@cullet/erp-core 1.0.5 → 1.0.7

package/dist/outcome.js.map

@@ -1 +1 @@
-{"version":3,"file":"outcome.js","names":[],"sources":["../src/core/result/outcome.ts"],"sourcesContent":["// core/domain/outcome.ts\n\nimport { InvariantViolationException } from \"../exceptions/invariant-violation-exception\";\n\n/**\n * Outcome — Business decision abstraction.\n *\n * Represents the semantic result of a domain decision, policy evaluation,\n * or business rule. NOT for technical success/failure — use Result for that.\n *\n * Mental model:\n *   \"What was the business decision?\"\n *   NOT \"Did the operation succeed?\"\n *\n * The status axis represents valid business outcomes (APPROVED, REJECTED,\n * ALLOW, DENY, NO_OP, etc.), never technical Ok/Err.\n *\n * @typeParam S - Union of valid status literals for this outcome\n * @typeParam D - Shape of the decision data carried by this outcome\n */\nexport class Outcome<S extends string, D = undefined> {\n    readonly status: S;\n    readonly data: D;\n    readonly reason: string | undefined;\n    readonly metadata: Readonly<Record<string, unknown>>;\n\n    private constructor(\n        status: S,\n        data: D,\n        reason: string | undefined,\n        metadata: Readonly<Record<string, unknown>>,\n    ) {\n        this.status = status;\n        this.data = data;\n        this.reason = reason;\n        this.metadata = metadata;\n        Object.freeze(this);\n    }\n\n    // ─── Generic factory ────────────────────────────────────────────────\n\n    static of<S extends string, D = undefined>(\n        status: S,\n        data: D,\n        reason?: string,\n        metadata?: Record<string, unknown>,\n    ): Outcome<S, D> {\n        return new Outcome(\n            status,\n            data,\n            reason,\n            Object.freeze({ ...metadata }),\n        );\n    }\n\n    // ─── Convenience factories for common business statuses ─────────────\n\n    static approved<D = undefined>(\n        data: D,\n        reason?: string,\n    ): Outcome<\"APPROVED\", D> {\n        return new Outcome(\"APPROVED\", data, reason, Object.freeze({}));\n    }\n\n    static rejected<D = undefined>(\n        data: D,\n        reason: string,\n    ): Outcome<\"REJECTED\", D> {\n        return new Outcome(\"REJECTED\", data, reason, Object.freeze({}));\n    }\n\n    static noOp<D = undefined>(data: D, reason?: string): Outcome<\"NO_OP\", D> {\n        return new Outcome(\"NO_OP\", data, reason, Object.freeze({}));\n    }\n\n    static deferred<D = undefined>(\n        data: D,\n        reason: string,\n    ): Outcome<\"DEFERRED\", D> {\n        return new Outcome(\"DEFERRED\", data, reason, Object.freeze({}));\n    }\n\n    static requiresReview<D = undefined>(\n        data: D,\n        reason: string,\n    ): Outcome<\"REQUIRES_REVIEW\", D> {\n        return new Outcome(\"REQUIRES_REVIEW\", data, reason, Object.freeze({}));\n    }\n\n    // ─── Type narrowing ────────────────────────────────────────────────\n\n    /**\n     * Narrows this Outcome to a specific status.\n     *\n     * @example\n     * if (outcome.is('DENY')) {\n     *   outcome.data.violations // TS knows status is 'DENY'\n     * }\n     */\n    is<T extends S>(status: T): this is Outcome<T, D> {\n        return (this.status as string) === status;\n    }\n\n    // ─── Exhaustive match ──────────────────────────────────────────────\n\n    /**\n     * Exhaustive pattern match over all possible statuses.