@armoriq/policy-ir
The Armor Policy v2 intermediate representation, shared by every runtime that evaluates a policy: conmap, the Armor CLI daemon, the SDK pre-check and OPA.
The IR is data, never a program. One canonical serialization and one
policyHash make it the hashing and signing boundary; one golden-vector suite,
exported from this package, is what every evaluator must pass before release.
What is here
| Export | Purpose |
|---|---|
PolicyDocument, Statement, … | the armor.policy.v2 types |
canonicalJson(value) | sorted keys, compact, ASCII escapes; the platform's one hashing rule |
policyHash(document) | sha256: over the canonical document without policyHash |
schemaHash(inputSchema) | sha256: over the canonicalized tool input schema, as the SDKs and the tool inventory compute it |
@armoriq/policy-ir/vectors | the fixtures: canonical forms, policy hashes, schema hashes |
@armoriq/policy-ir/document | parseYaml, parseDocument, validate, serialize, the glob helpers matchGlob and isGlob, the compose types and the source grammar types, with no Node built-ins, for browsers |
C0 is complete in this package; the conmap binding of the inventory port and the compile endpoint follow in conmap-auto.
Vectors
vectors/*.json are generated by npm run vectors:generate and committed. The
evaluation vectors are authored expectations; generation fails if the evaluator
disagrees with one, so a wrong expectation cannot be pinned by accident.
CI fails if regenerating them changes anything. A consumer asserts equality
against them; it never edits them.
Development
npm ci
npm run check # lint, typecheck, test, build, smoke (ESM and CJS consumers)
Every function is held under a cyclomatic complexity of 10 by lint. Releases
are tags vX.Y.Z matching package.json; the publish workflow runs the full
check before npm publish.