@graphrefly/ts 0.0.0 → 0.0.1

package/dist/{chunk-COHO25CZ.js → chunk-YDSIVHRR.js}

@@ -1,14 +1,14 @@
 import {
   memoryRetrievalBundle,
   validateMemoryFragment
-} from "./chunk-JIMUDQN3.js";
-import {
-  strictJsonCodec
-} from "./chunk-4VLAQHZI.js";
+} from "./chunk-FBUU43PM.js";
 import {
   depBatch,
   depLatest
-} from "./chunk-SWTLEQL6.js";
+} from "./chunk-WQIA3GFB.js";
+import {
+  strictJsonCodec
+} from "./chunk-4VLAQHZI.js";
 
 // src/solutions/agentic-memory.ts
 var AGENTIC_MEMORY_RECORD_FRAME_FORMAT = "graphrefly.agenticMemoryRecord";
@@ -2433,6 +2433,550 @@ function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/solutions/capability-admission.ts
+function capabilityAdmissionProposal(opts) {
+  return { kind: "capability-admission-proposal", ...opts };
+}
+function capabilityAdmissionProjector(graph, opts) {
+  const name = opts.name ?? "capabilityAdmissions";
+  const policyDeps = opts.admissionPolicies ?? [];
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    [opts.proposals, opts.decisions, ...policyDeps],
+    (ctx) => {
+      const state = ctx.state.get() ?? emptyCapabilityAdmissionState();
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposal = raw;
+        const issue = capabilityAdmissionProposalIssue(proposal);
+        if (issue !== void 0) {
+          emitIssue(
+            ctx,
+            state,
+            nextMalformedIssueKey(state, "proposal", proposalKeyFallback(proposal)),
+            issue
+          );
+          continue;
+        }
+        if (state.proposals.has(proposal.proposalId)) {
+          emitIssue(
+            ctx,
+            state,
+            `duplicate-proposal:${proposal.proposalId}`,
+            dataIssue(
+              "duplicate-capability-admission-proposal",
+              `CapabilityAdmissionProposal '${proposal.proposalId}' was already seen`,
+              { subjectId: proposal.subjectId, refs: capabilityProposalRefs(proposal) }
+            )
+          );
+          continue;
+        }
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      forEachPolicyDepBatch(ctx, 2, policyDeps.length, (raw) => {
+        const policy = raw;
+        const issue = capabilityAdmissionPolicyIssue(policy);
+        if (issue !== void 0) {
+          emitIssue(
+            ctx,
+            state,
+            nextMalformedIssueKey(state, "policy", policyKeyFallback(policy)),
+            issue
+          );
+          return;
+        }
+        if (state.policies.has(policy.policyId)) {
+          emitIssue(
+            ctx,
+            state,
+            `duplicate-policy:${policy.policyId}`,
+            dataIssue(
+              "duplicate-capability-admission-policy",
+              `CapabilityAdmissionPolicy '${policy.policyId}' was already seen`,
+              { refs: [ref("capability-admission-policy", policy.policyId)] }
+            )
+          );
+          return;
+        }
+        state.policies.set(policy.policyId, policy);
+      });
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const decision = raw;
+        const issue = capabilityAdmissionDecisionIssue(decision);
+        if (issue !== void 0) {
+          emitIssue(
+            ctx,
+            state,
+            nextMalformedIssueKey(state, "decision", decisionKeyFallback(decision)),
+            issue
+          );
+          continue;
+        }
+        if (state.decisions.has(decision.decisionId)) {
+          emitIssue(
+            ctx,
+            state,
+            `duplicate-decision:${decision.decisionId}`,
+            dataIssue(
+              "duplicate-capability-admission-decision",
+              `CapabilityAdmissionDecision '${decision.decisionId}' was already seen`,