\n     * TypeScript enforces that every status has a handler.\n     *\n     * @example\n     * outcome.match({\n     *   ALLOW: (o) => handleAllow(o.data),\n     *   DENY:  (o) => handleDeny(o.data.violations),\n     * })\n     */\n    match<THandlers extends { [K in S]: (outcome: Outcome<K, D>) => unknown }>(\n        handlers: THandlers,\n    ): ReturnType<THandlers[S]> {\n        const handler = (\n            handlers as Partial<Record<string, (o: unknown) => unknown>>\n        )[this.status];\n\n        if (typeof handler !== \"function\") {\n            const availableStatuses = Object.keys(handlers);\n            throw new InvariantViolationException(\n                `Outcome.match is missing a handler for runtime status \"${this.status}\". Available handlers: ${availableStatuses.join(\", \") || \"(none)\"}`,\n            );\n        }\n\n        return handler(this) as ReturnType<THandlers[S]>;\n    }\n\n    // ─── Derived copies ────────────────────────────────────────────────\n\n    withMetadata(extra: Record<string, unknown>): Outcome<S, D> {\n        return new Outcome(\n            this.status,\n            this.data,\n            this.reason,\n            Object.freeze({ ...this.metadata, ...extra }),\n        );\n    }\n\n    withReason(reason: string): Outcome<S, D> {\n        return new Outcome(this.status, this.data, reason, this.metadata);\n    }\n\n    // ─── Debug ─────────────────────────────────────────────────────────\n\n    toString(): string {\n        const parts: string[] = [this.status];\n        if (this.reason) parts.push(`reason=\"${this.reason}\"`);\n        return `Outcome(${parts.join(\", \")})`;\n    }\n}\n\n/** Common business outcome statuses. Extend per domain as needed. */\nexport type CommonOutcomeStatus =\n    | \"APPROVED\"\n    | \"REJECTED\"\n    | \"NO_OP\"\n    | \"DEFERRED\"\n    | \"REQUIRES_REVIEW\";\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,IAAa,UAAb,MAAa,QAAyC;CAMlD,YACI,QACA,MACA,QACA,UACF;EACE,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,WAAW;EAChB,OAAO,OAAO,IAAI;CACtB;CAIA,OAAO,GACH,QACA,MACA,QACA,UACa;EACb,OAAO,IAAI,QACP,QACA,MACA,QACA,OAAO,OAAO,EAAE,GAAG,SAAS,CAAC,CACjC;CACJ;CAIA,OAAO,SACH,MACA,QACsB;EACtB,OAAO,IAAI,QAAQ,YAAY,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAClE;CAEA,OAAO,SACH,MACA,QACsB;EACtB,OAAO,IAAI,QAAQ,YAAY,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAClE;CAEA,OAAO,KAAoB,MAAS,QAAsC;EACtE,OAAO,IAAI,QAAQ,SAAS,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAC/D;CAEA,OAAO,SACH,MACA,QACsB;EACtB,OAAO,IAAI,QAAQ,YAAY,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAClE;CAEA,OAAO,eACH,MACA,QAC6B;EAC7B,OAAO,IAAI,QAAQ,mBAAmB,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CACzE;;;;;;;;;CAYA,GAAgB,QAAkC;EAC9C,OAAQ,KAAK,WAAsB;CACvC;;;;;;;;;;;CAcA,MACI,UACwB;EACxB,MAAM,UACF,SACF,KAAK;EAEP,IAAI,OAAO,YAAY,YAAY;GAC/B,MAAM,oBAAoB,OAAO,KAAK,QAAQ;GAC9C,MAAM,IAAI,4BACN,0DAA0D,KAAK,OAAO,yBAAyB,kBAAkB,KAAK,IAAI,KAAK,UACnI;EACJ;EAEA,OAAO,QAAQ,IAAI;CACvB;CAIA,aAAa,OAA+C;EACxD,OAAO,IAAI,QACP,KAAK,QACL,KAAK,MACL,KAAK,QACL,OAAO,OAAO;GAAE,GAAG,KAAK;GAAU,GAAG;EAAM,CAAC,CAChD;CACJ;CAEA,WAAW,QAA+B;EACtC,OAAO,IAAI,QAAQ,KAAK,QAAQ,KAAK,MAAM,QAAQ,KAAK,QAAQ;CACpE;CAIA,WAAmB;EACf,MAAM,QAAkB,CAAC,KAAK,MAAM;EACpC,IAAI,KAAK,QAAQ,MAAM,KAAK,WAAW,KAAK,OAAO,EAAE;EACrD,OAAO,WAAW,MAAM,KAAK,IAAI,EAAE;CACvC;AACJ"}
