@visiq/core-wasm 0.1.6 → 0.1.8

package/README.md

@@ -7,28 +7,38 @@ of a parallel TS implementation that can drift.
 
 ```js
 const { evaluate } = require('@visiq/core-wasm');
-const decisionJson = evaluate(JSON.stringify(event), JSON.stringify(bundle));
+// PLAIN OBJECTS IN, PLAIN OBJECT OUT — `evaluate` does the JSON marshalling
+// itself. Do NOT pre-stringify: `evaluate(JSON.stringify(event), …)` double-
+// encodes, the core sees a JSON *string* where an object belongs, and the
+// decision comes back with `allowed: true` for an event policy DENIES.
+const decision = evaluate(event, bundle);
+if (!decision.allowed) {
+  // blocked by policy — do not execute the tool call
+}
 ```
 
 - **Synchronous, no async init.** `--target nodejs` glue instantiates the wasm from bytes
   at `require` time (`new WebAssembly.Module`/`Instance`) — a drop-in for a sync call.
   (Node/server only; a browser build would need `--target web` + async init.)
-- **`evaluate(eventJson, bundleJson) → decisionJson`** is the language-neutral seam
-  (`evaluate_json` in the core). Fail-closed (G001) on malformed input — never throws.
+- **`evaluate(event, bundle) → decision`** takes and returns plain objects; the
+  language-neutral seam underneath is `evaluate_json` (JSON string in, JSON string out),
+  and this package's wrapper is what stringifies/parses around it. Fail-closed (G001) on
+  malformed input — never throws.
 - **Faithful.** `node conformance.mjs` proves it reproduces the frozen golden corpus
   (`sdk-corpus/GOLDEN-oracle-vectors.json`) — the same vectors every other binding
-  reproduces. **85/85, 0 diverge.**
+  reproduces. **118/118, 0 diverge.**
 
 ## Rebuild
 
 `./build.sh` (needs rustup + `wasm32-unknown-unknown` + `wasm-bindgen-cli` **=0.2.100**;
 the crate pins `wasm-bindgen = "=0.2.100"` so CLI/schema versions match).
 
-## Scope / what this is NOT
+## Scope
 
-This emits the **decision tuple** `{decision, allowed, action:{decision,argRedactionRules},
-retrieval:{action,redactionRules}}`. It does **not** emit rule attribution (`ruleCode`,
-`reason` prose, `decisionId`) — those are out-of-core (#25) and still computed in TS. A
-full `@visiq/harness` cutover to this core therefore needs the core extended to return
-matched-rule attribution; until then this package is the proven, corpus-gated binding.
-See `experiments/matrix-v2/visiq-core-rs/PARITY-GAPS.md`.
+`evaluate` returns the full decision object — `{decision, allowed, reason, ruleId,
+ruleCode, enforced, agentMode, action:{decision,argRedactionRules},
+retrieval:{action,redactionRules}}`. Matched-rule attribution (`reason` prose,
+`ruleId`, `ruleCode`) IS emitted in-core; `decisionId` is not — it is minted by the
+caller. `@visiq/runtime` declares this package a REQUIRED dependency and calls it the
+sole decision engine, so the harness cutover is done, not pending. Remaining seams are
+tracked in `experiments/matrix-v2/visiq-core-rs/PARITY-GAPS.md`.

package/index.d.ts

@@ -93,3 +93,11 @@ export function recursiveKeyPaths(event: unknown): string[];
 export function deriveDeclaredCore(samples: unknown[], opts?: unknown): { requiredPaths: string[]; optionalPaths: string[] };
 export function shouldMintNewVersion(prev: string[] | null | undefined, next: string[]): boolean;
 export function sanitizeAgentReason(reason: string | null | undefined): string;
+/**
+ * Does the CORE compile this `regex.match` pattern? The arbiter of what a
+ * persisted rule can evaluate is this engine (`Regex::new`, RE2 dialect), NOT
+ * JavaScript's `RegExp` — see the implementation note in `index.js` for how the
+ * verdict is derived from the core's own decision path (no new Rust export, no
+ * re-stamp) and for the fail-closed edges (raw newline, non-string, throw).
+ */
+export function patternCompiles(pattern: string): boolean;

package/index.js

@@ -63,7 +63,123 @@ const deriveDeclaredCore = (samples, opts) => call('derive_declared_core', { sam
 const shouldMintNewVersion = (prev, next) => call('should_mint_new_version', { prev: prev ?? null, next });
 const sanitizeAgentReason = (reason) => call('sanitize_agent_reason', { reason });
 
