@sema-agent/core/dist/core/rule-denial-sentence.d.ts

Stateless, task-oriented AI agent core

/**
 * The ONE mint for "a rule refused this call".
 *
 * WHY IT EXISTS. The engine has two rule stores that can refuse a tool call — the per-session policy rows
 * a deployment writes against a session id, and the declarative permission rules compiled from a settings
 * layer — and each used to spell its refusal in its own grammar at its own site: `tool "X" is denied by a
 * session rule` beside `denied by permission rule "R" (layer)`, with the session lane's four containment
 * arms in three further shapes and the resumed-execution re-check asserting a source ("a session rule")
 * that was only ever one of the narrowing layers it speaks for. A consumer reading those strings could not
 * tell WHICH store had spoken, which is precisely the confusion that produced the wrong answer to "is the
 * rule store re-read at every gate?" — the two stores were being described as one.
 *
 * So: one grammar, one vocabulary of sources, one place to change either.
 */
/**
 * The closed vocabulary of rule sources a refusal may name, each with the two spellings the sentence needs:
 * `bare` when the source has no rule text to quote, `named` when it does. The type is DERIVED from this
 * table, so a source without its spellings is not expressible and no fence is needed to say so.
 *
 * The words are the ENGINE'S rule-bearing faces, not a settings layer's (`source`/`origin` are different
 * questions: WHICH STORE spoke, versus WHERE in that store's layering the row was written — the second
 * rides `origin`).
 */
declare const RULE_SOURCE_PHRASE: {
    /** The per-session policy rows (`SessionPolicyStore`), folded in as a deny-narrowing layer. */
    readonly session: {
        readonly bare: "a session rule";
        readonly named: "session rule";
    };
    /** The declarative permission rules compiled from a deployment's settings layers. */
    readonly permission: {
        readonly bare: "a permission rule";
        readonly named: "permission rule";
    };
    /**
     * The deny-narrowing fold as a WHOLE — session rules, inherited ancestor rules and the frozen constraint
     * projections. Used where the refusing layer's own sentence is carried as the
     * detail and the wrapper must not claim to know which of them spoke.
     */
    readonly narrowing: {
        readonly bare: "a narrowing policy layer";
        readonly named: "narrowing policy layer";
    };
};
/** A rule-bearing face that can refuse a call ({@link RULE_SOURCE_PHRASE} holds the whole vocabulary). */
export type RuleDenialSource = keyof typeof RULE_SOURCE_PHRASE;
/** How a refusal names `source` in prose, with no rule text to quote — for a sentence this module does not
 *  mint whole (a wrapper that carries the refusing layer's own sentence as its body). */
export declare function ruleSourcePhrase(source: RuleDenialSource): string;
/**
 * Mint the refusal.
 *
 * @contract rule_denial.one_sentence — every refusal a RULE STORE mints reads
 * `[tool "<tool>" is ]denied by <source>[ "<rule>"][ (<origin>)][: <detail>]`, composed here and nowhere
 * else: the call is named first, then WHICH rule-bearing face refused (from the closed source vocabulary),
 * then the rule's own text and the layer it was written in where the source has them, and last the reason
 * this call failed the rule. A consumer reading a refusal can therefore always tell the session-policy
 * store's answer from the permission rules' — and a carrier sentence that already named the call omits the
 * head rather than spelling a second grammar.
 *
 * - `tool` — named when the sentence stands alone; omitted when a carrier sentence already named the call.
 * - `rule` — the rule's own text, when the source has one to quote (a permission rule does; a session
 *   policy row is structured fields, not a rule DSL, so it does not).
 * - `origin` — where in that store's layering the row was written (e.g. a settings layer's key path).
 * - `detail` — WHY this call failed the rule, when the source word alone does not say it (an allowlist
 *   miss, a write the confinement cannot place, the refusing layer's own sentence).
 */
export declare function ruleDenialSentence(spec: {
    source: RuleDenialSource;
    tool?: string;
    rule?: string;
    origin?: string;
    detail?: string;
}): string;
export {};