+              { refs: capabilityDecisionRefs(decision) }
+            )
+          );
+          continue;
+        }
+        state.decisions.set(decision.decisionId, decision);
+      }
+      evaluateCapabilityAdmissions(ctx, state, now());
+      ctx.state.set(state);
+    },
+    { name: `${name}/runtime`, factory: "capabilityAdmissionProjector", partial: true }
+  );
+  return {
+    admissions: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/admissions`,
+      "capabilityAdmissions",
+      (fact) => fact.kind === "admission" ? fact.admission : void 0
+    ),
+    status: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/status`,
+      "capabilityAdmissionStatus",
+      (fact) => fact.kind === "status" ? fact.status : void 0
+    ),
+    issues: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "capabilityAdmissionIssues",
+      (fact) => fact.kind === "issue" ? fact.issue : void 0
+    ),
+    audit: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "capabilityAdmissionAudit",
+      (fact) => fact.kind === "audit" ? fact.audit : void 0
+    ),
+    views: capabilityAdmissionViews(graph, runtime, `${name}/views`)
+  };
+}
+function evaluateCapabilityAdmissions(ctx, state, admittedAtMs) {
+  for (const decision of state.decisions.values()) {
+    if (state.terminalDecisionIds.has(decision.decisionId)) continue;
+    evaluateCapabilityAdmission(ctx, state, decision, admittedAtMs);
+  }
+}
+function evaluateCapabilityAdmission(ctx, state, decision, admittedAtMs) {
+  const proposal = state.proposals.get(decision.proposalId);
+  if (proposal === void 0) {
+    emitIssue(
+      ctx,
+      state,
+      `missing-proposal:${decision.decisionId}:${decision.proposalId}`,
+      dataIssue(
+        "missing-capability-admission-proposal",
+        `CapabilityAdmissionDecision '${decision.decisionId}' references missing proposal '${decision.proposalId}'`,
+        { subjectId: decision.proposalId, refs: capabilityDecisionRefs(decision) }
+      )
+    );
+    return;
+  }
+  const policy = capabilityPolicyForDecision(state, decision);
+  if (typeof policy === "string") {
+    emitIssue(
+      ctx,
+      state,
+      `${policy}:${decision.decisionId}:${decision.policyId ?? "missing"}`,
+      dataIssue(policy, capabilityPolicyIssueMessage(policy, decision), {
+        subjectId: proposal.subjectId,
+        refs: capabilityDecisionRefs(decision, proposal)
+      })
+    );
+    if (policy === "stale-capability-admission-policy-ref")
+      state.terminalDecisionIds.add(decision.decisionId);
+    return;
+  }
+  if (policy !== void 0) {
+    const policyIssue = validateCapabilityAdmissionPolicy(policy, decision, proposal);
+    if (policyIssue !== void 0) {
+      emitIssue(
+        ctx,
+        state,
+        `${policyIssue.code}:${decision.decisionId}:${policy.policyId}`,
+        dataIssue(policyIssue.code, policyIssue.message, {
+          subjectId: proposal.subjectId,
+          refs: capabilityDecisionRefs(decision, proposal, policy)
+        })
+      );
+      return;
+    }
+  }
+  if (state.admissionsById.has(decision.admissionId)) {
+    emitIssue(
+      ctx,
+      state,
+      `duplicate-admission-id:${decision.admissionId}`,
+      dataIssue(
+        "duplicate-capability-admission",
+        `CapabilityAdmission '${decision.admissionId}' was already emitted`,
+        { subjectId: proposal.subjectId, refs: capabilityDecisionRefs(decision, proposal, policy) }
+      )
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return;
+  }
+  if (state.admissionsByProposal.has(decision.proposalId)) {
+    emitIssue(
+      ctx,
+      state,
+      `duplicate-admission-proposal:${decision.proposalId}:${decision.decisionId}`,
