@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/lib/rego-input-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-input-path.d.ts","sourceRoot":"","sources":["../../src/lib/rego-input-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMnE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCrD"}

package/dist/lib/rego-input-path.js

@@ -0,0 +1,70 @@
+/**
+ * Rendering of an `input` path that is injective over its segments.
+ *
+ * Joining segments with dots made `input["a.b"]` and `input.a.b` the same
+ * string, so the two fields shared one Z3 constant and the witness for one
+ * was rebuilt as the other. A segment that is a plain identifier is written
+ * `.seg`; any other is written `["..."]` with JSON quoting, which is how Rego
+ * itself spells it, and the two forms cannot collide.
+ */
+const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Render `["user", "a.b"]` as `input.user["a.b"]`. */
+export function renderInputPath(segments) {
+    let out = 'input';
+    for (const seg of segments) {
+        out += IDENT.test(seg) ? `.${seg}` : `[${JSON.stringify(seg)}]`;
+    }
+    return out;
+}
+/**
+ * Parse a rendered path back into its segments. The inverse of
+ * renderInputPath; anything it did not produce is read as best it can, one
+ * dot-separated segment at a time, so a plain `input.a.b` still works, and a
+ * bracket without a well-formed string inside is taken as literal text
+ * rather than thrown on.
+ */
+export function parseInputPath(path) {
+    let rest = /^input(?=[.[]|$)/.test(path) ? path.slice('input'.length) : path;
+    const segments = [];
+    while (rest.length > 0) {
+        if (rest.startsWith('.')) {
+            const m = /^\.([^.[]+)/.exec(rest);
+            if (!m) {
+                // A dot with no name after it is not a rendering of ours either.
+                segments.push(rest);
+                break;
+            }
+            segments.push(m[1]);
+            rest = rest.slice(m[0].length);
+        }
+        else if (rest.startsWith('["')) {
+            // A JSON string literal: find its closing quote, honouring escapes.
+            let i = 2;
+            while (i < rest.length && rest[i] !== '"')
+                i += rest[i] === '\\' ? 2 : 1;
+            const closed = i < rest.length && rest[i + 1] === ']';
+            let literal;
+            if (closed) {
+                try {
+                    literal = JSON.parse(rest.slice(1, i + 1));
+                }
+                catch {
+                    literal = undefined;
+                }
+            }
+            if (typeof literal !== 'string') {
+                segments.push(rest);
+                break;
+            }
+            segments.push(literal);
+            rest = rest.slice(i + 2);
+        }
+        else {
+            // Not a rendering of ours; take the remainder as one segment.
+            segments.push(rest);
+            break;
+        }
+    }
+    return segments;
+}
+//# sourceMappingURL=rego-input-path.js.map

package/dist/lib/rego-input-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-input-path.js","sourceRoot":"","sources":["../../src/lib/rego-input-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,KAAK,GAAG,0BAA0B,CAAC;AAEzC,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,iEAAiE;gBACjE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,oEAAoE;YACpE,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YACtD,IAAI,OAAgB,CAAC;YACrB,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,SAAS,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,8DAA8D;YAC9D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/rego-ir.d.ts

@@ -7,7 +7,8 @@
  * A value that appears as an operand in a VerifyExpr.
  *
  * input_ref   - a path like input.user.role (path = "input.user.role",
- *               segments = ["user","role"])
+ *               segments = ["user","role"]); a segment that is not a plain
+ *               identifier is rendered `["..."]`, so paths never collide
  * local_var   - a local variable bound by :=/= in the same clause
  * literal_*   - a constant from the policy source
  */
@@ -36,6 +37,11 @@ export type VerifyValue = {
  * All supported operator semantics map cleanly to Z3. The 'unsupported'
  * variant is included so the walker can pass through the reason; the
  * engine treats any clause containing it as inconclusive.
+ *
+ * 'contradiction' is the encodable counterpart: a body term that makes the
+ * clause unsatisfiable no matter the input, such as a literal `false`. It is
+ * distinct from 'unsupported' because the engine CAN reason about it, and
+ * dropping it instead would make the clause look satisfiable when it is not.
  */
 export type VerifyExpr = {
     kind: 'eq';
@@ -84,15 +90,38 @@ export type VerifyExpr = {
     kind: 'assign';
     local: string;
     value: VerifyValue;
+} | {
+    kind: 'contradiction';
+    reason: string;
+} | {
+    kind: 'negation';
+    inner: VerifyExpr[];
 } | {
     kind: 'unsupported';
     constructType: string;
     reason: string;
 };
+/**
+ * The shape of a rule head, which decides whether "is this rule true" is even
+ * a meaningful question.
+ *
+ * complete        - `allow if { ... }` or `allow := <value> if { ... }`. Its
+ *                   value is a single term, so it can be compared to `true`.
+ * partial_set     - `deny contains msg if { ... }`. Its value is a SET, so it
+ *                   is never equal to `true` and asking always_true/never_true
+ *                   about it answers a question the caller did not intend.
+ * partial_object  - `perms[k] := v if { ... }`. Value is an object, same problem.
+ * function        - `f(x) if { ... }`. Needs arguments the caller never supplies.
+ * else_chain      - `... else := ...`. Ordered fallthrough the encoder does not model.
+ */
+export type RuleShape = 'complete' | 'partial_set' | 'partial_object' | 'function' | 'else_chain';
 /**
  * One clause of a rule -- corresponds to one `rule { body... }` block.
- * Multiple clauses for the same rule name are OR'd together.
- * Expressions within one clause are AND'd together.
+ *
+ * A clause contributes to "the rule is true" only when its head value is
+ * literally `true`. It contributes to "the rule is defined" whenever its body
+ * is satisfied, whatever the head value is. Keeping those separate is what
+ * makes `default` and non-boolean heads encodable rather than silently wrong.
  */
 export interface VerifyRuleClause {
     clauseIndex: number;
@@ -111,6 +140,8 @@ export interface UnsupportedConstruct {
 export interface VerifyWalkResult {
     rules: Map<string, VerifyRuleClause[]>;
     defaults: Map<string, boolean | number | string | null>;
+    /** Head shape per rule name. Absent means no clause was ever walked for it. */
+    shapes: Map<string, RuleShape>;
     inputPaths: Map<string, string[]>;
     unsupported: UnsupportedConstruct[];
 }

