@gate-forge/core 0.1.0

package/dist/policy/coverage.js

@@ -0,0 +1,119 @@
+/**
+ * Closed-world CRUD coverage evaluator (plan 2026-09-13 §3.6, Phase 0
+ * item 7, ADR 0005 D5). Pure and deterministic: given the owner-owned
+ * coverage policy tables, the CURRENT run's user-facing table inventory,
+ * and the resolved test mappings, it returns typed blocking
+ * `CRUD_COVERAGE_MISSING` findings for every required operation lacking
+ * mapped browser-e2e coverage and lacking an owner disposition.
+ *
+ * Fail-closed by construction:
+ * - The caller MUST pass the resource inventory. A policy table absent
+ *   from it yields a CONFIG-ERROR result (callers turn that into exit 2):
+ *   a name the inventory cannot see is silently uncheckable, and a
+ *   silently dropped table is a violation, never coverage.
+ * - Inventory tables the policy does NOT enumerate are violations too
+ *   (the policy is closed-world over the inventory).
+ * - Only `browser-e2e` mappings satisfy (plan §3.2: api-e2e cannot
+ *   substitute for browser behavior); the mapping subsystem may pass an
+ *   empty list for now — the honest result is that enabled, undispositioned
+ *   tables block until mappings or dispositions exist.
+ */
+import { compareStrings } from '../graph/util.js';
+import { CAUSE_NEXT_ACTIONS } from '../schemas/verdict.js';
+/** Cause + next action for every blocking finding (plan §5.4). */
+const CRUD_COVERAGE_MISSING_CAUSE = CAUSE_NEXT_ACTIONS['CRUD_COVERAGE_MISSING'];
+/**
+ * Evaluates the coverage policy against the current inventory and
+ * resolved mappings. Pure: identical inputs produce byte-identical
+ * results; findings sort by table then operation.
+ *
+ * Semantics:
+ * - policy table absent from the inventory → CONFIG-ERROR
+ *   (`COVERAGE_TABLE_UNKNOWN`);
+ * - inventory table absent from the policy → blocking (closed-world: a
+ *   silently dropped table is a violation);
+ * - dispositioned table → excused (the disposition is a trusted owner
+ *   act recorded in config, never an agent self-approval);
+ * - otherwise each required operation without a `browser-e2e` mapping →
+ *   blocking `CRUD_COVERAGE_MISSING`.
+ *
+ * Args:
+ *   tables: the policy's table entries (validated `CoveragePolicySchema`).
+ *   inventory: the current run's user-facing table inventory (REQUIRED).
+ *   mappedCoverage: resolved test mappings; may be empty while the
+ *     mapping subsystem is unbuilt (Phase 2-3).
+ *
+ * Returns:
+ *   CoveragePolicyResult: sorted config errors and blocking findings.
+ */
+export function evaluateCoveragePolicy(tables, inventory, mappedCoverage = []) {
+    const inventoryByName = new Map();
+    for (const entry of inventory) {
+        const existing = inventoryByName.get(entry.name);
+        if (existing === undefined)
+            inventoryByName.set(entry.name, [entry]);
+        else
+            existing.push(entry);
+    }
+    const policyNames = new Set(tables.map((table) => table.name));
+    const configErrors = [];
+    const blocking = [];
+    for (const table of tables) {
+        const known = inventoryByName.get(table.name);
+        if (known === undefined) {
+            configErrors.push({
+                code: 'COVERAGE_TABLE_UNKNOWN',
+                table: table.name,
+                detail: `coverage policy names table '${table.name}' which is not present in the current ` +
+                    'resource inventory; a name the inventory cannot see is silently uncheckable, so ' +
+                    'the run fails as a configuration error (a silently dropped table is a violation, ' +
+                    'never coverage)',
+            });
+            continue;
+        }
+        // A recorded owner disposition excuses the table's required
+        // operations (trusted-policy act, ADR 0005 D5).