+// ── regex compilability, ARBITRATED BY THE CORE ────────────────────────────
+/**
+ * Does THE SHIPPED CORE compile this `regex.match` pattern?
+ *
+ * WHY THIS EXISTS. The rule write guard
+ * (`@visiq/rego-evaluator`'s `collectUninterpretableRegexPatterns`) has to
+ * decide whether a pattern an author is about to persist can fire at all. The
+ * engine that decides that in production is THIS core — `regex::Regex::new`
+ * (Rust regex, the RE2 dialect Rego's `regex.match` is specified over), whose
+ * `Err` the evaluator maps to `false`, so a `deny` carrying an uncompilable
+ * pattern PERMITS. Asking JavaScript's `RegExp` instead is wrong in BOTH
+ * directions and was measured wrong on 2026-07-31: `delete(?=_prod)`,
+ * `(?<=x)delete` and `(a)\1` are JS-valid and RE2-INVALID (accepted by the
+ * guard, dead in production), while `(?P<verb>del)ete` and `[[:alpha:]]+` are
+ * RE2-VALID and JS-invalid-or-different (refused by the guard, working in
+ * production).
+ *
+ * HOW IT ASKS, without a new Rust export or a wasm re-stamp. The core has no
+ * "compile this pattern" op, and adding one means editing the Rust core,
+ * re-stamping the corpus and regenerating every binding. It does not need one:
+ * compilability is DERIVABLE from the op the core already exposes. Evaluate a
+ * one-rule bundle whose body is `regex.match("|<pattern>", input.action)`. The
+ * leading empty alternative matches at position 0 of ANY subject, so:
+ *
+ *   pattern compiles  ->  the whole pattern compiles -> matches -> matched:true
+ *   pattern does not  ->  `Regex::new` errs -> condition false -> matched:false
+ *
+ * i.e. the verdict is the CORE's own `Regex::new`, read through the core's own
+ * decision path. Nothing here re-implements or enumerates a dialect difference.
+ *
+ * FAIL-CLOSED EDGES, stated rather than implied. A pattern carrying a raw
+ * newline or carriage return cannot be expressed in a single-line rego probe,
+ * so it is reported as NOT compilable rather than guessed at. (The rego parser
+ * is line-based, so such a pattern cannot reach a parsed condition in the first
+ * place.) A non-string, or any throw from the core, is likewise `false`.
+ *
+ * The pattern is a DECODED regex source (post `\\`/`\"` rego unescaping); it is
+ * re-encoded here with exactly the inverse the engines' `unescape_rego_string`
+ * applies, so the core sees the identical string back.
+ *
+ * @param {string} pattern decoded regex source
+ * @returns {boolean} true iff the core compiles it
+ */
+const PATTERN_PROBE_INPUT = {
+  agentId: 'regex-probe',
+  agent: { trust_tier: null, categories: [], business_function: null },
+  facets: ['action'],
+  // A non-null targetApp is REQUIRED: with `targetApp: null` the core's
+  // action-facet prefilter drops the rule and the probe reads 'no match',
+  // which would report every pattern as uncompilable.
+  targetApp: 'visiq-regex-probe',
+  action: 'visiq-regex-compilability-probe',
+  context: {},
+  operation: null,
+  resourceType: null,
+  resourceMetadata: null,
+  trustTier: null,
+  surface: null,
+  query: null,
+  normalized: {},
+  capabilities: { transformableResponse: false },
+};
+const patternProbeCache = new Map();
+function patternCompiles(pattern) {
+  if (typeof pattern !== 'string') {
+    return false;
+  }
+  const cached = patternProbeCache.get(pattern);
+  if (cached !== undefined) {
+    return cached;
+  }
+  let verdict = false;
+  if (!/[\n\r]/.test(pattern)) {
+    const encoded = `|${pattern}`.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    const rego = `deny { regex.match("${encoded}", input.action) }`;
+    try {
+      const res = evaluateUnifiedFromInput(
+        PATTERN_PROBE_INPUT,
+        {
+          rules: [
+            {
+              id: 'regex-probe',
+              origin_table: 'rules',
+              vendor_id: 'regex-probe',
+              name: 'regex-probe',
+              description: null,
+              rego_source: rego,
+              priority: 1,
+              enabled: true,
+              applies_to: ['action'],
+              target_app: null,
+              action_pattern: null,
+              trust_tier: null,
+              surface: null,
+              principal_exclusions: null,
+              bypass_active: false,
+              bypass_reason: null,
+              bypass_expires_at: null,
+              redaction_spec: null,
+              fail_closed_on_empty_spec: false,
+              rule_code: 'REGEX-PROBE',
+            },
+          ],
+        },
+        0,
+      );
+      verdict = res.matched === true && res.decision === 'deny';
+    } catch {
+      verdict = false;
+    }
+  }
+  patternProbeCache.set(pattern, verdict);
+  return verdict;
+}
+
 module.exports = {
+  patternCompiles,
   evaluate,
   evaluateUnifiedRulesRaw,
   evaluateUnifiedFromInput,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@visiq/core-wasm",
-  "version": "0.1.6",
-  "description": "VisIQ governance core (visiq-core-rs) compiled to WASM — the ONE Rust evaluation core, bound to JS. Same core the Go/Java/Ruby/Python SDKs use. evaluate(eventJson, bundleJson) -> decisionJson.",
+  "version": "0.1.8",
+  "description": "VisIQ governance core for Node.js — the one compiled Rust rule engine behind every VisIQ SDK, prebuilt to WebAssembly; evaluate(event, bundle) takes plain objects and synchronously returns a decision object.",
   "type": "commonjs",
   "main": "index.js",
   "types": "index.d.ts",
@@ -19,6 +19,7 @@
     "visiq",
     "ai-agent",
     "governance",
+    "agent-governance",
     "authorization",
     "wasm",
     "policy"