intentdna 1.6.5 → 1.7.4

package/dist/compiler/input-resolver.js

@@ -0,0 +1,281 @@
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { validateDNA } from "../schema/validate.js";
+import { parseYAML } from "../schema/yaml-parser.js";
+import { DNADiagnosticsError, hasDiagnosticErrors } from "./diagnostics.js";
+const DNA_CONFIG_CANDIDATES = [
+    ".dna/config.yaml",
+    ".dna/config.yml",
+    ".dna/config.json",
+    ".dna.yaml",
+    ".dna.yml",
+    ".dna.json",
+];
+async function fileExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function parseDNAContent(filePath, raw) {
+    const isYAML = filePath.endsWith(".yaml") || filePath.endsWith(".yml");
+    return (isYAML ? parseYAML(raw) : JSON.parse(raw));
+}
+export async function parseDNAFile(filePath) {
+    const raw = await readFile(filePath, "utf-8");
+    return parseDNAContent(filePath, raw);
+}
+export function resolveSpeciesReference(ref) {
+    if (!ref.startsWith("species:"))
+        return null;
+    const name = ref.slice("species:".length);
+    const thisDir = dirname(fileURLToPath(import.meta.url));
+    return resolve(thisDir, "..", "species", `${name}.dna.json`);
+}
+export async function detectDNAConfigs(projectDir = process.cwd()) {
+    const configsDir = resolve(projectDir, ".dna", "configs");
+    try {
+        const files = await readdir(configsDir);
+        const configs = files
+            .filter((file) => file.endsWith(".yaml") || file.endsWith(".yml"))
+            .sort()
+            .map((file) => resolve(configsDir, file));
+        if (configs.length > 0)
+            return configs;
+    }
+    catch {
+        // Directory does not exist.
+    }
+    for (const candidate of DNA_CONFIG_CANDIDATES) {
+        const path = resolve(projectDir, candidate);
+        if (await fileExists(path))
+            return [path];
+    }
+    return [];
+}
+function fingerprint(raw) {
+    return `sha256:${createHash("sha256").update(raw, "utf-8").digest("hex")}`;
+}
+function enterprisePolicyCandidates(name, cwd, options) {
+    const configuredDirs = [
+        ...(process.env.INTENTDNA_ENTERPRISE_POLICY_DIR ? [process.env.INTENTDNA_ENTERPRISE_POLICY_DIR] : []),
+        ...(options?.enterprisePolicyDirs ?? []),
+    ];
+    const dirs = [
+        ...configuredDirs.map((dir) => ({ dir, trust: "admin_shared" })),
+        { dir: resolve(cwd, ".dna", "policies", "enterprise"), trust: "project_local" },
+        { dir: resolve(homedir(), ".intentdna", "policies", "enterprise"), trust: "user_local" },
+    ];
+    const names = [`${name}.dna.yaml`, `${name}.dna.yml`, `${name}.dna.json`];
+    return dirs.flatMap(({ dir, trust }) => names.map((file) => ({ path: resolve(dir, file), trust })));
+}
+async function resolveEnterpriseReference(ref, cwd, options) {
+    if (!ref.startsWith("enterprise:"))
+        return {};
+    const name = ref.slice("enterprise:".length);
+    for (const candidate of enterprisePolicyCandidates(name, cwd, options)) {
+        if (await fileExists(candidate.path))
+            return candidate;
+    }
+    return {};
+}
+function resolveFileReference(ref, fromFile) {
+    if (!ref.startsWith("file:"))
+        return {};
+    const raw = ref.slice("file:".length);
+    if (!raw)
+        return {};
+    return { path: resolve(dirname(fromFile), raw), trust: "explicit_file" };
+}
+function sourceTrustForInput(file, ref, cwd) {
+    if (ref.startsWith("species:"))
+        return "builtin";
+    if (ref.startsWith("enterprise:"))
+        return file.includes(`${resolve(cwd, ".dna", "policies", "enterprise")}`) ? "project_local" : "admin_shared";
+    if (ref.startsWith("file:"))
+        return "explicit_file";
+    return "input";
+}
+async function readDNAWithRaw(path) {
+    const raw = await readFile(path, "utf-8");
+    return { raw, dna: parseDNAContent(path, raw) };
+}
+export async function expandDNAInputs(files, options) {
+    const cwd = options?.cwd ?? process.cwd();
+    const ordered = [];
+    const seen = new Set();
+    const diagnostics = [];
+    const provenance = new Map();
+    const stack = [];
+    const visit = async (file, ref, inheritedBy, trust) => {
+        const abs = resolve(cwd, file);
+        if (stack.includes(abs)) {
+            diagnostics.push({
+                severity: "error",
+                code: "inheritance_cycle",
+                message: `DNA inheritance cycle detected: ${[...stack, abs].join(" -> ")}`,
+                file: abs,
+            });
+            return;
+        }
+        if (seen.has(abs))
+            return;
+        let loaded;
+        try {
+            loaded = await readDNAWithRaw(abs);
+        }
+        catch (error) {
+            diagnostics.push({
+                severity: "error",
+                code: "inheritance_unresolved",
+                message: `Unable to resolve inherited DNA reference '${ref}': ${error instanceof Error ? error.message : String(error)}`,
+                file: inheritedBy ?? abs,
+            });
+            return;
+        }
+        stack.push(abs);
+        for (const inheritRef of loaded.dna.cascade?.inherits ?? []) {
+            const speciesPath = resolveSpeciesReference(inheritRef);
+            if (speciesPath) {