+{"version":3,"file":"outcome.js","names":[],"sources":["../src/core/result/outcome.ts"],"sourcesContent":["// core/domain/outcome.ts\n\nimport { InvariantViolationException } from \"../exceptions/invariant-violation-exception.js\";\n\n/**\n * Outcome — Business decision abstraction.\n *\n * Represents the semantic result of a domain decision, policy evaluation,\n * or business rule. NOT for technical success/failure — use Result for that.\n *\n * Mental model:\n *   \"What was the business decision?\"\n *   NOT \"Did the operation succeed?\"\n *\n * The status axis represents valid business outcomes (APPROVED, REJECTED,\n * ALLOW, DENY, NO_OP, etc.), never technical Ok/Err.\n *\n * @typeParam S - Union of valid status literals for this outcome\n * @typeParam D - Shape of the decision data carried by this outcome\n */\nexport class Outcome<S extends string, D = undefined> {\n    readonly status: S;\n    readonly data: D;\n    readonly reason: string | undefined;\n    readonly metadata: Readonly<Record<string, unknown>>;\n\n    private constructor(\n        status: S,\n        data: D,\n        reason: string | undefined,\n        metadata: Readonly<Record<string, unknown>>,\n    ) {\n        this.status = status;\n        this.data = data;\n        this.reason = reason;\n        this.metadata = metadata;\n        Object.freeze(this);\n    }\n\n    // ─── Generic factory ────────────────────────────────────────────────\n\n    static of<S extends string, D = undefined>(\n        status: S,\n        data: D,\n        reason?: string,\n        metadata?: Record<string, unknown>,\n    ): Outcome<S, D> {\n        return new Outcome(\n            status,\n            data,\n            reason,\n            Object.freeze({ ...metadata }),\n        );\n    }\n\n    // ─── Convenience factories for common business statuses ─────────────\n\n    static approved<D = undefined>(\n        data: D,\n        reason?: string,\n    ): Outcome<\"APPROVED\", D> {\n        return new Outcome(\"APPROVED\", data, reason, Object.freeze({}));\n    }\n\n    static rejected<D = undefined>(\n        data: D,\n        reason: string,\n    ): Outcome<\"REJECTED\", D> {\n        return new Outcome(\"REJECTED\", data, reason, Object.freeze({}));\n    }\n\n    static noOp<D = undefined>(data: D, reason?: string): Outcome<\"NO_OP\", D> {\n        return new Outcome(\"NO_OP\", data, reason, Object.freeze({}));\n    }\n\n    static deferred<D = undefined>(\n        data: D,\n        reason: string,\n    ): Outcome<\"DEFERRED\", D> {\n        return new Outcome(\"DEFERRED\", data, reason, Object.freeze({}));\n    }\n\n    static requiresReview<D = undefined>(\n        data: D,\n        reason: string,\n    ): Outcome<\"REQUIRES_REVIEW\", D> {\n        return new Outcome(\"REQUIRES_REVIEW\", data, reason, Object.freeze({}));\n    }\n\n    // ─── Type narrowing ────────────────────────────────────────────────\n\n    /**\n     * Narrows this Outcome to a specific status.