package/dist/lib/rego-ir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rego-ir.d.ts","sourceRoot":"","sources":["../../src/lib/rego-ir.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC"}
+{"version":3,"file":"rego-ir.d.ts","sourceRoot":"","sources":["../../src/lib/rego-ir.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,UAAU,GAAG,YAAY,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,+EAA+E;IAC/E,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC"}

package/dist/lib/rego-smt-encoder.d.ts

@@ -7,20 +7,43 @@
  * Design:
  *   - One Z3 constant per input path, typed by the type inferencer.
  *   - One Z3 constant per local variable, scoped per clause.
- *   - Each clause body becomes an AND of its expression formulas.
- *   - The full rule formula is an OR of all its clause formulas.
+ *   - Each clause body becomes an AND of its expression formulas, plus a
+ *     presence guard for every input path the clause reads.
+ *   - "the rule is TRUE" is the OR of the bodies of clauses whose head value is
+ *     literally true, OR'd with the default when no clause body holds. Encoding
+ *     the OR of all clause bodies instead conflated "the rule is defined" with
+ *     "the rule is true", which made `default allow := true` and non-boolean
+ *     heads silently wrong.
  *   - Uninterpreted sorts get a dedicated Z3 uninterpreted sort and
  *     can only participate in equality/inequality constraints.
  */
 import type { init as Z3Init } from 'z3-solver';
 import type { Z3Sort } from './rego-type-inferencer.js';
 import type { VerifyRuleClause } from './rego-ir.js';
+/**
+ * A string literal for Z3. Its parser reads `\u{HH}` inside a literal as an
+ * escape, so a policy literal that happens to spell one, or that holds any
+ * backslash, would be stored as something else. Every backslash is written
+ * as `\u{5c}`, which Z3 stores as the character and renders back as an
+ * escape the counterexample decoder undoes.
+ */
+export declare function z3String(Z3: Z3Context, value: string): ReturnType<Z3Context['String']['val']>;
 type Z3Context = ReturnType<Awaited<ReturnType<typeof Z3Init>>['Context']>;
 type Z3Bool = ReturnType<Z3Context['Bool']['const']>;
 type Z3AnyExpr = Z3Bool | ReturnType<Z3Context['Int']['const']> | ReturnType<Z3Context['String']['const']>;
 export interface EncoderContext {
     Z3: Z3Context;
     inputVars: Map<string, Z3AnyExpr>;
+    /**
+     * One Bool per input path, true when that field is present in the input.
+     *
+     * Rego evaluates a body to undefined when it reads a missing field, and an
+     * undefined body does not make the rule true. Modelling every path as a
+     * total, always-present constant made vacuous predicates look like
+     * tautologies, so always_true could be PROVEN for a rule that is merely
+     * undefined when a field is absent.
+     */
+    presenceVars: Map<string, Z3Bool>;
     sorts: Map<string, Z3Sort>;
     /** Per-call unique prefix for all Z3 constant names. Prevents sort conflicts
      *  when the same input path is inferred as different sorts across calls in the
@@ -31,19 +54,79 @@ export interface EncoderContext {
 export interface EncodedRule {
     formula: Z3Bool;
     warnings: string[];
+    /**
+     * True when at least one clause could not be encoded.
+     *
+     * The caller MUST treat the formula as meaningless in that case. Skipping the
+     * clause and solving the rest is what turned an unencodable operand into a
+     * confident PROVEN: dropping a clause makes the rule strictly easier to
+     * satisfy in one direction and strictly harder in the other, and both
+     * directions produce a wrong verdict.
+     */
+    unencodable: boolean;
 }
 /**
  * Create Z3 constants for all input paths based on inferred sorts.
  * Each constant name is prefixed with callId to ensure uniqueness across
  * verification calls in the same Z3 singleton context.
  */
-export declare function createInputVars(Z3: Z3Context, inputPaths: Map<string, string[]>, sorts: Map<string, Z3Sort>, callId: string): Map<string, Z3AnyExpr>;
+export declare function createInputVars(Z3: Z3Context, inputPaths: Map<string, string[]>, sorts: Map<string, Z3Sort>, callId: string): {
+    vars: Map<string, Z3AnyExpr>;
+    presence: Map<string, Z3Bool>;
+};
+/**
+ * Facts about the shape of any input, added to the solver alongside the
+ * property. A path the rule compared equal to a scalar literal, or fed to a
+ * string built-in, is present only as a scalar wherever that read holds, so
+ * it cannot also be the object holding a path beneath it: the two are never
+ * present together. Without this, `input.a == "x"` and `input.a.b == "y"`
+ * got two independent constants and a rule no input can satisfy was proved
+ * satisfiable, with a witness OPA rejects.
+ *
