@titan-design/authority 0.0.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vocabulary.ts","../src/schema.ts","../src/evaluate.ts","../src/table.json","../src/table.ts"],"sourcesContent":["export const ACTOR_CLASSES = [\"owner-terminal\", \"owner-remote\", \"coordinator\", \"worker\", \"headless\", \"automation\"] as const;\n\n/** The only classes that may resolve a gate: the owner, at a terminal or through a verified remote channel. */\nexport const RESOLVER_CLASSES = [\"owner-terminal\", \"owner-remote\"] as const;\n\nexport const ACTION_CLASSES = [\n  \"merge\",\n  \"release\",\n  \"secret-read\",\n  \"untrusted-ingest\",\n  \"private-to-public\",\n  \"private-egress\",\n  \"hardware-actuate\",\n  \"hardware-stop\",\n  \"destructive-remote\",\n  \"destructive-local\",\n  \"destructive-foreign\",\n  \"spawn\",\n  \"spend-over-cap\",\n  \"authority-config\",\n  \"human-verb\",\n] as const;\n\nexport const VERDICTS = [\"allow\", \"gate\", \"deny\"] as const;\n\n/** Codes for the record each rule expects to leave behind, from a decision record to a device read-back. */\nexport const EVIDENCE_KINDS = [\"E-dec\", \"E-gate\", \"E-ref\", \"E-byp\", \"E-gh\", \"E-npm\", \"E-spn\", \"E-prin\", \"E-dev\"] as const;\n\nexport type ActorClass = (typeof ACTOR_CLASSES)[number];\nexport type ResolverClass = (typeof RESOLVER_CLASSES)[number];\nexport type ActionClass = (typeof ACTION_CLASSES)[number];\nexport type Verdict = (typeof VERDICTS)[number];\nexport type EvidenceKind = (typeof EVIDENCE_KINDS)[number];\n","import { z } from \"zod\";\nimport { ACTION_CLASSES, ACTOR_CLASSES, EVIDENCE_KINDS, RESOLVER_CLASSES, VERDICTS } from \"./vocabulary.js\";\n\nconst ruleSchema = z\n  .object({\n    id: z.string().min(1),\n    action: z.enum(ACTION_CLASSES),\n    actor: z.enum(ACTOR_CLASSES),\n    verdict: z.enum(VERDICTS),\n    resolvers: z.array(z.enum(RESOLVER_CLASSES)).min(1).optional(),\n    taintEscalates: z.boolean().optional(),\n    condition: z.string().min(1).optional(),\n    evidence: z.array(z.enum(EVIDENCE_KINDS)),\n  })\n  .refine((rule) => (rule.verdict === \"gate\") === (rule.resolvers !== undefined), {\n    message: \"a gate rule needs resolvers, and only a gate rule may have them\",\n    path: [\"resolvers\"],\n  });\n\nexport type Rule = z.infer<typeof ruleSchema>;\n\nexport interface PolicyTable {\n  version: string;\n  rules: Rule[];\n}\n\nfunction checkTotality(table: PolicyTable, ctx: z.RefinementCtx): void {\n  const seenPairs = new Set<string>();\n  const seenIds = new Set<string>();\n  table.rules.forEach((rule, index) => {\n    const pair = `${rule.action} by ${rule.actor}`;\n    if (seenPairs.has(pair)) ctx.addIssue({ code: \"custom\", message: `duplicate rule for ${pair}`, path: [\"rules\", index] });\n    if (seenIds.has(rule.id)) ctx.addIssue({ code: \"custom\", message: `duplicate rule id ${rule.id}`, path: [\"rules\", index, \"id\"] });\n    seenPairs.add(pair);\n    seenIds.add(rule.id);\n  });\n  for (const action of ACTION_CLASSES) {\n    for (const actor of ACTOR_CLASSES) {\n      if (!seenPairs.has(`${action} by ${actor}`)) ctx.addIssue({ code: \"custom\", message: `no rule for ${action} by ${actor}`, path: [\"rules\"] });\n    }\n  }\n}\n\n/** Validates a table: every (action, actor) pair exactly once, and only owner classes as gate resolvers. */\nexport const policyTableSchema: z.ZodType<PolicyTable> = z\n  .object({ version: z.string().min(1), rules: z.array(ruleSchema) })\n  .superRefine(checkTotality);\n","import type { PolicyTable, Rule } from \"./schema.js\";\nimport type { ActionClass, ActorClass, ResolverClass } from \"./vocabulary.js\";\nimport { RESOLVER_CLASSES } from \"./vocabulary.js\";\n\nexport interface AuthorityRequest {\n  action: ActionClass;\n  actor: { class: ActorClass; id: string };\n  tainted: boolean;\n  subject: Record<string, string>;\n}\n\nexport type Decision =\n  | { verdict: \"allow\"; ruleId: string }\n  | { verdict: \"gate\"; ruleId: string; resolvers: ResolverClass[]; reason: string }\n  | { verdict: \"deny\"; ruleId: string | null; reason: string };\n\nconst TAINT_RESOLVERS: ResolverClass[] = [\"owner-terminal\"];\n\nfunction findRule(table: PolicyTable, action: string, actor: string): Rule | undefined {\n  return table.rules.find((rule) => rule.action === action && rule.actor === actor);\n}\n\n/** Decides one request against a table. Pure: no clock, no environment, and no match means deny. */\nexport function evaluate(table: PolicyTable, request: AuthorityRequest): Decision {\n  const { action } = request;\n  const actor = request.actor.class;\n  const rule = findRule(table, action, actor);\n  if (!rule) return { verdict: \"deny\", ruleId: null, reason: `no rule for ${action} by ${actor}` };\n  if (rule.verdict === \"deny\") return { verdict: \"deny\", ruleId: rule.id, reason: `${rule.id} denies ${action} by ${actor}` };\n  if (rule.verdict === \"gate\") {\n    return { verdict: \"gate\", ruleId: rule.id, resolvers: [...