\n     *\n     * @example\n     * if (outcome.is('DENY')) {\n     *   outcome.data.violations // TS knows status is 'DENY'\n     * }\n     */\n    is<T extends S>(status: T): this is Outcome<T, D> {\n        return (this.status as string) === status;\n    }\n\n    // ─── Exhaustive match ──────────────────────────────────────────────\n\n    /**\n     * Exhaustive pattern match over all possible statuses.\n     * TypeScript enforces that every status has a handler.\n     *\n     * @example\n     * outcome.match({\n     *   ALLOW: (o) => handleAllow(o.data),\n     *   DENY:  (o) => handleDeny(o.data.violations),\n     * })\n     */\n    match<THandlers extends { [K in S]: (outcome: Outcome<K, D>) => unknown }>(\n        handlers: THandlers,\n    ): ReturnType<THandlers[S]> {\n        const handler = (\n            handlers as Partial<Record<string, (o: unknown) => unknown>>\n        )[this.status];\n\n        if (typeof handler !== \"function\") {\n            const availableStatuses = Object.keys(handlers);\n            throw new InvariantViolationException(\n                `Outcome.match is missing a handler for runtime status \"${this.status}\". Available handlers: ${availableStatuses.join(\", \") || \"(none)\"}`,\n            );\n        }\n\n        return handler(this) as ReturnType<THandlers[S]>;\n    }\n\n    // ─── Derived copies ────────────────────────────────────────────────\n\n    withMetadata(extra: Record<string, unknown>): Outcome<S, D> {\n        return new Outcome(\n            this.status,\n            this.data,\n            this.reason,\n            Object.freeze({ ...this.metadata, ...extra }),\n        );\n    }\n\n    withReason(reason: string): Outcome<S, D> {\n        return new Outcome(this.status, this.data, reason, this.metadata);\n    }\n\n    // ─── Debug ─────────────────────────────────────────────────────────\n\n    toString(): string {\n        const parts: string[] = [this.status];\n        if (this.reason) parts.push(`reason=\"${this.reason}\"`);\n        return `Outcome(${parts.join(\", \")})`;\n    }\n}\n\n/** Common business outcome statuses. Extend per domain as needed. */\nexport type CommonOutcomeStatus =\n    | \"APPROVED\"\n    | \"REJECTED\"\n    | \"NO_OP\"\n    | \"DEFERRED\"\n    | \"REQUIRES_REVIEW\";\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,IAAa,UAAb,MAAa,QAAyC;CAMlD,YACI,QACA,MACA,QACA,UACF;EACE,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,WAAW;EAChB,OAAO,OAAO,IAAI;CACtB;CAIA,OAAO,GACH,QACA,MACA,QACA,UACa;EACb,OAAO,IAAI,QACP,QACA,MACA,QACA,OAAO,OAAO,EAAE,GAAG,SAAS,CAAC,CACjC;CACJ;CAIA,OAAO,SACH,MACA,QACsB;EACtB,OAAO,IAAI,QAAQ,YAAY,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAClE;CAEA,OAAO,SACH,MACA,QACsB;EACtB,OAAO,IAAI,QAAQ,YAAY,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAClE;CAEA,OAAO,KAAoB,MAAS,QAAsC;EACtE,OAAO,IAAI,QAAQ,SAAS,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAC/D;CAEA,OAAO,SACH,MACA,QACsB;EACtB,OAAO,IAAI,QAAQ,YAAY,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAClE;CAEA,OAAO,eACH,MACA,QAC6B;EAC7B,OAAO,IAAI,QAAQ,mBAAmB,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CACzE;;;;;;;;;CAYA,GAAgB,QAAkC;EAC9C,OAAQ,KAAK,WAAsB;CACvC;;;;;;;;;;;CAcA,MACI,UACwB;EACxB,MAAM,UACF,SACF,KAAK;EAEP,IAAI,OAAO,YAAY,YAAY;GAC/B,MAAM,oBAAoB,OAAO,KAAK,QAAQ;GAC9C,MAAM,IAAI,4BACN,0DAA0D,KAAK,OAAO,yBAAyB,kBAAkB,KAAK,IAAI,KAAK,UACnI;EACJ;EAEA,OAAO,QAAQ,IAAI;CACvB;CAIA,aAAa,OAA+C;EACxD,OAAO,IAAI,QACP,KAAK,QACL,KAAK,MACL,KAAK,QACL,OAAO,OAAO;GAAE,GAAG,KAAK;GAAU,GAAG;EAAM,CAAC,CAChD;CACJ;CAEA,WAAW,QAA+B;EACtC,OAAO,IAAI,QAAQ,KAAK,QAAQ,KAAK,MAAM,QAAQ,KAAK,QAAQ;CACpE;CAIA,WAAmB;EACf,MAAM,QAAkB,CAAC,KAAK,MAAM;EACpC,IAAI,KAAK,QAAQ,MAAM,KAAK,WAAW,KAAK,OAAO,EAAE;EACrD,OAAO,WAAW,MAAM,KAAK,IAAI,EAAE;CACvC;AACJ"}

package/dist/policies/engines/v1/gate/index.d.ts

@@ -26,6 +26,8 @@ declare class ConditionEvaluatorV1 {
   private static buildNullishNumericOperandMessage;
   private static buildNullishDateOperandMessage;
   private static buildInvalidDateOperandMessage;
+  private static buildInvalidNumericOperandMessage;
+  private static buildInvalidSetOperandMessage;
   private static buildEmptyOrConditionMessage;
   private static buildEmptyAndConditionMessage;
   private static parseComparableDate;
@@ -33,6 +35,8 @@ declare class ConditionEvaluatorV1 {
   private buildReport;
   private conditionEvalErr;
   private reportDateOperandError;
+  private reportInvalidNumericOperand;
+  private reportInvalidSetOperand;
   private evaluateDateRelationalNode;
   private evaluateOperator;
   private evaluateNumericRelationalNode;

package/dist/policies/engines/v1/gate/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../../src/core/policies/engines/v1/gate/gate-engine-v1.ts"],"sourcesContent":["import { type CoreConfig, coreConfig } from \"../../../../config\";\nimport { Outcome } from \"../../../../result/outcome\";\nimport { Result } from \"../../../../result/result\";\n\nimport {\n    ConditionEvaluatorV1,\n    type TracedConditionEvaluation,\n} from \"../condition-evaluator\";\nimport type { ConditionLeafNode, ConditionNode } from \"../condition-types\";\nimport type { GatePayload } from \"../../gate-payload\";\nimport type {\n    GateOutcome,\n    GateStatus,\n    GateTraceLeafSnapshot,\n    GateTraceNodeSnapshot,\n    PolicyContext,\n    PolicyViolation,\n    VersionedGateEngine,\n} from \"../../gate-types\";\n\n// ─── Gate engine v1 ─────────────────────────────────────────────────────────\n\nexport class GateEngineV1 implements VersionedGateEngine {\n    public readonly version = 1;\n    private readonly coreConfig: CoreConfig;\n\n    constructor(params: { readonly coreConfig?: CoreConfig } = {}) {\n        this.coreConfig = params.coreConfig ?? coreConfig;\n    }\n\n    private allow(): Result<GateOutcome, string> {\n        return Result.ok(Outcome.of(\"ALLOW\", { violations: [] }));\n    }\n\n    private deny(violation: PolicyViolation): Result<GateOutcome, string> {\n        return Result.ok(\n            Outcome.of(\"DENY\", {\n                violations: [violation],\n            }),\n        );\n    }\n\n    private outcomeFromStatus(\n        status: GateStatus,\n        violation: PolicyViolation,\n    ): Result<GateOutcome, string> {\n        return status === \"ALLOW\" ? this.allow() : this.deny(violation);\n    }\n\n    private isLeafNode(node: ConditionNode): node is ConditionLeafNode {\n        return \"field\" in node && \"op\" in node;\n    }\n\n    private toLeafSnapshot(node: ConditionLeafNode): GateTraceLeafSnapshot {\n        return {\n            kind: \"LEAF\",\n            field: node.field,\n            op: node.op,\n            ...