+      dataIssue(
+        "duplicate-capability-admission-proposal",
+        `CapabilityAdmissionProposal '${decision.proposalId}' already has an admission decision`,
+        { subjectId: proposal.subjectId, refs: capabilityDecisionRefs(decision, proposal, policy) }
+      )
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return;
+  }
+  const admissionState = admissionStateForOutcome(decision.outcome);
+  if (admissionState === void 0) {
+    emitIssue(
+      ctx,
+      state,
+      `unsupported-outcome:${decision.decisionId}:${String(decision.outcome)}`,
+      dataIssue(
+        "unsupported-capability-admission-outcome",
+        `CapabilityAdmissionDecision '${decision.decisionId}' uses unsupported outcome '${String(decision.outcome)}'`,
+        { subjectId: proposal.subjectId, refs: capabilityDecisionRefs(decision, proposal, policy) }
+      )
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return;
+  }
+  const admission = {
+    kind: "capability-admission",
+    admissionId: decision.admissionId,
+    proposalId: proposal.proposalId,
+    subjectId: proposal.subjectId,
+    capability: cloneCapabilityRef(proposal.capability),
+    state: admissionState,
+    decisionId: decision.decisionId,
+    boundaryName: proposal.boundaryName,
+    role: proposal.role,
+    policyId: decision.policyId,
+    reason: decision.reason ?? proposal.reason,
+    sourceRefs: capabilityDecisionRefs(decision, proposal, policy),
+    admittedAtMs: decision.decidedAtMs ?? admittedAtMs,
+    metadata: {
+      ...proposal.metadata ?? {},
+      ...policy?.metadata ?? {},
+      ...decision.metadata ?? {}
+    }
+  };
+  state.admissionsById.set(admission.admissionId, admission);
+  state.admissionsByProposal.set(admission.proposalId, admission);
+  state.terminalDecisionIds.add(decision.decisionId);
+  emitAdmission(ctx, state, admission);
+}
+function capabilityAdmissionViews(graph, runtime, name) {
+  return graph.node(
+    [runtime],
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        admissionsByProposal: /* @__PURE__ */ new Map(),
+        admissionsBySubject: /* @__PURE__ */ new Map(),
+        issues: [],
+        audit: []
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const fact = raw;
+        if (fact.kind === "admission") {
+          const admission = fact.admission;
+          state.admissionsByProposal.set(admission.proposalId, admission);
+          const bySubject = state.admissionsBySubject.get(admission.subjectId) ?? [];
+          bySubject.push(admission);
+          state.admissionsBySubject.set(admission.subjectId, bySubject);
+        }
+        if (fact.kind === "issue") state.issues.push(fact.issue);
+        if (fact.kind === "audit") state.audit.push(fact.audit);
+      }
+      ctx.state.set(state);
+      ctx.down([["DATA", freezeCapabilityAdmissionViews(state)]]);
+    },
+    { name, factory: "capabilityAdmissionViews" }
+  );
+}
+function emitAdmission(ctx, state, admission) {
+  state.statusSeq += 1;
+  state.auditSeq += 1;
+  const statusState = capabilityAdmissionStatusState(admission.state);
+  const status = {
+    kind: "capability-admission-status",
+    statusId: `${admission.subjectId}:${statusState}:${state.statusSeq}`,
+    state: statusState,
+    proposalId: admission.proposalId,
+    admissionId: admission.admissionId,
+    subjectId: admission.subjectId,
+    capabilityId: admission.capability.id,
+    capabilityKind: admission.capability.kind,
+    policyId: admission.policyId,
+    sourceRefs: admission.sourceRefs
+  };
+  const audit = {
+    id: `${admission.subjectId}:${statusState}:${state.auditSeq}`,
+    kind: `capability-admission-${admission.state}`,