(rule.resolvers ?? [])], reason: `${rule.id} gates ${action} by ${actor}` };\n  }\n  if (request.tainted && rule.taintEscalates) {\n    return { verdict: \"gate\", ruleId: rule.id, resolvers: [...TAINT_RESOLVERS], reason: `${rule.id} gates ${action} by a tainted ${actor}` };\n  }\n  return { verdict: \"allow\", ruleId: rule.id };\n}\n\nfunction gateResolvers(rule: Rule): readonly ResolverClass[] {\n  if (rule.verdict === \"gate\") return rule.resolvers ?? [];\n  if (rule.verdict === \"allow\" && rule.taintEscalates) return TAINT_RESOLVERS;\n  return [];\n}\n\nfunction isResolverClass(actorClass: ActorClass): actorClass is ResolverClass {\n  return (RESOLVER_CLASSES as readonly string[]).includes(actorClass);\n}\n\n/** Whether a resolver may resolve the gate a rule opens. Agents, automation and tainted sessions never may. */\nexport function canResolve(table: PolicyTable, ruleId: string, resolver: { class: ActorClass; tainted: boolean }): boolean {\n  if (resolver.tainted || !isResolverClass(resolver.class)) return false;\n  const rule = table.rules.find((candidate) => candidate.id === ruleId);\n  return rule !== undefined && gateResolvers(rule).includes(resolver.class);\n}\n","{\n  \"version\": \"1.0.0\",\n  \"rules\": [\n    {\n      \"id\": \"MRG-OT\",\n      \"action\": \"merge\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-gh\"\n      ]\n    },\n    {\n      \"id\": \"MRG-OR\",\n      \"action\": \"merge\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"gate\",\n      \"resolvers\": [\n        \"owner-remote\"\n      ],\n      \"condition\": \"Read-back of repo, pull request number, head SHA and title. Resolves a coordinator or automation merge gate; no direct door.\",\n      \"evidence\": [\n        \"E-gate\",\n        \"E-prin\"\n      ]\n    },\n    {\n      \"id\": \"MRG-CO\",\n      \"action\": \"merge\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"gate\",\n      \"resolvers\": [\n        \"owner-terminal\",\n        \"owner-remote\"\n      ],\n      \"evidence\": [\n        \"E-gate\",\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"MRG-WK\",\n      \"action\": \"merge\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"MRG-HD\",\n      \"action\": \"merge\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"MRG-AU\",\n      \"action\": \"merge\",\n      \"actor\": \"automation\",\n      \"verdict\": \"gate\",\n      \"resolvers\": [\n        \"owner-terminal\",\n        \"owner-remote\"\n      ],\n      \"condition\": \"Merge on green plus owner approval.\",\n      \"evidence\": [\n        \"E-gate\",\n        \"E-gh\"\n      ]\n    },\n    {\n      \"id\": \"REL-OT\",\n      \"action\": \"release\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Includes the first hand publish of a new package.\",\n      \"evidence\": [\n        \"E-npm\"\n      ]\n    },\n    {\n      \"id\": \"REL-OR\",\n      \"action\": \"release\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"REL-CO\",\n      \"action\": \"release\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"gate\",\n      \"resolvers\": [\n        \"owner-terminal\"\n      ],\n      \"condition\": \"A Version Packages pull request merge and a Worker deploy are releases.\",\n      \"evidence\": [\n        \"E-gate\",\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"REL-WK\",\n      \"action\": \"release\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"REL-HD\",\n      \"action\": \"release\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"REL-AU\",\n      \"action\": \"release\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Only the release workflow on main after a merged Version Packages pull request.\",\n      \"evidence\": [\n        \"E-npm\"\n      ]\n    },\n    {\n      \"id\": \"SEC-OT\",\n      \"action\": \"secret-read\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Secret values are never logged.