(node.allowNull === true ? { allowNull: true } : {}),\n        };\n    }\n\n    private toNodeSnapshot(node: ConditionNode): GateTraceNodeSnapshot {\n        if (this.isLeafNode(node)) {\n            return this.toLeafSnapshot(node);\n        }\n\n        if (\"and\" in node) {\n            return {\n                kind: \"AND\",\n                childCount: node.and.length,\n            };\n        }\n\n        if (\"or\" in node) {\n            return {\n                kind: \"OR\",\n                childCount: node.or.length,\n            };\n        }\n\n        return {\n            kind: \"NOT\",\n        };\n    }\n\n    private buildDenyViolation(\n        conditionResult: TracedConditionEvaluation,\n    ): PolicyViolation {\n        return {\n            code: \"DENY_CONDITION_MET\",\n            message: `Gate denied at ${conditionResult.trace.conditionPath}`,\n            trace: {\n                conditionPath: conditionResult.trace.conditionPath,\n                decisiveNode: this.toNodeSnapshot(\n                    conditionResult.trace.decisiveNode,\n                ),\n                lastEvaluatedLeaf: this.toLeafSnapshot(\n                    conditionResult.trace.lastEvaluatedLeaf,\n                ),\n                lastEvaluatedLeafPath:\n                    conditionResult.trace.lastEvaluatedLeafPath,\n                lastEvaluatedLeafResult:\n                    conditionResult.trace.lastEvaluatedLeafResult,\n                field: conditionResult.trace.lastEvaluatedLeaf.field,\n                op: conditionResult.trace.lastEvaluatedLeaf.op,\n            },\n        };\n    }\n\n    private normalizePayload(payload: GatePayload): {\n        readonly allowIf: ConditionNode;\n        readonly defaultOutcome: \"ALLOW\" | \"DENY\";\n    } {\n        if (\"condition\" in payload) {\n            return {\n                allowIf: payload.condition,\n                defaultOutcome: \"DENY\",\n            };\n        }\n\n        return payload;\n    }\n\n    /**\n     * Evaluates a GATE payload against a context object.\n     * Pure function — no side effects.\n     *\n     * Receives an already-parsed `GatePayload`; the registry is responsible\n     * for parsing from raw `unknown` before calling this method.\n     * Returns Result for technical failures (condition evaluation errors).\n     * The Outcome inside carries the business decision (ALLOW/DENY).\n     */\n    evaluate(\n        payload: GatePayload,\n        context: PolicyContext,\n    ): Result<GateOutcome, string> {\n        const gatePayload = this.normalizePayload(payload);\n        const conditionEvaluator = new ConditionEvaluatorV1(\n            context,\n            this.coreConfig.getConditionEvaluationOptions(this.version),\n        );\n\n        const isAllowedResult = conditionEvaluator.evaluateWithTrace(\n            gatePayload.allowIf,\n        );\n        if (isAllowedResult.isErr()) {\n            return Result.err(isAllowedResult.errorOrNull()!);\n        }\n\n        const isAllowed = isAllowedResult.getOrNull()!;\n        if (isAllowed.matched) {\n            return