+    subjectId: admission.subjectId,
+    sourceRefs: admission.sourceRefs,
+    metadata: {
+      admissionId: admission.admissionId,
+      capabilityId: admission.capability.id,
+      capabilityKind: admission.capability.kind,
+      policyId: admission.policyId,
+      proposalId: admission.proposalId
+    }
+  };
+  ctx.down([
+    ["DATA", { kind: "admission", admission }],
+    ["DATA", { kind: "status", status }],
+    ["DATA", { kind: "audit", audit }]
+  ]);
+}
+function emitIssue(ctx, state, key, issue) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  state.statusSeq += 1;
+  state.auditSeq += 1;
+  const status = {
+    kind: "capability-admission-status",
+    statusId: `capability-admission-issue:${state.statusSeq}`,
+    state: "capability-admission-issue",
+    subjectId: issue.subjectId,
+    issues: [issue]
+  };
+  const audit = {
+    id: `capability-admission-issue:${state.auditSeq}`,
+    kind: "capability-admission-issue",
+    subjectId: issue.subjectId,
+    message: issue.message,
+    issueCode: issue.code
+  };
+  ctx.down([
+    ["DATA", { kind: "issue", issue }],
+    ["DATA", { kind: "status", status }],
+    ["DATA", { kind: "audit", audit }]
+  ]);
+}
+function capabilityAdmissionProposalIssue(proposal) {
+  if (proposal.kind !== "capability-admission-proposal" || typeof proposal.proposalId !== "string" || proposal.proposalId.length === 0 || typeof proposal.subjectId !== "string" || proposal.subjectId.length === 0 || !isBoundaryCapabilityRef(proposal.capability)) {
+    return dataIssue(
+      "malformed-capability-admission-proposal",
+      "CapabilityAdmissionProposal requires proposalId, subjectId, and a D348 BoundaryCapabilityRef",
+      { subjectId: typeof proposal.subjectId === "string" ? proposal.subjectId : void 0 }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionPolicyIssue(policy) {
+  if (policy.kind !== "capability-admission-policy" || typeof policy.policyId !== "string" || policy.policyId.length === 0 || policy.capabilityIds !== void 0 && (!Array.isArray(policy.capabilityIds) || !policy.capabilityIds.every((id) => typeof id === "string" && id.length > 0)) || policy.capabilityKinds !== void 0 && (!Array.isArray(policy.capabilityKinds) || !policy.capabilityKinds.every(isBoundaryCapabilityKind)) || policy.requiredOnly !== void 0 && typeof policy.requiredOnly !== "boolean" || policy.allowedOutcomes !== void 0 && (!Array.isArray(policy.allowedOutcomes) || !policy.allowedOutcomes.every(isCapabilityAdmissionOutcome))) {
+    return dataIssue(
+      "malformed-capability-admission-policy",
+      "CapabilityAdmissionPolicy requires a policyId and D348 capability/outcome filters",
+      { subjectId: typeof policy.policyId === "string" ? policy.policyId : void 0 }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionDecisionIssue(decision) {
+  if (decision.kind !== "capability-admission-decision" || typeof decision.decisionId !== "string" || decision.decisionId.length === 0 || typeof decision.admissionId !== "string" || decision.admissionId.length === 0 || typeof decision.proposalId !== "string" || decision.proposalId.length === 0 || !isCapabilityAdmissionOutcome(decision.outcome) || decision.policyId !== void 0 && (typeof decision.policyId !== "string" || decision.policyId.length === 0)) {
+    return dataIssue(
+      "malformed-capability-admission-decision",
+      "CapabilityAdmissionDecision requires decisionId, admissionId, proposalId, and allow/block/defer outcome",
+      { subjectId: typeof decision.proposalId === "string" ? decision.proposalId : void 0 }
+    );
+  }
+  return void 0;
+}
+function validateCapabilityAdmissionPolicy(policy, decision, proposal) {
