seen);
+            if (l.t === 'e' || r.t === 'e')
+                return E;
+            if (l.t === 'u' || r.t === 'u')
+                return U; // any comparison touching absence ⇒ non-satisfied (§8)
+            const a = l.v;
+            const b = r.v;
+            switch (op) {
+                case 'eq':
+                    return C(deepEq(a, b));
+                case 'neq':
+                    return C(!deepEq(a, b));
+                case 'lt':
+                    return C(a < b);
+                case 'lte':
+                    return C(a <= b);
+                case 'gt':
+                    return C(a > b);
+                case 'gte':
+                    return C(a >= b);
+                case 'add':
+                    return C(a + b);
+                case 'subtract':
+                    return C(a - b);
+                case 'multiply':
+                    return C(a * b);
+                case 'divide':
+                    return C(a / b);
+                default:
+                    return E;
+            }
+        }
+        case 'conditional': {
+            const c = evalAuthz(expression.condition, scope, seen);
+            if (c.t !== 'c')
+                return c;
+            return asBool(c.v) ? evalAuthz(expression.whenTrue, scope, seen) : evalAuthz(expression.whenFalse, scope, seen);
+        }
+        case 'object': {
+            const out = {};
+            for (const entry of expression.entries ?? []) {
+                const v = evalAuthz(entry.value, scope, seen);
+                if (v.t === 'e')
+                    return E;
+                if (v.t === 'u')
+                    return U;
+                out[String(entry.fieldId)] = v.v;
+            }
+            return C(out);
+        }
+        case 'call': {
+            const args = [];
+            for (const argument of expression.arguments ?? []) {
+                const v = evalAuthz(argument, scope, seen);
+                if (v.t === 'e')
+                    return E;
+                if (v.t === 'u')
+                    return U; // conservative: any absent input ⇒ non-satisfied (spec15pt2 §57, §85)
+                args.push(v.v);
+            }
+            return applyPolicyBuiltin(String(expression.function), args);
+        }
+        default:
+            return E;
+    }
+}
+function applyPolicyBuiltin(fn, args) {
+    switch (fn) {
+        case 'required':
+            return C(args[0] !== null && args[0] !== undefined);
+        case 'is-empty':
+            return C(args[0] === null || args[0] === undefined || args[0] === '' || (Array.isArray(args[0]) && args[0].length === 0));
+        case 'non-empty':
+            return C(!(args[0] === null || args[0] === undefined || args[0] === '' || (Array.isArray(args[0]) && args[0].length === 0)));
+        case 'length':
+            return C(Array.isArray(args[0]) || typeof args[0] === 'string' ? args[0].length : 0);
+        case 'contains':
+            return C(typeof args[0] === 'string'
+                ? args[0].includes(String(args[1]))
+                : Array.isArray(args[0])
+                    ? args[0].some((x) => deepEq(x, args[1]))
+                    : false);
+        case 'one-of':
+            return C(args.slice(1).some((x) => deepEq(x, args[0])));
+        case 'concat':
+            return C(args.map((x) => (x === null || x === undefined ? '' : String(x))).join(''));
+        case 'to-string':
+            return C(args[0] === null || args[0] === undefined ? '' : String(args[0]));
+        case 'lowercase':
+            return C(String(args[0] ?? '').toLowerCase());
+        case 'trim':
+            return C(String(args[0] ?? '').trim());
+        case 'substring-before': {
+            const s = String(args[0] ?? '');
+            const i = s.indexOf(String(args[1] ?? ''));
+            return C(i < 0 ? '' : s.slice(0, i));
+        }
+        case 'substring-after': {
+            const s = String(args[0] ?? '');
+            const needle = String(args[1] ?? '');
+            const i = s.indexOf(needle);
+            return C(i < 0 ? '' : s.slice(i + needle.length));
+        }
+        case 'coalesce':
+            return C(args.find((x) => x !== null && x !== undefined) ?? null);
+        default:
+            return E; // an unknown / non-deterministic builtin fails closed
+    }
+}
+/**
+ * spec15pt2 F1 — the **canonical** three-valued `AuthorizationPolicyDef.allow` evaluator,
+ * used by every policy-bearing surface (spec15pt2 §33). Returns the `{ ok, value }` shape
+ * `decideAuthorization` already consumes:
+ *
+ * - `allow` reduces to **exactly `true`** (with every required security input present) ⇒
+ *   `{ ok: true, value: true }` — the only ALLOW;
+ * - `allow` reduces to any other concrete value ⇒ `{ ok: true, value: false }`;
+ * - the truth of `allow` depends on a **missing PRINCIPAL / RESOURCE field**
+ *   (`AbsentSecurityValue`) ⇒ `{ ok: true, value: false }` — absence never creates authority
+ *   through `eq` / `neq` / `not` / `or` (spec15pt2 §8-§12);
+ * - an evaluation error (malformed node reaching the runtime, unsupported builtin) ⇒
+ *   `{ ok: false }`.
+ *
+ * A constant `literal(true)` is `{ ok: true, value: true }` regardless of principal — an
+ * explicitly public policy still admits an anonymous caller (spec15pt2 §13, §14).
+ */
+export function evaluateAuthorizationPolicyAllow(allow, scope) {
+    let result;
+    try {
+        result = evalAuthz(allow, scope, new Set());
+    }
+    catch {
+        return { ok: false };
+    }
+    if (result.t === 'e')
+        return { ok: false };
+    if (result.t === 'u')
+        return { ok: true, value: false };
+    return { ok: true, value: result.v };
+}
+/**
+ * The distinct policy ids a graph node references for authorization — for dependency
+ * analysis and `validateGraph` reference resolution. Total over malformed input.
+ */
+export function nodeAuthorizationPolicyRefs(node) {
+    if (!isPlainObject(node))
+        return [];
+    const out = [];
+    for (const key of ['authorizationPolicy', 'startPolicy', 'instanceAccessPolicy']) {
+        const value = node[key];
+        if (typeof value === 'string')
+            out.push(value);
+    }
+    return out;
+}