this.allow();\n        }\n\n        return this.outcomeFromStatus(\n            gatePayload.defaultOutcome,\n            this.buildDenyViolation(isAllowed),\n        );\n    }\n}\n"],"mappings":";;;AAsBA,IAAa,eAAb,MAAyD;CAIrD,YAAY,SAA+C,CAAC,GAAG;iBAHrC;EAItB,KAAK,aAAa,OAAO,cAAc;CAC3C;CAEA,QAA6C;EACzC,OAAO,OAAO,GAAG,QAAQ,GAAG,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;CAC5D;CAEA,KAAa,WAAyD;EAClE,OAAO,OAAO,GACV,QAAQ,GAAG,QAAQ,EACf,YAAY,CAAC,SAAS,EAC1B,CAAC,CACL;CACJ;CAEA,kBACI,QACA,WAC2B;EAC3B,OAAO,WAAW,UAAU,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;CAClE;CAEA,WAAmB,MAAgD;EAC/D,OAAO,WAAW,QAAQ,QAAQ;CACtC;CAEA,eAAuB,MAAgD;EACnE,OAAO;GACH,MAAM;GACN,OAAO,KAAK;GACZ,IAAI,KAAK;GACT,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;EACzD;CACJ;CAEA,eAAuB,MAA4C;EAC/D,IAAI,KAAK,WAAW,IAAI,GACpB,OAAO,KAAK,eAAe,IAAI;EAGnC,IAAI,SAAS,MACT,OAAO;GACH,MAAM;GACN,YAAY,KAAK,IAAI;EACzB;EAGJ,IAAI,QAAQ,MACR,OAAO;GACH,MAAM;GACN,YAAY,KAAK,GAAG;EACxB;EAGJ,OAAO,EACH,MAAM,MACV;CACJ;CAEA,mBACI,iBACe;EACf,OAAO;GACH,MAAM;GACN,SAAS,kBAAkB,gBAAgB,MAAM;GACjD,OAAO;IACH,eAAe,gBAAgB,MAAM;IACrC,cAAc,KAAK,eACf,gBAAgB,MAAM,YAC1B;IACA,mBAAmB,KAAK,eACpB,gBAAgB,MAAM,iBAC1B;IACA,uBACI,gBAAgB,MAAM;IAC1B,yBACI,gBAAgB,MAAM;IAC1B,OAAO,gBAAgB,MAAM,kBAAkB;IAC/C,IAAI,gBAAgB,MAAM,kBAAkB;GAChD;EACJ;CACJ;CAEA,iBAAyB,SAGvB;EACE,IAAI,eAAe,SACf,OAAO;GACH,SAAS,QAAQ;GACjB,gBAAgB;EACpB;EAGJ,OAAO;CACX;;;;;;;;;;CAWA,SACI,SACA,SAC2B;EAC3B,MAAM,cAAc,KAAK,iBAAiB,OAAO;EAMjD,MAAM,kBAAkB,IALO,qBAC3B,SACA,KAAK,WAAW,8BAA8B,KAAK,OAAO,CAGrB,EAAE,kBACvC,YAAY,OAChB;EACA,IAAI,gBAAgB,MAAM,GACtB,OAAO,OAAO,IAAI,gBAAgB,YAAY,CAAE;EAGpD,MAAM,YAAY,gBAAgB,UAAU;EAC5C,IAAI,UAAU,SACV,OAAO,KAAK,MAAM;EAGtB,OAAO,KAAK,kBACR,YAAY,gBACZ,KAAK,mBAAmB,SAAS,CACrC;CACJ;AACJ"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../../src/core/policies/engines/v1/gate/gate-engine-v1.ts"],"sourcesContent":["import { type CoreConfig, coreConfig } from \"../../../../config/index.js\";\nimport { Outcome } from \"../../../../result/outcome.js\";\nimport { Result } from \"../../../../result/result.js\";\n\nimport {\n    ConditionEvaluatorV1,\n    type TracedConditionEvaluation,\n} from \"../condition-evaluator.js\";\nimport type { ConditionLeafNode, ConditionNode } from \"../condition-types.js\";\nimport type { GatePayload } from \"../../gate-payload.js\";\nimport type {\n    GateOutcome,\n    GateStatus,\n    GateTraceLeafSnapshot,\n    GateTraceNodeSnapshot,\n    PolicyContext,\n    PolicyViolation,\n    VersionedGateEngine,\n} from \"../../gate-types.js\";\n\n// ─── Gate engine v1 ─────────────────────────────────────────────────────────\n\nexport class GateEngineV1 implements VersionedGateEngine {\n    public readonly version = 1;\n    private readonly coreConfig: CoreConfig;\n\n    constructor(params: { readonly coreConfig?: CoreConfig } = {}) {\n        this.coreConfig = params.coreConfig ?? coreConfig;\n    }\n\n    private allow(): Result<GateOutcome, string> {\n        return Result.ok(Outcome.of(\"ALLOW\", { violations: [] }));\n    }\n\n    private deny(violation: PolicyViolation): Result<GateOutcome, string> {\n        return Result.ok(\n            Outcome.of(\"DENY\", {\n                violations: [violation],\n            }),\n        );\n    }\n\n    private outcomeFromStatus(\n        