+ * Only those reads qualify. `input.a != "x"`, `input.a > 1` and a bare
+ * `input.a` all hold for an object, and a path with no evidence at all is
+ * given the string sort by default; treating any of them as scalar proved
+ * satisfiable rules never true.
+ */
+export declare function structuralAxioms(Z3: Z3Context, inputPaths: Map<string, string[]>, scalarPaths: ReadonlySet<string>, presence: Map<string, Z3Bool>): Z3Bool[];
+/**
+ * Every input path `clauses` reference, a negated body included.
+ *
+ * The presence guard below deliberately skips a negated body, since a
+ * missing field satisfies it; a witness must still be able to name that
+ * field. It must also never name a field the rule does not read: variables
+ * are created for every path in the module, so a path belonging to another
+ * rule is unconstrained here, and model completion would hand it an
+ * arbitrary value. Where that path is the parent of one this rule reads,
+ * the two collide and the witness stops satisfying the rule.
+ */
+export declare function clauseInputPaths(clauses: VerifyRuleClause[]): Set<string>;
 /**
  * Encode a complete rule as a Z3 Bool formula.
  * rule_formula = clause_0 OR clause_1 OR ... OR clause_n
  */
-export declare function encodeRule(clauses: VerifyRuleClause[], ctx: EncoderContext): EncodedRule;
-/** Convert an input path like "input.user.role" to a valid Z3 var name. */
+/**
+ * Encode "the rule evaluates to true".
+ *
+ * Rego semantics, and why the previous OR-of-all-clauses was wrong:
+ *   - a clause whose body holds gives the rule that clause's HEAD value
+ *   - the rule is DEFINED when any clause body holds
+ *   - when no body holds the rule takes its `default`, or stays undefined
+ *
+ * So `rule == true` is the OR of the bodies of clauses whose head is literally
+ * true, plus the default case when nothing else fired. Treating every satisfied
+ * body as "true" made `allow := false if {...}` prove always-true, and ignoring
+ * the default made `default allow := true` prove never-true.
+ */
+export declare function encodeRule(clauses: VerifyRuleClause[], ctx: EncoderContext, defaultValue?: boolean | number | string | null): EncodedRule;
+/**
+ * Convert an input path like "input.user.role" to a valid Z3 constant name.
+ *
+ * Must be INJECTIVE. Replacing "." with "__" was not: a quoted key holding a
+ * dot or an underscore pair, ordinary in Kubernetes and cloud policies such as
+ * `input.labels["app.kubernetes.io/name"]`, collided with a different path and
+ * two distinct fields became a single SMT variable.
+ */
 export declare function pathToVarName(path: string): string;
 /** Reconstruct a nested JSON object from flat Z3 var name → value pairs. */
 export declare function varNameToPath(varName: string): string;

package/dist/lib/rego-smt-encoder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rego-smt-encoder.d.ts","sourceRoot":"","sources":["../../src/lib/rego-smt-encoder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAc,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAE9E,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3E,KAAK,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrD,KAAK,SAAS,GACZ,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAE5F,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B;;;6EAGyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,MAAM,EAAE,MAAM,GACb,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CA2BxB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,cAAc,GAAG,WAAW,CAuBxF;AAsQD,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAcD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAa7D"}
+{"version":3,"file":"rego-smt-encoder.d.ts","sourceRoot":"","sources":["../../src/lib/rego-smt-encoder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAc,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAE9E;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAE7F;AAED,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3E,KAAK,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrD,KAAK,SAAS,GACZ,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAE5F,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC;;;;;;;;OAQG;IACH,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B;;;6EAGyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAgCjE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACjC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,MAAM,EAAE,CAgBV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAazE;AAgDD;;;GAGG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,gBAAgB,EAAE,EAC3B,GAAG,EAAE,cAAc,EACnB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAC9C,WAAW,CAyCb;AAsTD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQlD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIrD;AAcD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgB7D"}