\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"SEC-OR\",\n      \"action\": \"secret-read\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SEC-CO\",\n      \"action\": \"secret-read\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SEC-WK\",\n      \"action\": \"secret-read\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SEC-HD\",\n      \"action\": \"secret-read\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SEC-AU\",\n      \"action\": \"secret-read\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Its own scoped credential only.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"UNT-OT\",\n      \"action\": \"untrusted-ingest\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"condition\": \"The receiving session becomes tainted.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"UNT-OR\",\n      \"action\": \"untrusted-ingest\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"allow\",\n      \"condition\": \"The message arrives human-endorsed, never as from the human; forwarded third-party text taints.\",\n      \"evidence\": [\n        \"E-prin\"\n      ]\n    },\n    {\n      \"id\": \"UNT-CO\",\n      \"action\": \"untrusted-ingest\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"allow\",\n      \"condition\": \"The session becomes tainted.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"UNT-WK\",\n      \"action\": \"untrusted-ingest\",\n      \"actor\": \"worker\",\n      \"verdict\": \"allow\",\n      \"condition\": \"The session becomes tainted.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"UNT-HD\",\n      \"action\": \"untrusted-ingest\",\n      \"actor\": \"headless\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Only fenced as data with no authority tools; the run is tainted from the start.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"UNT-AU\",\n      \"action\": \"untrusted-ingest\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Only into a fenced field that a consumer treats as tainted.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"PUB-OT\",\n      \"action\": \"private-to-public\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"PUB-OR\",\n      \"action\": \"private-to-public\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"PUB-CO\",\n      \"action\": \"private-to-public\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"PUB-WK\",\n      \"action\": \"private-to-public\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"PUB-HD\",\n      \"action\": \"private-to-public\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"PUB-AU\",\n      \"action\": \"private-to-public\",\n      \"actor\": \"automation\",\n      \"verdict\": \"deny\",\n      \"condition\": \"The CI check fails.\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"EXT-OT\",\n      \"action\": \"private-egress\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"EXT-OR\",\n      \"action\": \"private-egress\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Read-back of open queue items to the owner's own device.\",\n      \"evidence\": [\n        \"E-prin\"\n      ]\n    },\n    {\n      \"id\": \"EXT-CO\",\n      \"action\": \"private-egress\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"deny\",\n      \"taintEscalates\": true,\n      \"condition\": \"Outside registered pipes.\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"EXT-WK\",\n      \"action\": \"private-egress\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"condition\": \"Outside registered pipes.\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"EXT-HD\",\n      \"action\": \"private-egress\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"condition\": \"Outside registered pipes.\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"EXT-AU\",\n      \"action\": \"private-egress\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Through a registered pipe with redaction and minimization.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"HW-OT\",\n      \"action\": \"hardware-actuate\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"HW-OR\",\n      \"action\": \"hardware-actuate\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"condition\": \"Engaging or raising load; hardware-stop covers stop and unload.\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HW-CO\",\n      \"action\": \"hardware-actuate\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"gate\",\n      \"resolvers\": [\n        \"owner-terminal\"\n      ],\n      \"condition\": \"The owner at the device confirms each engage step; a forced takeover of an engaged device is always gated.