+  if (policy.capabilityIds !== void 0 && !policy.capabilityIds.includes(proposal.capability.id)) {
+    return {
+      code: "capability-admission-policy-mismatch",
+      message: `CapabilityAdmissionPolicy '${policy.policyId}' does not apply to capability '${proposal.capability.id}'`
+    };
+  }
+  if (policy.capabilityKinds !== void 0 && !policy.capabilityKinds.includes(proposal.capability.kind)) {
+    return {
+      code: "capability-admission-policy-mismatch",
+      message: `CapabilityAdmissionPolicy '${policy.policyId}' does not apply to capability kind '${proposal.capability.kind}'`
+    };
+  }
+  if (policy.requiredOnly === true && !proposal.capability.required) {
+    return {
+      code: "capability-admission-policy-mismatch",
+      message: `CapabilityAdmissionPolicy '${policy.policyId}' applies only to required capabilities`
+    };
+  }
+  if (policy.allowedOutcomes !== void 0 && !policy.allowedOutcomes.includes(decision.outcome)) {
+    return {
+      code: "unsupported-capability-admission-outcome",
+      message: `CapabilityAdmissionPolicy '${policy.policyId}' does not allow outcome '${decision.outcome}'`
+    };
+  }
+  return void 0;
+}
+function capabilityPolicyForDecision(state, decision) {
+  if (decision.policyId === void 0) return void 0;
+  const stalePolicyRef = (decision.sourceRefs ?? []).find(
+    (sourceRef) => sourceRef.kind === "capability-admission-policy" && sourceRef.id !== decision.policyId
+  );
+  if (stalePolicyRef !== void 0) return "stale-capability-admission-policy-ref";
+  return state.policies.get(decision.policyId) ?? "missing-capability-admission-policy";
+}
+function capabilityPolicyIssueMessage(code, decision) {
+  if (code === "missing-capability-admission-policy") {
+    return `CapabilityAdmissionPolicy '${decision.policyId}' was referenced but not present`;
+  }
+  return `CapabilityAdmissionDecision '${decision.decisionId}' carries a stale admission policy source ref`;
+}
+function admissionStateForOutcome(outcome) {
+  if (outcome === "allow") return "allowed";
+  if (outcome === "block") return "blocked";
+  if (outcome === "defer") return "deferred";
+  return void 0;
+}
+function capabilityAdmissionStatusState(state) {
+  if (state === "allowed") return "capability-admission-allowed";
+  if (state === "blocked") return "capability-admission-blocked";
+  return "capability-admission-deferred";
+}
+function cloneCapabilityRef(ref2) {
+  return {
+    id: ref2.id,
+    kind: ref2.kind,
+    required: ref2.required,
+    ...ref2.sourceRefs === void 0 ? {} : { sourceRefs: [...ref2.sourceRefs] }
+  };
+}
+function isBoundaryCapabilityRef(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return typeof record.id === "string" && record.id.length > 0 && isBoundaryCapabilityKind(record.kind) && typeof record.required === "boolean" && (record.sourceRefs === void 0 || Array.isArray(record.sourceRefs) && record.sourceRefs.every((sourceRef) => typeof sourceRef === "string"));
+}
+function isBoundaryCapabilityKind(value) {
+  return value === "auth" || value === "permission" || value === "config" || value === "resource";
+}
+function isCapabilityAdmissionOutcome(value) {
+  return value === "allow" || value === "block" || value === "defer";
+}
+function proposalKeyFallback(proposal) {
+  return typeof proposal.proposalId === "string" && proposal.proposalId.length > 0 ? proposal.proposalId : `${stringValue(proposal.subjectId) ?? "unknown"}:${capabilityKeyFallback(proposal.capability)}`;
+}
+function policyKeyFallback(policy) {
+  return typeof policy.policyId === "string" && policy.policyId.length > 0 ? policy.policyId : "unknown";
+}
+function decisionKeyFallback(decision) {