+                await visit(speciesPath, inheritRef, abs, "builtin");
+                continue;
+            }
+            const fileRef = resolveFileReference(inheritRef, abs);
+            if (fileRef.path) {
+                await visit(fileRef.path, inheritRef, abs, fileRef.trust);
+                continue;
+            }
+            const enterpriseRef = await resolveEnterpriseReference(inheritRef, cwd, options);
+            if (enterpriseRef.path) {
+                await visit(enterpriseRef.path, inheritRef, abs, enterpriseRef.trust);
+                continue;
+            }
+            if (inheritRef.startsWith("enterprise:") || inheritRef.startsWith("file:")) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "inheritance_unresolved",
+                    message: `Unable to resolve inherited DNA reference '${inheritRef}'`,
+                    file: abs,
+                    path: "cascade.inherits",
+                });
+            }
+        }
+        stack.pop();
+        seen.add(abs);
+        ordered.push(abs);
+        provenance.set(abs, {
+            source_id: loaded.dna.id,
+            source_ref: ref,
+            resolved_path: abs,
+            fingerprint: fingerprint(loaded.raw),
+            type: loaded.dna.type,
+            cascade_priority: loaded.dna.cascade.priority,
+            version: loaded.dna.version,
+            trust: trust ?? sourceTrustForInput(abs, ref, cwd),
+            inherited_by: inheritedBy,
+            genes: Object.keys(loaded.dna.genes ?? {}).sort(),
+        });
+    };
+    for (const file of files) {
+        await visit(resolve(cwd, file), file, undefined, "input");
+    }
+    if (hasDiagnosticErrors(diagnostics)) {
+        throw new DNADiagnosticsError("DNA inheritance resolution failed", diagnostics);
+    }
+    return { files: ordered, provenance: ordered.map((file) => provenance.get(file)).filter(Boolean), diagnostics };
+}
+export async function expandDNAInputFiles(files, options) {
+    return (await expandDNAInputs(files, options)).files;
+}
+export async function checkNamespaceCollisions(configPaths) {
+    const diagnostics = [];
+    const namespaces = new Map();
+    for (const configPath of configPaths) {
+        try {
+            const data = await parseDNAFile(configPath);
+            const namespace = typeof data.namespace === "string" ? data.namespace : undefined;
+            if (!namespace)
+                continue;
+            const previous = namespaces.get(namespace);
+            if (previous) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "namespace_conflict",
+                    message: `Namespace "${namespace}" conflict: ${previous} and ${configPath}. Each template must have a unique namespace.`,
+                    file: configPath,
+                });
+            }
+            else {
+                namespaces.set(namespace, configPath);
+            }
+        }
+        catch {
+            // Parse/validation errors are reported by the load step.
+        }
+    }
+    return diagnostics;
+}
+export async function assertNoNamespaceCollisions(configPaths) {
+    const diagnostics = await checkNamespaceCollisions(configPaths);
+    if (diagnostics.length > 0) {
+        throw new DNADiagnosticsError(diagnostics[0].message, diagnostics);
+    }
+}
+export async function loadDNAWithDiagnostics(filePath) {
+    const diagnostics = [];
+    try {
+        const dna = await parseDNAFile(filePath);
+        const result = validateDNA(dna);
+        for (const warning of result.warnings ?? []) {
+            diagnostics.push({
+                severity: "warning",
+                code: "schema_warning",
+                message: warning.message,
+                file: filePath,
+                path: warning.path,
+            });
+        }
+        for (const error of result.errors) {
+            diagnostics.push({
+                severity: "error",
+                code: "schema_error",
+                message: error.message,
+                file: filePath,
+                path: error.path,
+            });
+        }
+        return { dna: result.valid ? dna : undefined, diagnostics };
+    }
+    catch (error) {
+        diagnostics.push({
+            severity: "error",
+            code: "parse_error",
+            message: error instanceof Error ? error.message : String(error),
+            file: filePath,
+        });
+        return { diagnostics };
+    }
+}
+export async function resolveDNAInputs(files, options) {
+    const cwd = options?.cwd ?? process.cwd();
+    const inputFiles = files.length > 0 ? files : await detectDNAConfigs(cwd);
+    const expandedFiles = await expandDNAInputFiles(inputFiles, { cwd });
+    const diagnostics = await checkNamespaceCollisions(expandedFiles);
+    const dnas = [];
+    for (const file of expandedFiles) {
+        const result = await loadDNAWithDiagnostics(file);
+        diagnostics.push(...result.diagnostics);
+        if (result.dna)
+            dnas.push(result.dna);
+    }
+    if (hasDiagnosticErrors(diagnostics)) {
+        throw new DNADiagnosticsError("DNA input resolution failed", diagnostics);
+    }
+    return { files: expandedFiles, dnas, diagnostics };
+}