\",\n      \"evidence\": [\n        \"E-gate\",\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"HW-WK\",\n      \"action\": \"hardware-actuate\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HW-HD\",\n      \"action\": \"hardware-actuate\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HW-AU\",\n      \"action\": \"hardware-actuate\",\n      \"actor\": \"automation\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HWS-OT\",\n      \"action\": \"hardware-stop\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"HWS-OR\",\n      \"action\": \"hardware-stop\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"HWS-CO\",\n      \"action\": \"hardware-stop\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"HWS-WK\",\n      \"action\": \"hardware-stop\",\n      \"actor\": \"worker\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"HWS-HD\",\n      \"action\": \"hardware-stop\",\n      \"actor\": \"headless\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"HWS-AU\",\n      \"action\": \"hardware-stop\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dev\"\n      ]\n    },\n    {\n      \"id\": \"DSR-OT\",\n      \"action\": \"destructive-remote\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Through the git-safety bypass or a command the owner typed.\",\n      \"evidence\": [\n        \"E-byp\"\n      ]\n    },\n    {\n      \"id\": \"DSR-OR\",\n      \"action\": \"destructive-remote\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSR-CO\",\n      \"action\": \"destructive-remote\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSR-WK\",\n      \"action\": \"destructive-remote\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSR-HD\",\n      \"action\": \"destructive-remote\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSR-AU\",\n      \"action\": \"destructive-remote\",\n      \"actor\": \"automation\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-gh\"\n      ]\n    },\n    {\n      \"id\": \"DSL-OT\",\n      \"action\": \"destructive-local\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"DSL-OR\",\n      \"action\": \"destructive-local\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSL-CO\",\n      \"action\": \"destructive-local\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Inside its own checkout.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"DSL-WK\",\n      \"action\": \"destructive-local\",\n      \"actor\": \"worker\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Inside its own worktree.\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"DSL-HD\",\n      \"action\": \"destructive-local\",\n      \"actor\": \"headless\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Inside its own worktree.\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"DSL-AU\",\n      \"action\": \"destructive-local\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Inside its own workspace.\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"DSX-OT\",\n      \"action\": \"destructive-foreign\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Includes retire --force and a broker restart, which are terminal-only.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"DSX-OR\",\n      \"action\": \"destructive-foreign\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSX-CO\",\n      \"action\": \"destructive-foreign\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSX-WK\",\n      \"action\": \"destructive-foreign\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSX-HD\",\n      \"action\": \"destructive-foreign\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"DSX-AU\",\n      \"action\": \"destructive-foreign\",\n      \"actor\": \"automation\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SPN-OT\",\n      \"action\": \"spawn\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-spn\"\n      ]\n    },\n    {\n      \"id\": \"SPN-OR\",\n      \"action\": \"spawn\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Within service limits, which are never lifted; the owner is recorded as the principal.\",\n      \"evidence\": [\n        \"E-spn\",\n        \"E-prin\"\n      ]\n    },\n    {\n      \"id\": \"SPN-CO\",\n      \"action\": \"spawn\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"allow\",\n      \"taintEscalates\": true,\n      \"condition\": \"Within the spawn escalation, depth, rate, cwd and slot limits.