package/dist/diagnostics.d.ts

@@ -204,5 +204,13 @@ export declare const VALIDATION_CODES: {
     readonly migrationTransformImpure: "MIGRATION_TRANSFORM_IMPURE";
     /** A `transform-field` whose declared `toType` does not match the field's type in the target schema, or an `add-field` `populate` whose value cannot satisfy the field (spec11 §77). */
     readonly migrationTransformTypeMismatch: "MIGRATION_TRANSFORM_TYPE_MISMATCH";
+    /** An `AuthorizationPolicyDef` with no boolean `allow` expression, or a non-object policy value. */
+    readonly authorizationInvalidPolicy: "AUTHORIZATION_INVALID_POLICY";
+    /** An `AuthorizationPolicyDef.allow` expression references an id outside the policy scope (`PRINCIPAL` / `RESOURCE` / `OPERATION`). */
+    readonly authorizationInvalidScope: "AUTHORIZATION_INVALID_SCOPE";
+    /** An `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` id that does not resolve to an `authorization-policy` node. */
+    readonly authorizationUnknownPolicy: "AUTHORIZATION_UNKNOWN_POLICY";
+    /** An `AuthorizationPolicyDef.allow` expression calls `now` / `uuid` / `random` — authorization must be deterministic (spec15 §34). */
+    readonly authorizationNondeterministic: "AUTHORIZATION_NONDETERMINISTIC";
 };
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/diagnostics.js

@@ -200,4 +200,15 @@ export const VALIDATION_CODES = {
     migrationTransformImpure: 'MIGRATION_TRANSFORM_IMPURE',
     /** A `transform-field` whose declared `toType` does not match the field's type in the target schema, or an `add-field` `populate` whose value cannot satisfy the field (spec11 §77). */
     migrationTransformTypeMismatch: 'MIGRATION_TRANSFORM_TYPE_MISMATCH',
+    // Authorization completeness (0.15). `validateGraph` rejects a malformed or inconsistent
+    // authorization policy before it can be compiled or executed; every failure is structured,
+    // never a native exception (spec15 §36, §37, §38).
+    /** An `AuthorizationPolicyDef` with no boolean `allow` expression, or a non-object policy value. */
+    authorizationInvalidPolicy: 'AUTHORIZATION_INVALID_POLICY',
+    /** An `AuthorizationPolicyDef.allow` expression references an id outside the policy scope (`PRINCIPAL` / `RESOURCE` / `OPERATION`). */
+    authorizationInvalidScope: 'AUTHORIZATION_INVALID_SCOPE',
+    /** An `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` id that does not resolve to an `authorization-policy` node. */
+    authorizationUnknownPolicy: 'AUTHORIZATION_UNKNOWN_POLICY',
+    /** An `AuthorizationPolicyDef.allow` expression calls `now` / `uuid` / `random` — authorization must be deterministic (spec15 §34). */
+    authorizationNondeterministic: 'AUTHORIZATION_NONDETERMINISTIC',
 };