package/dist/compiler/provenance.d.ts

@@ -0,0 +1,8 @@
+import type { CascadeLayerProvenance, ConstraintIR, ConstraintProvenance, DNASourceProvenance, ProvenanceCascadeLayerName } from "../schema/types.js";
+export declare const PROVENANCE_SCHEMA_VERSION: "intentdna.provenance.v1.7.2";
+export declare const PROVENANCE_LAYERS: readonly ProvenanceCascadeLayerName[];
+export declare function hashString(content: string): string;
+export declare function hashObject(value: unknown): string;
+export declare function buildCascadeLayers(sources: DNASourceProvenance[]): Record<ProvenanceCascadeLayerName, CascadeLayerProvenance>;
+export declare function buildConstraintWinners(ir: ConstraintIR, sources: DNASourceProvenance[]): ConstraintProvenance[];
+export declare function attachProvenance(ir: ConstraintIR, sources: DNASourceProvenance[]): ConstraintIR;

package/dist/compiler/provenance.js

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+export const PROVENANCE_SCHEMA_VERSION = "intentdna.provenance.v1.7.2";
+export const PROVENANCE_LAYERS = [
+    "species",
+    "enterprise",
+    "project",
+    "personal",
+    "role",
+    "context",
+    "task",
+];
+function stable(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stable).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .filter(([key]) => key !== "compiled_ir_hash" && key !== "provenance" && key !== "compiled_at")
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stable(entry)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+export function hashString(content) {
+    return `sha256:${createHash("sha256").update(content, "utf-8").digest("hex")}`;
+}
+export function hashObject(value) {
+    return hashString(stable(value));
+}
+function placeholderLayer(layer) {
+    return {
+        layer,
+        source_id: "unknown",
+        source_ref: "unknown",
+        fingerprint: "unknown",
+        status: "unknown",
+    };
+}
+export function buildCascadeLayers(sources) {
+    const layers = Object.fromEntries(PROVENANCE_LAYERS.map((layer) => [layer, placeholderLayer(layer)]));
+    for (const layer of PROVENANCE_LAYERS) {
+        const layerSources = sources.filter((source) => source.type === layer);
+        if (layerSources.length === 0)
+            continue;
+        const fingerprint = hashObject(layerSources.map((source) => ({
+            source_id: source.source_id,
+            source_ref: source.source_ref,
+            fingerprint: source.fingerprint,
+            cascade_priority: source.cascade_priority,
+        })));
+        layers[layer] = {
+            layer,
+            source_id: layerSources.map((source) => source.source_id).join("+"),
+            source_ref: layerSources.map((source) => source.source_ref).join(","),
+            fingerprint,
+            status: "active",
+            sources: layerSources.map((source) => source.source_id),
+        };
+    }
+    return layers;
+}
+function sourceForGene(sources, geneId) {
+    return [...sources].reverse().find((source) => source.genes?.includes(geneId));
+}
+function constraintId(kind, sourceGene, discriminator) {
+    return `${kind}:${sourceGene || "unknown"}:${hashString(discriminator).slice("sha256:".length, "sha256:".length + 12)}`;
+}
+function actionFor(kind, constraint) {
+    if (constraint.action === "escalate")
+        return "escalate";
+    if (constraint.action === "warn")
+        return "warn";
+    if (kind === "post_validator")