\",\n      \"evidence\": [\n        \"E-spn\",\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SPN-WK\",\n      \"action\": \"spawn\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SPN-HD\",\n      \"action\": \"spawn\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SPN-AU\",\n      \"action\": \"spawn\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Within service limits, with no principal recorded.\",\n      \"evidence\": [\n        \"E-spn\"\n      ]\n    },\n    {\n      \"id\": \"SPD-OT\",\n      \"action\": \"spend-over-cap\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"SPD-OR\",\n      \"action\": \"spend-over-cap\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"condition\": \"There is no cap to raise remotely.\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"SPD-CO\",\n      \"action\": \"spend-over-cap\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Spend is recorded and crossing the notice threshold notifies the owner; the run continues.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"SPD-WK\",\n      \"action\": \"spend-over-cap\",\n      \"actor\": \"worker\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Spend is recorded and crossing the notice threshold notifies the owner; the run continues.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"SPD-HD\",\n      \"action\": \"spend-over-cap\",\n      \"actor\": \"headless\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Spend is recorded and crossing the notice threshold notifies the owner; the run continues.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"SPD-AU\",\n      \"action\": \"spend-over-cap\",\n      \"actor\": \"automation\",\n      \"verdict\": \"allow\",\n      \"condition\": \"Spend is recorded and crossing the notice threshold notifies the owner; the run continues.\",\n      \"evidence\": [\n        \"E-dec\"\n      ]\n    },\n    {\n      \"id\": \"CFG-OT\",\n      \"action\": \"authority-config\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": []\n    },\n    {\n      \"id\": \"CFG-OR\",\n      \"action\": \"authority-config\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"CFG-CO\",\n      \"action\": \"authority-config\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"deny\",\n      \"condition\": \"A repository CLAUDE.md change goes through a pull request under merge, flagged as a sensitive path.\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"CFG-WK\",\n      \"action\": \"authority-config\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"CFG-HD\",\n      \"action\": \"authority-config\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"CFG-AU\",\n      \"action\": \"authority-config\",\n      \"actor\": \"automation\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HV-OT\",\n      \"action\": \"human-verb\",\n      \"actor\": \"owner-terminal\",\n      \"verdict\": \"allow\",\n      \"evidence\": [\n        \"E-gate\"\n      ]\n    },\n    {\n      \"id\": \"HV-OR\",\n      \"action\": \"human-verb\",\n      \"actor\": \"owner-remote\",\n      \"verdict\": \"gate\",\n      \"resolvers\": [\n        \"owner-remote\"\n      ],\n      \"condition\": \"Read-back of what is answered; voice caps an endorsement at 600 characters and a permission preview at 300.\",\n      \"evidence\": [\n        \"E-prin\",\n        \"E-gate\"\n      ]\n    },\n    {\n      \"id\": \"HV-CO\",\n      \"action\": \"human-verb\",\n      \"actor\": \"coordinator\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HV-WK\",\n      \"action\": \"human-verb\",\n      \"actor\": \"worker\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HV-HD\",\n      \"action\": \"human-verb\",\n      \"actor\": \"headless\",\n      \"verdict\": \"deny\",\n      \"evidence\": [\n        \"E-ref\"\n      ]\n    },\n    {\n      \"id\": \"HV-AU\",\n      \"action\": \"human-verb\",\n      \"actor\": \"automation\",\n      \"verdict\": \"deny\",\n      \"condition\": \"A queue mirror applying a verdict the owner gave remotely acts as owner-remote, not as automation.