package/dist/graph.js

@@ -23,7 +23,7 @@ export class ApplicationGraph {
     /** Bumped by every change, so the derived edge index can never serve stale data. */
     revision = 0;
     semanticIndex;
-    constructor(id, name, version = '0.14.0') {
+    constructor(id, name, version = '0.15.0') {
         this.data = { id, name, version, nodes: {}, edges: {} };
     }
     get id() {

package/dist/index.d.ts

@@ -16,6 +16,7 @@ export * from './storage.js';
 export * from './query.js';
 export * from './live-query.js';
 export * from './workflows.js';
+export * from './authorization.js';
 export * from './relationships.js';
 export * from './read-policy.js';
 export * from './migration.js';

package/dist/index.js

@@ -16,6 +16,7 @@ export * from './storage.js';
 export * from './query.js';
 export * from './live-query.js';
 export * from './workflows.js';
+export * from './authorization.js';
 export * from './relationships.js';
 export * from './read-policy.js';
 export * from './migration.js';

package/dist/nodes.d.ts

@@ -229,6 +229,13 @@ export interface ActionDef extends NodeBase {
      * claiming to. `requiresConfirmation` is UX and is not an authorization mechanism.
      */
     authorization?: Expression;
+    /**
+     * The `AuthorizationPolicyDef` id governing `action.invoke` (spec15). The canonical 0.15
+     * form of `authorization` above: one policy language, one evaluator. If both are present
+     * the effective decision is their conjunction (ALLOW iff both ALLOW). Absent + no legacy
+     * `authorization` ⇒ the action's pre-0.15 public contract is preserved (spec15 §9).
+     */
+    authorizationPolicy?: NodeId;
     /** What the confirmation says, when a plain message is not enough. */
     confirmation?: ConfirmationPresentation;
     /** Restricts which invocation sources may reach this action. Absent means both. */

package/dist/query.d.ts

@@ -200,6 +200,12 @@ export interface QueryDef extends NodeBase {
     pagination?: QueryPagination;
     /** The `ReadPolicyDef` whose predicate is AND-ed into `filter` before execution. */
     readPolicyId?: NodeId;
+    /**
+     * The `AuthorizationPolicyDef` id governing `query.read` — whether this principal may run
+     * the query at all (spec15), distinct from `readPolicyId` which filters *which rows* the
+     * result contains. Absent ⇒ the query's pre-0.15 contract is preserved (spec15 §9).
+     */
+    authorizationPolicy?: NodeId;
 }
 export declare function queryPaginationStrategy(query: QueryDef): QueryPaginationStrategy;
 export declare function queryMaxPageSize(query: QueryDef): number;