+  return typeof decision.decisionId === "string" && decision.decisionId.length > 0 ? decision.decisionId : `${stringValue(decision.proposalId) ?? "unknown"}:${stringValue(decision.admissionId) ?? "unknown"}`;
+}
+function capabilityKeyFallback(value) {
+  if (!isBoundaryCapabilityRef(value)) return "unknown-capability";
+  return `${value.kind}:${value.id}`;
+}
+function nextMalformedIssueKey(state, kind, fallback) {
+  state.issueSeq += 1;
+  return `malformed-${kind}:${state.issueSeq}:${fallback}`;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function capabilityProposalRefs(proposal) {
+  return uniqueSourceRefs([
+    ref("capability-admission-proposal", proposal.proposalId),
+    ref("boundary-capability", `${proposal.capability.kind}:${proposal.capability.id}`),
+    ...proposal.sourceRefs ?? []
+  ]);
+}
+function capabilityDecisionRefs(decision, proposal, policy) {
+  return uniqueSourceRefs([
+    ref("capability-admission-decision", decision.decisionId),
+    ref("capability-admission", decision.admissionId),
+    ref("capability-admission-proposal", decision.proposalId),
+    ...proposal === void 0 ? [] : capabilityProposalRefs(proposal),
+    ...decision.policyId === void 0 ? [] : [ref("capability-admission-policy", decision.policyId)],
+    ...policy === void 0 ? [] : [ref("capability-admission-policy", policy.policyId)],
+    ...decision.sourceRefs ?? []
+  ]);
+}
+function forEachPolicyDepBatch(ctx, start, count, fn) {
+  for (let i = 0; i < count; i += 1) {
+    for (const value of depBatch(ctx, start + i) ?? []) fn(value);
+  }
+}
+function projectRuntimeFact(graph, runtime, name, factory, pick) {
+  return graph.node(
+    [runtime],
+    (ctx) => {
+      for (const fact of depBatch(ctx, 0) ?? []) {
+        const typed = fact;
+        const value = pick(typed);
+        if (value !== void 0) ctx.down([["DATA", value]]);
+      }
+    },
+    { name, factory }
+  );
+}
+function freezeCapabilityAdmissionViews(state) {
+  return {
+    admissionsByProposal: new Map(state.admissionsByProposal),
+    admissionsBySubject: new Map(
+      Array.from(state.admissionsBySubject, ([key, value]) => [key, Object.freeze([...value])])
+    ),
+    issues: Object.freeze([...state.issues]),
+    audit: Object.freeze([...state.audit])
+  };
+}
+function emptyCapabilityAdmissionState() {
+  return {
+    proposals: /* @__PURE__ */ new Map(),
+    policies: /* @__PURE__ */ new Map(),
+    decisions: /* @__PURE__ */ new Map(),
+    admissionsById: /* @__PURE__ */ new Map(),
+    admissionsByProposal: /* @__PURE__ */ new Map(),
+    terminalDecisionIds: /* @__PURE__ */ new Set(),
+    issueKeys: /* @__PURE__ */ new Set(),
+    issueSeq: 0,
+    statusSeq: 0,
+    auditSeq: 0
+  };
+}
+function dataIssue(code, message, opts = {}) {
+  return {
+    kind: "issue",
+    code,
+    message,
+    severity: "error",
+    subjectId: opts.subjectId,
+    refs: opts.refs?.map((sourceRef) => `${sourceRef.kind}:${sourceRef.id}`),
+    details: opts.details
+  };
+}
+function uniqueSourceRefs(sourceRefs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sourceRef of sourceRefs) {
+    const key = `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(sourceRef);
+  }
+  return out;
+}
+function ref(kind, id) {
+  return { kind, id };
+}
+
 export {
   AGENTIC_MEMORY_RECORD_FRAME_FORMAT,
   AGENTIC_MEMORY_RECORD_FRAME_VERSION,
@@ -2444,6 +2988,8 @@ export {
   agenticMemoryRecordCodec,
   agenticMemoryRetentionBundle,
   agenticMemoryConsolidationBundle,
-  agenticMemoryContextPackingBundle
+  agenticMemoryContextPackingBundle,
+  capabilityAdmissionProposal,
+  capabilityAdmissionProjector
 };
-//# sourceMappingURL=chunk-COHO25CZ.js.map
+//# sourceMappingURL=chunk-YDSIVHRR.js.map