+        if (table.disposition !== undefined)
+            continue;
+        for (const operation of table.requiredOperations) {
+            const covered = mappedCoverage.some((mapping) => mapping.table === table.name &&
+                mapping.operation === operation &&
+                mapping.testKind === 'browser-e2e');
+            if (covered)
+                continue;
+            blocking.push({
+                code: 'CRUD_COVERAGE_MISSING',
+                cause: 'CRUD_COVERAGE_MISSING',
+                table: table.name,
+                operation,
+                detail: `coverage policy: table '${table.name}' has no mapped browser-e2e '${operation}' ` +
+                    'coverage and no owner disposition',
+                nextAction: CRUD_COVERAGE_MISSING_CAUSE,
+            });
+        }
+    }
+    // Closed-world: an inventory table the policy does not enumerate is a
+    // dropped violation, not coverage (plan Phase 0 item 7).
+    for (const [name, entries] of inventoryByName) {
+        if (policyNames.has(name))
+            continue;
+        const operations = [
+            ...new Set(entries.flatMap((entry) => [...entry.operations])),
+        ].sort(compareStrings);
+        blocking.push({
+            code: 'CRUD_COVERAGE_MISSING',
+            cause: 'CRUD_COVERAGE_MISSING',
+            table: name,
+            operation: null,
+            detail: `coverage policy: user-facing table '${name}' is present in the resource inventory ` +
+                `but the policy does not enumerate it (enabled operations: ` +
+                `[${operations.join(', ')}]); a silently dropped table is a violation, never coverage`,
+            nextAction: CRUD_COVERAGE_MISSING_CAUSE,
+        });
+    }
+    configErrors.sort((a, b) => compareStrings(a.table, b.table));
+    blocking.sort((a, b) => compareStrings(a.table, b.table) ||
+        compareStrings(a.operation ?? '', b.operation ?? ''));
+    return { configErrors, blocking };
+}
+//# sourceMappingURL=coverage.js.map

package/dist/policy/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../src/policy/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAkB,MAAM,uBAAuB,CAAC;AA2D3E,kEAAkE;AAClE,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgC,EAChC,SAA4C,EAC5C,iBAA4C,EAAE;IAE9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS;YAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;;YAChE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,YAAY,GAA0B,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EACJ,gCAAgC,KAAK,CAAC,IAAI,wCAAwC;oBAClF,kFAAkF;oBAClF,mFAAmF;oBACnF,iBAAiB;aACpB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,4DAA4D;QAC5D,gDAAgD;QAChD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,SAAS;QAC9C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CACjC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI;gBAC5B,OAAO,CAAC,SAAS,KAAK,SAAS;gBAC/B,OAAO,CAAC,QAAQ,KAAK,aAAa,CACrC,CAAC;YACF,IAAI,OAAO;gBAAE,SAAS;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,uBAAuB;gBAC9B,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,SAAS;gBACT,MAAM,EACJ,2BAA2B,KAAK,CAAC,IAAI,gCAAgC,SAAS,IAAI;oBAClF,mCAAmC;gBACrC,UAAU,EAAE,2BAA2B;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,yDAAyD;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,eAAe,EAAE,CAAC;QAC9C,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,UAAU,GAAG;YACjB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;SAC9D,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,uBAAuB;YAC9B,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI;YACf,MAAM,EACJ,uCAAuC,IAAI,yCAAyC;gBACpF,4DAA4D;gBAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D;YACxF,UAAU,EAAE,2BAA2B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrB,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAChC,cAAc,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CACrD,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC"}

package/dist/policy/evaluate.d.ts

@@ -0,0 +1,275 @@
+/**
+ * Policy engine (plan §5.2, G2): evaluates declarative policies
+ * (`PolicyFile`) against the classified resources of a built
+ * {@link ResourceGraph} and produces obligations plus the blocking
+ * verdict entries the gate must stay visible for (invariants 1, 8).
+ *
+ * Semantics (plan §5.2 + ADR 0001):
+ * - `crud:create|read|update|delete` obligations are LIFECYCLE-GATED:
+ *   a contract is emitted only when the classification's lifecycle
+ *   flag for that operation is `true` (user-facing + `lifecycle.create`
+ *   ⇒ `crud:create`, etc.). Non-uniform lifecycles fall out naturally:
+ *   immutable/read-only resources generate only `crud:read`, append-only
+ *   resources `crud:create` + `crud:read`, archive-not-delete resources
+ *   `crud:delete` with `deleteSemantics: 'archive'` in the fingerprint.
+ * - Non-`crud:` contracts pass through ungated (the policy author
+ *   explicitly required them).