package/dist/semantic-identity.d.ts

@@ -33,6 +33,12 @@ import type { ApplicationGraph } from './graph.js';
  * - `StorageDef` — `readAuthorization` / `uploadAuthorization` expressions, `retry`.
  * - `RelationshipDef` — endpoints and cardinality (also in the schema fingerprint; repeated
  *   here so a semantic-only comparison is self-contained).
+ * - `AuthorizationPolicyDef` — the `allow` expression (spec15). Whether a principal may
+ *   perform a semantic operation is executable meaning: a policy edited from ALLOW to DENY
+ *   moves the fingerprint and makes a mixed-build authority incompatible (spec15 §6, §45,
+ *   §46). The `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` id an action /
+ *   query / workflow references is a field of those already-projected nodes, so a re-pointed
+ *   reference moves the fingerprint too.
  * - `WorkflowDef` — `inputs`, `bindings`, `entry`, and every step's kind, control-flow edges
  *   and step-specific executable semantics (the `ActionDef` / `EventDef` a step targets, an
  *   `action` step's argument expressions / `retry` policy, a `wait-event` step's correlation
@@ -65,7 +71,7 @@ export declare const SEMANTIC_FINGERPRINT_VERSION = 1;
  * so a future primitive cannot be added to one and silently omitted from the other
  * (spec14pt3 §189, §190 — the deeper architectural correction behind Phase 22 F3).
  */
-export declare const EXECUTABLE_KINDS: readonly ["action", "integration", "integration-operation", "trigger", "event", "subscription", "read-policy", "query", "expression", "constraint", "transition-constraint", "storage", "relationship", "workflow"];
+export declare const EXECUTABLE_KINDS: readonly ["action", "integration", "integration-operation", "trigger", "event", "subscription", "read-policy", "query", "expression", "constraint", "transition-constraint", "storage", "relationship", "workflow", "authorization-policy"];
 export type ExecutableKind = (typeof EXECUTABLE_KINDS)[number];
 export interface SemanticProjection {
     fingerprintVersion: number;
@@ -94,6 +100,15 @@ export interface AuthorityCompatibilityKey {
     schemaFingerprint: string;
     serverContract: string;
     semanticFingerprint: string;
+    /**
+     * spec15pt2 §35 — the runtime authorization-evaluator semantics version. `0.15.0-alpha.1`
+     * and `0.15.0-alpha.2` evaluate the *same* Server IR authorization policy differently
+     * (absent-value safety, F1), yet the graph — and therefore `semanticFingerprint` — is
+     * identical. This discriminator, present only when the IR carries authorization
+     * vocabulary, keeps the two builds from silently co-participating in one authority domain.
+     * Absent on a graph with no authorization policy (its evaluation is unchanged).
+     */
+    authorizationRuntime?: string;
 }
 export declare function authorityCompatibilityKey(parts: AuthorityCompatibilityKey): AuthorityCompatibilityKey;
 /** A stable, comparable string form for storing on a durable work item (spec12 §43). */

package/dist/semantic-identity.js

@@ -36,6 +36,12 @@ import { canonicalWorkflowForFingerprint } from './workflows.js';
  * - `StorageDef` — `readAuthorization` / `uploadAuthorization` expressions, `retry`.
  * - `RelationshipDef` — endpoints and cardinality (also in the schema fingerprint; repeated
  *   here so a semantic-only comparison is self-contained).
+ * - `AuthorizationPolicyDef` — the `allow` expression (spec15). Whether a principal may
+ *   perform a semantic operation is executable meaning: a policy edited from ALLOW to DENY
+ *   moves the fingerprint and makes a mixed-build authority incompatible (spec15 §6, §45,
+ *   §46). The `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` id an action /
+ *   query / workflow references is a field of those already-projected nodes, so a re-pointed
+ *   reference moves the fingerprint too.
  * - `WorkflowDef` — `inputs`, `bindings`, `entry`, and every step's kind, control-flow edges
  *   and step-specific executable semantics (the `ActionDef` / `EventDef` a step targets, an
  *   `action` step's argument expressions / `retry` policy, a `wait-event` step's correlation
@@ -83,6 +89,7 @@ export const EXECUTABLE_KINDS = [
     'storage',
     'relationship',
     'workflow',
+    'authorization-policy',
 ];
 /** Keys removed everywhere in the tree — human metadata, never executable meaning. */
 const NON_SEMANTIC_KEYS = new Set(['name', 'description', 'label', 'metadata', AUTHORING_METADATA_KEY]);
@@ -131,6 +138,7 @@ export function authorityCompatibilityKey(parts) {
         schemaFingerprint: parts.schemaFingerprint,
         serverContract: parts.serverContract,
         semanticFingerprint: parts.semanticFingerprint,
+        ...(parts.authorizationRuntime !== undefined ? { authorizationRuntime: parts.authorizationRuntime } : {}),
     };
 }
 /** A stable, comparable string form for storing on a durable work item (spec12 §43). */
@@ -148,7 +156,10 @@ export function compareAuthorityCompatibility(a, b) {
         'schemaFingerprint',
         'serverContract',
         'semanticFingerprint',
+        'authorizationRuntime',
     ];
-    const mismatches = fields.filter((field) => a[field] !== b[field]);
+    // `authorizationRuntime` absent on both sides (a non-authorization graph) is a match;
+    // present-vs-absent (alpha.1 stored key vs alpha.2) is a mismatch (spec15pt2 §35, §76).
+    const mismatches = fields.filter((field) => (a[field] ?? null) !== (b[field] ?? null));
     return { compatible: mismatches.length === 0, mismatches };
 }

