Add aggregate semantics to Policy Compiler

conformance/testdata/aggregate/config.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate"
+variables:
+  - name: "resource"
+    type_name: "map"
+    params:
+      - type_name: "string"
+      - type_name: "dyn"

conformance/testdata/aggregate/policy.yaml

@@ -0,0 +1,26 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate
+rule:
+  aggregate:
+    - condition: "resource.is_pii == true"
+      emit: "'PII'"
+    - condition: "resource.is_confidential == true"
+      emit: "'CONFIDENTIAL'"
+    - condition: "true"
+      rule:
+        match:
+          - condition: "resource.nested_cond == true"
+            output: "'NESTED'"

conformance/testdata/aggregate/tests.yaml

@@ -0,0 +1,42 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Aggregate semantic conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "all_match_nested_triggered"
+        input:
+          resource:
+            expr: "{'is_pii': true, 'is_confidential': true, 'nested_cond': true}"
+        output:
+          expr: "['PII', 'CONFIDENTIAL', 'NESTED']"
+      - name: "all_match_nested_fallback"
+        input:
+          resource:
+            expr: "{'is_pii': true, 'is_confidential': true, 'nested_cond': false}"
+        output:
+          expr: "['PII', 'CONFIDENTIAL']"
+      - name: "some_match"
+        input:
+          resource:
+            expr: "{'is_pii': true, 'is_confidential': false, 'nested_cond': false}"
+        output:
+          expr: "['PII']"
+      - name: "none_match"
+        input:
+          resource:
+            expr: "{'is_pii': false, 'is_confidential': false, 'nested_cond': false}"
+        output:
+          expr: "[]"

conformance/testdata/aggregate_explicit_list_output/policy.yaml

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_explicit_list_output
+rule:
+  aggregate:
+    - condition: "true"
+      emit: "['tag1', 'tag2']"

conformance/testdata/aggregate_explicit_list_output/tests.yaml

@@ -0,0 +1,22 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Explicit list output conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "all_match"
+        input: {}
+        output:
+          expr: "[['tag1', 'tag2']]"

conformance/testdata/aggregate_explicit_optional_none/policy.yaml

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_explicit_optional_none
+rule:
+  aggregate:
+    - condition: "true"
+      emit: "optional.none()"

conformance/testdata/aggregate_explicit_optional_none/tests.yaml

@@ -0,0 +1,22 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Explicit optional none conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "all_match"
+        input: {}
+        output:
+          expr: "[optional.none()]"

conformance/testdata/aggregate_nested_explicit_list_double_wrapping/policy.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_nested_explicit_list_double_wrapping
+rule:
+  aggregate:
+    - rule:
+        match:
+          - condition: "true"
+            output: "['tag1', 'tag2']"

conformance/testdata/aggregate_nested_explicit_list_double_wrapping/tests.yaml

@@ -0,0 +1,22 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate_nested_explicit_list_double_wrapping"
+description: "Tests that aggregate policies cleanly support double-wrapped lists when a nested first_match rule returns an explicit list literal"
+sections:
+- name: "compile"
+  tests:
+  - name: "nested_explicit_list"
+    output:
+      value: [["tag1", "tag2"]]

conformance/testdata/aggregate_shadowed_variables/config.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate_shadowed_variables"
+variables:
+  - name: "resource"
+    type_name: "map"
+    params:
+      - type_name: "string"
+      - type_name: "dyn"

conformance/testdata/aggregate_shadowed_variables/policy.yaml

@@ -0,0 +1,30 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_shadowed_variables
+rule:
+  variables:
+    - name: "x"
+      expression: "10"
+  aggregate:
+    - condition: "resource.cond1 == true"
+      emit: "variables.x"
+    - condition: "resource.cond2 == true"
+      rule:
+        variables:
+          - name: "x"
+            expression: "20"
+        match:
+          - condition: "true"
+            output: "variables.x"

conformance/testdata/aggregate_shadowed_variables/tests.yaml

@@ -0,0 +1,24 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Shadowed variables conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "shadowed_in_nested_rule"
+        input:
+          resource:
+            expr: "{'cond1': true, 'cond2': true}"
+        output:
+          expr: "[10, 20]"

conformance/testdata/compile_errors/aggregate_errors/config.yaml

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate_errors"
+variables:
+  - name: cond
+    type:
+      type_name: "bool"

conformance/testdata/compile_errors/aggregate_errors/policy.yaml

@@ -0,0 +1,24 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_errors
+rule:
+  aggregate:
+    - condition: "cond"
+      rule:
+        match:
+          - condition: "cond"
+            output: "optional.of('USER_PII')"
+          - condition: "true"
+            output: "403"

conformance/testdata/compile_errors/aggregate_false_condition/policy.yaml

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_false_condition
+rule:
+  aggregate:
+    - condition: "false"
+      emit: "'FALSE'"

conformance/testdata/compile_errors/aggregate_false_condition/tests.yaml

@@ -0,0 +1,23 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate_false_condition"
+description: "Tests for false condition in aggregate policy"
+sections:
+- name: "compile"
+  tests:
+  - name: "false_condition"
+    output:
+      error_set:
+      - "condition is always false"