+ * - Internal resources generate NO CRUD obligations — their claims are
+ *   invalid (ADR 0001). Non-CRUD contracts still apply.
+ * - Unclassified and unresolved resources produce blocking entries and
+ *   no obligations until classified/resolved, but stay gate-visible.
+ *   So do detector/graph `findings` (a partial discovery must never
+ *   yield a green gate) and `stale` references (invariant 9).
+ * - Policies are evaluated in file order; the first policy generating
+ *   a given `<resourceId>:<contract>` owns it (obligation ids are
+ *   unique identities — pin #1's fingerprint keys on them).
+ */
+import { z } from 'zod';
+import { type ContractName } from '../schemas/common.js';
+import { type PolicyFile } from '../schemas/policy.js';
+import { type Claim } from '../schemas/claim.js';
+import { type ResourceGraph } from '../graph/schema.js';
+/** The CRUD contract namespace gated by lifecycle flags. */
+export declare const CRUD_CONTRACT_PREFIX = "crud:";
+/**
+ * The persistence-level CRUD contract namespace (audit round 5):
+ * lifecycle-gated exactly like `crud:`, but graded on the witness's own
+ * engine-side observations (absence/presence, before/after deltas,
+ * owner-declared archive state). UI-semantic `crud:` contracts stay
+ * fail-closed in the verdict engine until a witness-controlled UI
+ * observation channel exists.
+ */
+export declare const PERSISTENCE_CONTRACT_PREFIX = "persistence:";
+/**
+ * Fail-closed policy-engine error: thrown for policy documents that
+ * are structurally invalid (zod) or use the `crud:` namespace with an
+ * unknown operation — a config/usage problem, never a silent skip.
+ */
+export declare class PolicyEvaluationError extends Error {
+    constructor(message: string);
+}
+/** Why a resource currently generates no obligations. */
+export declare const BlockingEntrySchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        unclassified: "unclassified";
+        unresolved: "unresolved";
+        classification: "classification";
+        finding: "finding";
+        "stale-reference": "stale-reference";
+    }>;
+    resourceId: z.ZodNullable<z.ZodString>;
+    name: z.ZodNullable<z.ZodString>;
+    detail: z.ZodString;
+    location: z.ZodNullable<z.ZodObject<{
+        file: z.ZodString;
+        line: z.ZodNumber;
+        col: z.ZodNumber;
+    }, z.core.$strict>>;
+    cause: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        TEST_INVENTORY_INCOMPLETE: "TEST_INVENTORY_INCOMPLETE";
+        TEST_KIND_UNKNOWN: "TEST_KIND_UNKNOWN";
+        TEST_MAPPING_MISSING: "TEST_MAPPING_MISSING";
+        TEST_MAPPING_AMBIGUOUS: "TEST_MAPPING_AMBIGUOUS";
+        TEST_MAPPING_STALE: "TEST_MAPPING_STALE";
+        EVIDENCE_NOT_COLLECTED: "EVIDENCE_NOT_COLLECTED";
+        VERIFIER_UNSUPPORTED: "VERIFIER_UNSUPPORTED";
+        TEST_NOT_EXECUTED: "TEST_NOT_EXECUTED";
+        TEST_FAILED: "TEST_FAILED";
+        RUN_INCOMPLETE: "RUN_INCOMPLETE";
+        EVIDENCE_STALE: "EVIDENCE_STALE";
+        CHANGE_UNMAPPED: "CHANGE_UNMAPPED";
+        EVIDENCE_SCOPE_INCOMPLETE: "EVIDENCE_SCOPE_INCOMPLETE";
+        ENFORCEMENT_UNTRUSTED: "ENFORCEMENT_UNTRUSTED";
+        EVIDENCE_VALUE_MISMATCH: "EVIDENCE_VALUE_MISMATCH";
+        SERVER_PROBE_UNAVAILABLE: "SERVER_PROBE_UNAVAILABLE";
+        CRUD_COVERAGE_MISSING: "CRUD_COVERAGE_MISSING";
+        DIAGNOSTIC_TEST_FAILURE: "DIAGNOSTIC_TEST_FAILURE";
+        DIAGNOSTIC_RUN_INCOMPLETE: "DIAGNOSTIC_RUN_INCOMPLETE";
+        DIAGNOSTIC_RESULT_STALE: "DIAGNOSTIC_RESULT_STALE";
+    }>>>;
+    nextAction: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+/** Inferred blocking-entry shape. */
+export type BlockingEntry = z.infer<typeof BlockingEntrySchema>;
+/**
+ * The adopted identity of a classification-blocked resource (two-layer
+ * adoption): the ONE canonical string both `gateforge adopt` captures
+ * into the receipt's `classificationBlocked` set and the check matches
+ * against when waiving — so the two sides can never disagree.