package/dist/server-ir.d.ts

@@ -12,6 +12,7 @@ import type { RelationshipDef } from './relationships.js';
 import type { ReadPolicyDef } from './read-policy.js';
 import type { MigrationDef } from './migration.js';
 import type { WorkflowDef } from './workflows.js';
+import type { AuthorizationPolicyDef } from './authorization.js';
 /**
  * The contracts a Server IR may declare. A runtime that does not recognize the value MUST
  * refuse the IR rather than interpret it partially.
@@ -27,7 +28,7 @@ import type { WorkflowDef } from './workflows.js';
  * Every existing application therefore still compiles to a byte-identical
  * `axiom.server.v1` document, and the frozen conformance fixtures stay frozen.
  */
-export declare const SERVER_IR_CONTRACTS: readonly ["axiom.server.v1", "axiom.server.v2", "axiom.server.v3", "axiom.server.v4", "axiom.server.v5", "axiom.server.v6", "axiom.server.v7", "axiom.server.v8"];
+export declare const SERVER_IR_CONTRACTS: readonly ["axiom.server.v1", "axiom.server.v2", "axiom.server.v3", "axiom.server.v4", "axiom.server.v5", "axiom.server.v6", "axiom.server.v7", "axiom.server.v8", "axiom.server.v9"];
 export type ServerIRContract = (typeof SERVER_IR_CONTRACTS)[number];
 /** The oldest contract, and the one a document declares unless it needs more. */
 export declare const SERVER_IR_CONTRACT: ServerIRContract;
@@ -121,6 +122,37 @@ export declare function usesMigrationVocabulary(ir: {
 export declare function usesWorkflowVocabulary(ir: {
     workflows?: readonly unknown[];
 }): boolean;
+/**
+ * Whether a document uses 0.15 authorization vocabulary — any `AuthorizationPolicyDef`, or
+ * any `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` reference on an action,
+ * query or workflow. Any of it present requires `axiom.server.v9`; a document with none is
+ * byte-identical to the v1–v8 document it always was (spec15 §70). Total over a tampered IR.
+ */
+export declare function usesAuthorizationVocabulary(ir: {
+    authorizationPolicies?: readonly unknown[];
+    actions?: Record<string, {
+        authorizationPolicy?: unknown;
+    }>;
+    queries?: readonly {
+        authorizationPolicy?: unknown;
+    }[];
+    workflows?: readonly {
+        startPolicy?: unknown;
+        instanceAccessPolicy?: unknown;
+    }[];
+}): boolean;
+/**
+ * Authorization vocabulary whose *enforcement* has not shipped yet — the admission gate a
+ * build uses to fail closed rather than run a declared policy as a silent no-op (spec4 §4,
+ * spec15 §128). spec15 landed enforcement in phases: C — `ActionDef.authorizationPolicy`
+ * (and every state / provider-record mutation it drives); D — `QueryDef.authorizationPolicy`
+ * (`query.read`, one-shot / live-open / query-operation); E — `WorkflowDef.startPolicy` /
+ * `instanceAccessPolicy` (`workflow.start` / `.inspect` / `.history` / `.cancel`). Every
+ * `AuthorizationPolicyDef` reference the graph vocabulary defines is now enforced, so this
+ * predicate is `false` for every valid IR. It is kept as the extension point: a later phase
+ * that introduces authorization vocabulary ahead of its enforcement re-populates it.
+ */
+export declare function usesUnenforcedAuthorizationVocabulary(_ir: unknown): boolean;
 /**
  * Whether a document uses 0.10's semantic data-access vocabulary — a `QueryDef`, a
  * `RelationshipDef`, a `ReadPolicyDef`, or a `query` operation inside an action. A v5
@@ -149,6 +181,7 @@ export declare function serverIRExpressions(ir: {
     storages?: readonly StorageDef[];
     queries?: readonly QueryDef[];
     readPolicies?: readonly ReadPolicyDef[];
+    authorizationPolicies?: readonly AuthorizationPolicyDef[];
     migrations?: readonly MigrationDef[];
     workflows?: readonly WorkflowDef[];
 }): Expression[];
@@ -243,6 +276,14 @@ export interface ServerIR {
      * cannot satisfy one by claiming to.
      */
     readPolicies?: ReadPolicyDef[];
+    /**
+     * Canonical authorization policies (spec15, `axiom.server.v9`). Each is a boolean `allow`
+     * expression over the closed scope `PRINCIPAL` / `RESOURCE` / `OPERATION`; a surface points
+     * at one by id (`ActionDef.authorizationPolicy`, `QueryDef.authorizationPolicy`,
+     * `WorkflowDef.startPolicy` / `instanceAccessPolicy`). Portable plain data — no callback,
+     * no host object. Present only in an `axiom.server.v9` document.
+     */
+    authorizationPolicies?: AuthorizationPolicyDef[];
     /**
      * Semantic migrations between consecutive schema versions (spec11 §14). Present only in an
      * `axiom.server.v7` document. Portable plain data — a closed operation vocabulary and