+        return "validate";
+    return "block";
+}
+function constraintFrom(kind, constraint, sources) {
+    const sourceGene = constraint.source_gene ?? "unknown";
+    const originSource = constraint.origin
+        ? sources.find((source) => source.source_id === constraint.origin?.source_dna_id)
+        : undefined;
+    const source = originSource ?? sourceForGene(sources, sourceGene);
+    const discriminator = constraint.condition ?? constraint.target ?? constraint.check ?? stable(constraint);
+    const sourceLayer = (constraint.origin?.source_layer ?? source?.type);
+    const sourceDnaId = constraint.origin?.source_dna_id ?? source?.source_id;
+    return {
+        constraint_id: constraintId(kind, sourceGene, discriminator),
+        source_layer: sourceLayer ?? "unknown",
+        source_dna_id: sourceDnaId ?? "unknown",
+        gene_id: sourceGene,
+        codon_type: kind === "tool_filter" ? "repel" : kind === "post_validator" ? "sense" : "threshold",
+        action: actionFor(kind, constraint),
+        provenance_reason: sourceDnaId && sourceLayer
+            ? `${kind} '${discriminator}' compiled from ${sourceLayer} DNA '${sourceDnaId}'`
+            : `${kind} '${discriminator}' has no resolved source DNA`,
+    };
+}
+export function buildConstraintWinners(ir, sources) {
+    return [
+        ...ir.pre_execution_gates.map((gate) => constraintFrom("pre_gate", gate, sources)),
+        ...ir.tool_filters.map((filter) => constraintFrom("tool_filter", filter, sources)),
+        ...ir.post_execution_validators.map((validator) => constraintFrom("post_validator", validator, sources)),
+    ];
+}
+export function attachProvenance(ir, sources) {
+    const baseIR = {
+        ...ir,
+        provenance: undefined,
+        compiled_ir_hash: undefined,
+    };
+    const compiledHash = hashObject(baseIR);
+    const enterprise = sources.find((source) => source.type === "enterprise");
+    const manifest = {
+        schema_version: PROVENANCE_SCHEMA_VERSION,
+        policy_bundle_id: enterprise?.source_id ?? "unknown",
+        policy_bundle_version: enterprise?.version ?? "unknown",
+        sources,
+        cascade_layers: buildCascadeLayers(sources),
+        constraint_winners: buildConstraintWinners(ir, sources),
+        compiled_ir_hash: compiledHash,
+    };
+    return {
+        ...ir,
+        compiled_ir_hash: compiledHash,
+        provenance: manifest,
+    };
+}

package/dist/governance/index.d.ts

@@ -1,7 +1,8 @@
 /**
- * Intent DNA — Remote Governance Module
+ * Intent DNA — Governance Module
  *
- * Architecture reservation for Phase 7 enterprise governance.
- * Currently exports type definitions only — no runtime implementation.
+ * Exports the v1.7.1 enterprise evidence contract plus reserved remote governance interfaces.
  */
 export type { AuditReport, RemoteDNAPolicy, PolicyContent, PolicyScope, PolicyUpdate, GovernanceConfig, GovernanceClient, GovernanceResponse, GovernanceSubscription, } from "./types.js";
+export { CASCADE_LAYER_NAMES, RUNTIME_DECISION_EVENT_SCHEMA_VERSION, validateRuntimeDecisionEvent, } from "./runtime-decision-event.js";
+export type { CascadeDecisionTrace, CascadeLayerFingerprint, CascadeLayerName, CascadeLayers, EnforcementPoint, ExplicitPlaceholder, HarnessRuntimeContext, PolicyBundle, RuntimeDecision, RuntimeDecisionEvent, RuntimeDecisionEventValidationResult, RuntimeEvidenceRef, WinningConstraint, } from "./runtime-decision-event.js";