+ *
+ * - The plane-qualified `resourceId` when the entry carries one (blocks
+ *   on otherwise-classified resources, e.g. delete-semantics).
+ * - Else the bare resource name under a `name:` namespace — a resource
+ *   with NO derivable plane (PLANE_UNRESOLVED) has no plane-qualified id
+ *   by definition, and its bare name is the stable, merge-surviving
+ *   identity. The `name:` prefix keeps the fallback out of the
+ *   plane-qualified id space (`tenant.users` et al.).
+ * - Both the `classification` entry (the typed block) AND the
+ *   `unclassified` shadow entry (the definitional "no effective
+ *   classification" block the policy engine emits for the SAME resource)
+ *   map to the same identity: waiving the resource waives its whole
+ *   adopted block, or the gate could never return to green.
+ *
+ * Returns null for entries that are never resource-scoped (document-level
+ * classifier blocks — stale targets, invalid signals — and
+ * unresolved/finding/stale-reference kinds): those can never be adopted
+ * by this layer.
+ */
+export declare function classificationBlockedIdentity(entry: BlockingEntry): string | null;
+/** Assessment of one watched claim against the generated obligations. */
+export declare const ClaimAssessmentSchema: z.ZodObject<{
+    claim: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        obligationId: z.ZodString;
+        testId: z.ZodString;
+        testFile: z.ZodOptional<z.ZodString>;
+        location: z.ZodOptional<z.ZodObject<{
+            file: z.ZodString;
+            line: z.ZodNumber;
+            col: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    status: z.ZodEnum<{
+        invalid: "invalid";
+        valid: "valid";
+    }>;
+    reason: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+/** Inferred claim-assessment shape. */
+export type ClaimAssessment = z.infer<typeof ClaimAssessmentSchema>;
+/** The complete policy-engine result. Deterministic; fully sorted. */
+export declare const PolicyEvaluationResultSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    obligations: z.ZodArray<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        id: z.ZodString;
+        resourceId: z.ZodString;
+        contract: z.ZodString;
+        policyId: z.ZodString;
+        lifecycle: z.ZodObject<{
+            create: z.ZodBoolean;
+            read: z.ZodBoolean;
+            update: z.ZodBoolean;
+            delete: z.ZodBoolean;
+            deleteSemantics: z.ZodOptional<z.ZodEnum<{
+                hard: "hard";
+                archive: "archive";
+            }>>;
+            archiveFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+            updateableFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    blocking: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            unclassified: "unclassified";
+            unresolved: "unresolved";
+            classification: "classification";
+            finding: "finding";
+            "stale-reference": "stale-reference";
+        }>;
+        resourceId: z.ZodNullable<z.ZodString>;
+        name: z.ZodNullable<z.ZodString>;
+        detail: z.ZodString;
+        location: z.ZodNullable<z.ZodObject<{
+            file: z.ZodString;
+            line: z.ZodNumber;
+            col: z.ZodNumber;
+        }, z.core.$strict>>;
+        cause: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            TEST_INVENTORY_INCOMPLETE: "TEST_INVENTORY_INCOMPLETE";
+            TEST_KIND_UNKNOWN: "TEST_KIND_UNKNOWN";
+            TEST_MAPPING_MISSING: "TEST_MAPPING_MISSING";
+            TEST_MAPPING_AMBIGUOUS: "TEST_MAPPING_AMBIGUOUS";
+            TEST_MAPPING_STALE: "TEST_MAPPING_STALE";
+            EVIDENCE_NOT_COLLECTED: "EVIDENCE_NOT_COLLECTED";
+            VERIFIER_UNSUPPORTED: "VERIFIER_UNSUPPORTED";
+            TEST_NOT_EXECUTED: "TEST_NOT_EXECUTED";
+            TEST_FAILED: "TEST_FAILED";
+            RUN_INCOMPLETE: "RUN_INCOMPLETE";
+            EVIDENCE_STALE: "EVIDENCE_STALE";