package/dist/server-ir.js

@@ -2,6 +2,7 @@ import { walkExpression } from './expressions.js';
 import { queryExpressions } from './query.js';
 import { migrationExpressions } from './migration.js';
 import { workflowExpressions } from './workflows.js';
+import { authorizationPolicyExpressions } from './authorization.js';
 /**
  * The contracts a Server IR may declare. A runtime that does not recognize the value MUST
  * refuse the IR rather than interpret it partially.
@@ -26,11 +27,12 @@ export const SERVER_IR_CONTRACTS = [
     'axiom.server.v6',
     'axiom.server.v7',
     'axiom.server.v8',
+    'axiom.server.v9',
 ];
 /** The oldest contract, and the one a document declares unless it needs more. */
 export const SERVER_IR_CONTRACT = 'axiom.server.v1';
 /** The newest contract this implementation produces and executes. */
-export const SERVER_IR_LATEST_CONTRACT = 'axiom.server.v8';
+export const SERVER_IR_LATEST_CONTRACT = 'axiom.server.v9';
 /** Operation kinds no contract before `axiom.server.v5` contains. */
 export const SERVER_IR_V5_OPERATION_KINDS = [
     'blob-metadata',
@@ -146,6 +148,49 @@ export function usesWorkflowVocabulary(ir) {
     // but is not workflow vocabulary); a malformed present value is refused at admission.
     return Array.isArray(ir.workflows) && ir.workflows.length > 0;
 }
+/**
+ * Whether a document uses 0.15 authorization vocabulary — any `AuthorizationPolicyDef`, or
+ * any `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` reference on an action,
+ * query or workflow. Any of it present requires `axiom.server.v9`; a document with none is
+ * byte-identical to the v1–v8 document it always was (spec15 §70). Total over a tampered IR.
+ */
+export function usesAuthorizationVocabulary(ir) {
+    if (Array.isArray(ir.authorizationPolicies) && ir.authorizationPolicies.length > 0)
+        return true;
+    for (const action of Object.values(ir.actions ?? {})) {
+        if (action && typeof action === 'object' && action.authorizationPolicy !== undefined) {
+            return true;
+        }
+    }
+    for (const query of Array.isArray(ir.queries) ? ir.queries : []) {
+        if (query && typeof query === 'object' && query.authorizationPolicy !== undefined) {
+            return true;
+        }
+    }
+    for (const workflow of Array.isArray(ir.workflows) ? ir.workflows : []) {
+        if (workflow &&
+            typeof workflow === 'object' &&
+            (workflow.startPolicy !== undefined ||
+                workflow.instanceAccessPolicy !== undefined)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Authorization vocabulary whose *enforcement* has not shipped yet — the admission gate a
+ * build uses to fail closed rather than run a declared policy as a silent no-op (spec4 §4,
+ * spec15 §128). spec15 landed enforcement in phases: C — `ActionDef.authorizationPolicy`
+ * (and every state / provider-record mutation it drives); D — `QueryDef.authorizationPolicy`
+ * (`query.read`, one-shot / live-open / query-operation); E — `WorkflowDef.startPolicy` /
+ * `instanceAccessPolicy` (`workflow.start` / `.inspect` / `.history` / `.cancel`). Every
+ * `AuthorizationPolicyDef` reference the graph vocabulary defines is now enforced, so this
+ * predicate is `false` for every valid IR. It is kept as the extension point: a later phase
+ * that introduces authorization vocabulary ahead of its enforcement re-populates it.
+ */
+export function usesUnenforcedAuthorizationVocabulary(_ir) {
+    return false;
+}
 /**
  * Whether a document uses 0.10's semantic data-access vocabulary — a `QueryDef`, a
  * `RelationshipDef`, a `ReadPolicyDef`, or a `query` operation inside an action. A v5
@@ -210,6 +255,10 @@ export function serverIRExpressions(ir) {
     for (const policy of ir.readPolicies ?? []) {
         found.push(policy.predicate);
     }
+    const authorizationPolicies = ir.authorizationPolicies;
+    for (const policy of Array.isArray(authorizationPolicies) ? authorizationPolicies : []) {
+        found.push(...authorizationPolicyExpressions(policy));
+    }
     for (const migration of ir.migrations ?? []) {
         found.push(...migrationExpressions(migration));
     }