\",\n      \"evidence\": [\n        \"E-gate\"\n      ]\n    }\n  ]\n}\n","import tableJson from \"./table.json\" with { type: \"json\" };\nimport type { PolicyTable } from \"./schema.js\";\nimport { policyTableSchema } from \"./schema.js\";\n\n/** The owner-approved decision table, validated on load. The same data ships as `@titan-design/authority/table.json`. */\nexport const DEFAULT_TABLE: PolicyTable = policyTableSchema.parse(tableJson);\n"],"mappings":";AAAO,IAAM,gBAAgB,CAAC,kBAAkB,gBAAgB,eAAe,UAAU,YAAY,YAAY;AAG1G,IAAM,mBAAmB,CAAC,kBAAkB,cAAc;AAE1D,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,WAAW,CAAC,SAAS,QAAQ,MAAM;AAGzC,IAAM,iBAAiB,CAAC,SAAS,UAAU,SAAS,SAAS,QAAQ,SAAS,SAAS,UAAU,OAAO;;;AC1B/G,SAAS,SAAS;AAGlB,IAAM,aAAa,EAChB,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,QAAQ,EAAE,KAAK,cAAc;AAAA,EAC7B,OAAO,EAAE,KAAK,aAAa;AAAA,EAC3B,SAAS,EAAE,KAAK,QAAQ;AAAA,EACxB,WAAW,EAAE,MAAM,EAAE,KAAK,gBAAgB,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC7D,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACrC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,MAAM,EAAE,KAAK,cAAc,CAAC;AAC1C,CAAC,EACA,OAAO,CAAC,SAAU,KAAK,YAAY,YAAa,KAAK,cAAc,SAAY;AAAA,EAC9E,SAAS;AAAA,EACT,MAAM,CAAC,WAAW;AACpB,CAAC;AASH,SAAS,cAAc,OAAoB,KAA4B;AACrE,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,MAAM,QAAQ,CAAC,MAAM,UAAU;AACnC,UAAM,OAAO,GAAG,KAAK,MAAM,OAAO,KAAK,KAAK;AAC5C,QAAI,UAAU,IAAI,IAAI,EAAG,KAAI,SAAS,EAAE,MAAM,UAAU,SAAS,sBAAsB,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC;AACvH,QAAI,QAAQ,IAAI,KAAK,EAAE,EAAG,KAAI,SAAS,EAAE,MAAM,UAAU,SAAS,qBAAqB,KAAK,EAAE,IAAI,MAAM,CAAC,SAAS,OAAO,IAAI,EAAE,CAAC;AAChI,cAAU,IAAI,IAAI;AAClB,YAAQ,IAAI,KAAK,EAAE;AAAA,EACrB,CAAC;AACD,aAAW,UAAU,gBAAgB;AACnC,eAAW,SAAS,eAAe;AACjC,UAAI,CAAC,UAAU,IAAI,GAAG,MAAM,OAAO,KAAK,EAAE,EAAG,KAAI,SAAS,EAAE,MAAM,UAAU,SAAS,eAAe,MAAM,OAAO,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;AAAA,IAC7I;AAAA,EACF;AACF;AAGO,IAAM,oBAA4C,EACtD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,OAAO,EAAE,MAAM,UAAU,EAAE,CAAC,EACjE,YAAY,aAAa;;;AC9B5B,IAAM,kBAAmC,CAAC,gBAAgB;AAE1D,SAAS,SAAS,OAAoB,QAAgB,OAAiC;AACrF,SAAO,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,UAAU,KAAK,UAAU,KAAK;AAClF;AAGO,SAAS,SAAS,OAAoB,SAAqC;AAChF,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,QAAQ,QAAQ,MAAM;AAC5B,QAAM,OAAO,SAAS,OAAO,QAAQ,KAAK;AAC1C,MAAI,CAAC,KAAM,QAAO,EAAE,SAAS,QAAQ,QAAQ,MAAM,QAAQ,eAAe,MAAM,OAAO,KAAK,GAAG;AAC/F,MAAI,KAAK,YAAY,OAAQ,QAAO,EAAE,SAAS,QAAQ,QAAQ,KAAK,IAAI,QAAQ,GAAG,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,GAAG;AAC1H,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,EAAE,SAAS,QAAQ,QAAQ,KAAK,IAAI,WAAW,CAAC,GAAI,KAAK,aAAa,CAAC,CAAE,GAAG,QAAQ,GAAG,KAAK,EAAE,UAAU,MAAM,OAAO,KAAK,GAAG;AAAA,EACtI;AACA,MAAI,QAAQ,WAAW,KAAK,gBAAgB;AAC1C,WAAO,EAAE,SAAS,QAAQ,QAAQ,KAAK,IAAI,WAAW,CAAC,GAAG,eAAe,GAAG,QAAQ,GAAG,KAAK,EAAE,UAAU,MAAM,iBAAiB,KAAK,GAAG;AAAA,EACzI;AACA,SAAO,EAAE,SAAS,SAAS,QAAQ,KAAK,GAAG;AAC7C;AAEA,SAAS,cAAc,MAAsC;AAC3D,MAAI,KAAK,YAAY,OAAQ,QAAO,KAAK,aAAa,CAAC;AACvD,MAAI,KAAK,YAAY,WAAW,KAAK,eAAgB,QAAO;AAC5D,SAAO,CAAC;AACV;AAEA,SAAS,gBAAgB,YAAqD;AAC5E,SAAQ,iBAAuC,SAAS,UAAU;AACpE;AAGO,SAAS,WAAW,OAAoB,QAAgB,UAA4D;AACzH,MAAI,SAAS,WAAW,CAAC,gBAAgB,SAAS,KAAK,EAAG,QAAO;AACjE,QAAM,OAAO,MAAM,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,MAAM;AACpE,SAAO,SAAS,UAAa,cAAc,IAAI,EAAE,SAAS,SAAS,KAAK;AAC1E;;;ACrDA;AAAA,EACE,SAAW;AAAA,EACX,OAAS;AAAA,IACP;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,gBAAkB;AAAA,MAClB,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,gBAAkB;AAAA,MAClB,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY,CAAC;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAM;AAAA,MACN,QAAU;AAAA,MACV,OAAS;AAAA,MACT,SAAW;AAAA,MACX,WAAa;AAAA,MACb,UAAY;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC71BO,IAAM,gBAA6B,kBAAkB,MAAM,aAAS;","names":[]}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@titan-design/authority",
+  "version": "0.0.0",
+  "description": "The authority decision table as data: who may merge, release, read secrets, spawn or actuate hardware, with a pure evaluator",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./table.json": "./src/table.json"
+  },
+  "files": [
+    "dist",
+    "src/table.json",
+    "README.md"
+  ],
+  "author": "Henry Jewkes",
+  "license": "MIT",
+  "homepage": "https://github.com/HJewkes/titan-platform#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/HJewkes/titan-platform.git",
+    "directory": "packages/authority"
+  },
+  "bugs": "https://github.com/HJewkes/titan-platform/issues",
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "zod": "^4.4.3"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src"
+  }
+}