+            CHANGE_UNMAPPED: "CHANGE_UNMAPPED";
+            EVIDENCE_SCOPE_INCOMPLETE: "EVIDENCE_SCOPE_INCOMPLETE";
+            ENFORCEMENT_UNTRUSTED: "ENFORCEMENT_UNTRUSTED";
+            EVIDENCE_VALUE_MISMATCH: "EVIDENCE_VALUE_MISMATCH";
+            SERVER_PROBE_UNAVAILABLE: "SERVER_PROBE_UNAVAILABLE";
+            CRUD_COVERAGE_MISSING: "CRUD_COVERAGE_MISSING";
+            DIAGNOSTIC_TEST_FAILURE: "DIAGNOSTIC_TEST_FAILURE";
+            DIAGNOSTIC_RUN_INCOMPLETE: "DIAGNOSTIC_RUN_INCOMPLETE";
+            DIAGNOSTIC_RESULT_STALE: "DIAGNOSTIC_RESULT_STALE";
+        }>>>;
+        nextAction: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>>;
+    claims: z.ZodArray<z.ZodObject<{
+        claim: z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            obligationId: z.ZodString;
+            testId: z.ZodString;
+            testFile: z.ZodOptional<z.ZodString>;
+            location: z.ZodOptional<z.ZodObject<{
+                file: z.ZodString;
+                line: z.ZodNumber;
+                col: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        status: z.ZodEnum<{
+            invalid: "invalid";
+            valid: "valid";
+        }>;
+        reason: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Inferred policy-evaluation-result shape. */
+export type PolicyEvaluationResult = z.infer<typeof PolicyEvaluationResultSchema>;
+/**
+ * Whether a contract is allowed by a lifecycle. `crud:` and
+ * `persistence:` contracts map to their lifecycle flag (`crud:create` ⇔
+ * `lifecycle.create === true`, etc. — unknown operations in either
+ * namespace are a policy-authoring error); every other contract passes
+ * through ungated.
+ *
+ * Args:
+ *   contract: the required contract name, e.g. `crud:update`.
+ *   lifecycle: the classification's lifecycle flags.
+ *
+ * Returns:
+ *   boolean: true when an obligation for this contract must be generated.
+ * @throws PolicyEvaluationError for `crud:`/`persistence:` contracts
+ *   outside the four lifecycle operations.
+ */
+export declare function lifecycleAllowsContract(contract: ContractName, lifecycle: {
+    create: boolean;
+    read: boolean;
+    update: boolean;
+    delete: boolean;
+    archiveFields?: Record<string, string | number | boolean>;
+}): boolean;
+export interface PolicyEvaluationInput {
+    /** A graph built by `buildResourceGraph`. */
+    graph: ResourceGraph;
+    /** The declarative policies document (validated fail-closed). */
+    policies: PolicyFile;
+    /** Claims to assess against the generated obligations (ADR 0001). */
+    claims?: Claim[];
+    /**
+     * Pre-projected blocking entries from the classifier (plan phase 5),
+     * appended verbatim before the deterministic sort.
+     */
+    extraBlocking?: BlockingEntry[];
+}
+/**
+ * Evaluates the policy document against a built resource graph.
+ *
+ * Args:
+ *   input: graph + policies (+ claims to assess). The policy document
+ *     is validated fail-closed; resources are consumed in the graph's
+ *     deterministic order.
+ *
+ * Returns:
+ *   PolicyEvaluationResult: obligations, blocking entries, and claim
+ *   assessments — all sorted, byte-for-byte deterministic.
+ * @throws z.ZodError when the policy document is invalid (config error).
+ * @throws PolicyEvaluationError for `crud:` contracts outside the four
+ *   lifecycle operations.
+ */
+export declare function evaluatePolicies(input: PolicyEvaluationInput): PolicyEvaluationResult;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/policy/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAG5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGzG,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAK1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC5B,CAAC;AAEL,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;kBAM9B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAcrC,CAAC;AAEL,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC3D,GACA,OAAO,CAaT;AAED,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAmErF"}