package/dist/types.d.ts

@@ -12,11 +12,12 @@ import type { RelationshipDef } from './relationships.js';
 import type { ReadPolicyDef } from './read-policy.js';
 import type { MigrationDef } from './migration.js';
 import type { WorkflowDef } from './workflows.js';
-export type SemanticNodeKind = 'entity' | 'state' | 'action' | 'constraint' | 'transition-constraint' | 'route' | 'expression' | 'integration' | 'integration-operation' | 'event' | 'trigger' | 'subscription' | 'storage' | 'query' | 'relationship' | 'read-policy' | 'migration' | 'workflow';
+import type { AuthorizationPolicyDef } from './authorization.js';
+export type SemanticNodeKind = 'entity' | 'state' | 'action' | 'constraint' | 'transition-constraint' | 'route' | 'expression' | 'integration' | 'integration-operation' | 'event' | 'trigger' | 'subscription' | 'storage' | 'query' | 'relationship' | 'read-policy' | 'migration' | 'workflow' | 'authorization-policy';
 /** Every semantic node kind, enumerated so tests can walk them. */
 export declare const SEMANTIC_NODE_KINDS: readonly SemanticNodeKind[];
 export type NodeKind = SemanticNodeKind | UINodeKind;
-export type AnyNode = EntityDef | StateDef | ActionDef | ConstraintDef | TransitionConstraintDef | RouteDef | ExpressionDef | IntegrationDef | IntegrationOperationDef | EventDef | TriggerDef | SubscriptionDef | StorageDef | QueryDef | RelationshipDef | ReadPolicyDef | MigrationDef | WorkflowDef | UINode;
+export type AnyNode = EntityDef | StateDef | ActionDef | ConstraintDef | TransitionConstraintDef | RouteDef | ExpressionDef | IntegrationDef | IntegrationOperationDef | EventDef | TriggerDef | SubscriptionDef | StorageDef | QueryDef | RelationshipDef | ReadPolicyDef | MigrationDef | WorkflowDef | AuthorizationPolicyDef | UINode;
 export type NodeOfKind<K extends NodeKind> = Extract<AnyNode, {
     kind: K;
 }>;

package/dist/types.js

@@ -18,4 +18,5 @@ export const SEMANTIC_NODE_KINDS = [
     'read-policy',
     'migration',
     'workflow',
+    'authorization-policy',
 ];