package/dist/governance/index.js

@@ -1,7 +1,6 @@
 /**
- * Intent DNA — Remote Governance Module
+ * Intent DNA — Governance Module
  *
- * Architecture reservation for Phase 7 enterprise governance.
- * Currently exports type definitions only — no runtime implementation.
+ * Exports the v1.7.1 enterprise evidence contract plus reserved remote governance interfaces.
  */
-export {};
+export { CASCADE_LAYER_NAMES, RUNTIME_DECISION_EVENT_SCHEMA_VERSION, validateRuntimeDecisionEvent, } from "./runtime-decision-event.js";

package/dist/governance/runtime-decision-event.d.ts

@@ -0,0 +1,85 @@
+export declare const RUNTIME_DECISION_EVENT_SCHEMA_VERSION: "intentdna.runtime_decision_event.v1.7.1";
+export declare const CASCADE_LAYER_NAMES: readonly ["species", "enterprise", "project", "personal", "role", "context", "task"];
+export type ExplicitPlaceholder = "unknown" | "unsupported";
+export type RuntimeDecision = "allow" | "warn" | "block" | "escalate" | "validate";
+export type EnforcementPoint = "hook" | "sdk" | "ci" | "plugin_runtime" | "mcp_external_write" | ExplicitPlaceholder;
+export type CascadeLayerName = typeof CASCADE_LAYER_NAMES[number];
+export type RuntimeEvidenceRefType = "trace" | "audit" | "artifact" | "verifier" | "handoff" | "legacy" | ExplicitPlaceholder;
+export interface PolicyBundle {
+    policy_bundle_id: string;
+    policy_bundle_version: string;
+    source_ref: string;
+    fingerprint: string;
+}
+export interface CascadeLayerFingerprint {
+    layer: CascadeLayerName;
+    source_id: string;
+    source_ref: string;
+    fingerprint: string;
+    status: "active" | ExplicitPlaceholder;
+}
+export type CascadeLayers = Record<CascadeLayerName, CascadeLayerFingerprint>;
+export interface WinningConstraint {
+    constraint_id: string;
+    source_layer: CascadeLayerName | ExplicitPlaceholder;
+    source_dna_id: string;
+    gene_id: string;
+    codon_type: string;
+    action: RuntimeDecision;
+    provenance_reason: string;
+}
+export interface CascadeDecisionTrace {
+    cascade_layers: CascadeLayers;
+    winning_constraint: WinningConstraint;
+    compiled_ir_hash: string;
+    decision_reason: string;
+}
+export interface RuntimeEvidenceRef {
+    type: RuntimeEvidenceRefType;
+    ref: string;
+}
+export interface HarnessRuntimeContext {
+    agent_id: string;
+    agent_role: string;
+    agent_type: string;
+    session_agent: string;
+    harness_adapter: string;
+    runtime: string;
+}
+export interface RuntimeDecisionEvent {
+    schema_version: typeof RUNTIME_DECISION_EVENT_SCHEMA_VERSION;
+    event_id: string;
+    timestamp: string;
+    org_id: string;
+    team_id: string;
+    user_id: string;
+    project_id: string;
+    agent_id: string;
+    agent_role: string;
+    agent_type: string;
+    session_agent: string;
+    harness_adapter: string;
+    runtime: string;
+    policy_bundle_id: string;
+    policy_bundle_version: string;
+    cascade_layers: CascadeLayers;
+    winning_constraint: WinningConstraint;
+    compiled_ir_hash: string;
+    decision: RuntimeDecision;
+    decision_reason: string;
+    enforcement_point: EnforcementPoint;
+    harness_runtime_context: HarnessRuntimeContext;
+    session_id: string;
+    run_id: string;
+    step_id: string;
+    tool_name: string;
+    action_kind: string;
+    resource_ref: string;
+    evidence_refs: RuntimeEvidenceRef[];
+}
+export interface RuntimeDecisionEventValidationResult {
+    valid: boolean;
+    classification: "enterprise_evidence" | "legacy_diagnostic";
+    errors: string[];
+}
+export declare function validateRuntimeDecisionEvent(event: unknown): RuntimeDecisionEventValidationResult;