package/dist/validate.js

@@ -6,6 +6,7 @@ import { BLOB_REF_FIELDS } from './storage.js';
 import { queryPaginationStrategy, sortKeyDirection } from './query.js';
 import { queryStateReferences } from './live-query.js';
 import { WORKFLOW_EVENT_SCOPE, WORKFLOW_PRINCIPAL_SCOPE, WORKFLOW_STEP_TYPES, workflowHasCycle, workflowReachableSteps, workflowStepById, workflowStepExpressions, workflowStepSuccessors, } from './workflows.js';
+import { authorizationPolicyProblems } from './authorization.js';
 import { relationshipIsToOne } from './relationships.js';
 import { validateMigrations } from './validate-migration.js';
 import { collectionType, entityType } from './type-ref.js';
@@ -176,6 +177,9 @@ function validateNode(node, context) {
         case 'workflow':
             validateWorkflow(node, context);
             return;
+        case 'authorization-policy':
+            validateAuthorizationPolicyNode(node, context);
+            return;
         case 'migration':
             // A `MigrationDef` is validated by the graph-level `validateMigrations` pass, which
             // needs every migration and `graph.schemaVersion` at once — chain contiguity and
@@ -265,6 +269,7 @@ function validateAction(action, context) {
     if (action.authorization) {
         validateExpression(action.authorization, action.id, context, new Set());
     }
+    requireAuthorizationPolicy(action.authorizationPolicy, action.id, context);
     if (action.invocation?.allowedSources && action.invocation.allowedSources.length === 0) {
         context.errors.push({
             code: VALIDATION_CODES.invalidInvocationSource,
@@ -836,6 +841,35 @@ function validateStorage(storage, context) {
  * its row scope does not collide. Whether the predicate may read `PRINCIPAL` is the
  * authority boundary's job, checked in `validate-authority.ts`.
  */
+/**
+ * spec15 — an `AuthorizationPolicyDef`. Total over any input: a malformed policy produces a
+ * structured `AUTHORIZATION_*` diagnostic, never a native exception (spec15 §36, §37).
+ * `authorizationPolicyProblems` (core) covers structure + closed scope + determinism; the
+ * cross-node ref check (does an `authorizationPolicy` id point here) is on the referencing
+ * node's validator.
+ */
+function validateAuthorizationPolicyNode(policy, context) {
+    for (const problem of authorizationPolicyProblems(policy)) {
+        context.errors.push({
+            code: problem.code,
+            message: problem.message,
+            nodeId: policy?.id,
+        });
+    }
+}
+/** Resolve an `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` id, if present. */
+function requireAuthorizationPolicy(id, ownerId, context) {
+    if (id === undefined || id === null)
+        return;
+    const node = typeof id === 'string' ? context.nodes.get(id) : undefined;
+    if (!node || node.kind !== 'authorization-policy') {
+        context.errors.push({
+            code: VALIDATION_CODES.authorizationUnknownPolicy,
+            message: `${ownerId} references authorization policy ${String(id)}, which is not an authorization-policy node`,
+            nodeId: ownerId,
+        });
+    }
+}
 function validateReadPolicy(policy, context) {
     requireKind(policy.entityId, 'entity', policy.id, context, VALIDATION_CODES.unknownQueryEntity);
     const entity = context.nodes.get(policy.entityId);
@@ -903,6 +937,8 @@ function policyRowScope(rowScopeId, entityId, ownerId, context, entity) {
  * diagnostic — never a thrown `TypeError` on a malformed step.
  */
 function validateWorkflow(workflow, context) {
+    requireAuthorizationPolicy(workflow.startPolicy, workflow.id, context);
+    requireAuthorizationPolicy(workflow.instanceAccessPolicy, workflow.id, context);
     const steps = Array.isArray(workflow.steps) ? workflow.steps : [];
     const stepIds = new Set();
     for (const step of steps) {
@@ -1217,6 +1253,7 @@ function fieldTypeOf(fieldId, context) {
  */
 function validateQuery(query, context) {
     requireKind(query.source, 'entity', query.id, context, VALIDATION_CODES.unknownQueryEntity);
+    requireAuthorizationPolicy(query.authorizationPolicy, query.id, context);
     const source = context.nodes.get(query.source);
     const sourceEntity = source?.kind === 'entity' ? source : undefined;
     // The base scope every query expression is evaluated in: one source row, plus the typed

package/dist/workflows.d.ts

@@ -108,6 +108,21 @@ export interface WorkflowDef extends NodeBase {
     bindings?: WorkflowBinding[];
     entry: NodeId;
     steps: WorkflowStep[];
+    /**
+     * The `AuthorizationPolicyDef` id governing `workflow.start` (spec15 §100). Ability to
+     * discover a `WorkflowDef` is not ability to start it. Absent ⇒ any principal may start
+     * it (its pre-0.15 contract), separate from each action step's own authorization, which
+     * is always re-evaluated (spec15 §10, §101).
+     */
+    startPolicy?: NodeId;
+    /**
+     * The `AuthorizationPolicyDef` id governing `workflow.inspect` / `workflow.history` /
+     * `workflow.cancel` on a *running instance* (spec15 §13-§15). Absent ⇒ the 0.14
+     * owner-fingerprint rule (the caller's principal fingerprint must equal the instance's).
+     * A policy may broaden this, but only explicitly — a role like `admin` never bypasses
+     * owner-only unless the policy says so (spec15 §14, §74).
+     */
+    instanceAccessPolicy?: NodeId;
 }
 /**
  * Whether a value is a structurally recognizable workflow step — an object with an `id` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-core",
-  "version": "0.14.0-alpha.5",
+  "version": "0.15.0-alpha.2",
   "description": "Application Graph, semantic types, locations and validation for Axiom.",
   "license": "MIT",
   "author": "AskTech AS",