status: GateStatus,\n        violation: PolicyViolation,\n    ): Result<GateOutcome, string> {\n        return status === \"ALLOW\" ? this.allow() : this.deny(violation);\n    }\n\n    private isLeafNode(node: ConditionNode): node is ConditionLeafNode {\n        return \"field\" in node && \"op\" in node;\n    }\n\n    private toLeafSnapshot(node: ConditionLeafNode): GateTraceLeafSnapshot {\n        return {\n            kind: \"LEAF\",\n            field: node.field,\n            op: node.op,\n            ...(node.allowNull === true ? { allowNull: true } : {}),\n        };\n    }\n\n    private toNodeSnapshot(node: ConditionNode): GateTraceNodeSnapshot {\n        if (this.isLeafNode(node)) {\n            return this.toLeafSnapshot(node);\n        }\n\n        if (\"and\" in node) {\n            return {\n                kind: \"AND\",\n                childCount: node.and.length,\n            };\n        }\n\n        if (\"or\" in node) {\n            return {\n                kind: \"OR\",\n                childCount: node.or.length,\n            };\n        }\n\n        return {\n            kind: \"NOT\",\n        };\n    }\n\n    private buildDenyViolation(\n        conditionResult: TracedConditionEvaluation,\n    ): PolicyViolation {\n        return {\n            code: \"DENY_CONDITION_MET\",\n            message: `Gate denied at ${conditionResult.trace.conditionPath}`,\n            trace: {\n                conditionPath: conditionResult.trace.conditionPath,\n                decisiveNode: this.toNodeSnapshot(\n                    conditionResult.trace.decisiveNode,\n                ),\n                lastEvaluatedLeaf: this.toLeafSnapshot(\n                    conditionResult.trace.lastEvaluatedLeaf,\n                ),\n                lastEvaluatedLeafPath:\n                    conditionResult.trace.lastEvaluatedLeafPath,\n                lastEvaluatedLeafResult:\n                    conditionResult.trace.lastEvaluatedLeafResult,\n                field: conditionResult.trace.lastEvaluatedLeaf.field,\n                op: conditionResult.trace.lastEvaluatedLeaf.op,\n            },\n        };\n    }\n\n    private normalizePayload(payload: GatePayload): {\n        readonly allowIf: ConditionNode;\n        readonly defaultOutcome: \"ALLOW\" | \"DENY\";\n    } {\n        if (\"condition\" in payload) {\n            return {\n                allowIf: payload.condition,\n                defaultOutcome: \"DENY\",\n            };\n        }\n\n        return payload;\n    }\n\n    /**\n     * Evaluates a GATE payload against a context object.\n     * Pure function — no side effects.\n     *\n     * Receives an already-parsed `GatePayload`; the registry is responsible\n     * for parsing from raw `unknown` before calling this method.\n     * Returns Result for technical failures (condition evaluation errors).\n     * The Outcome inside carries the business decision (ALLOW/DENY).\n     */\n    evaluate(\n        payload: GatePayload,\n        context: PolicyContext,\n    ): Result<GateOutcome, string> {\n        const gatePayload = this.normalizePayload(payload);\n        const conditionEvaluator = new ConditionEvaluatorV1(\n            context,\n            this.coreConfig.getConditionEvaluationOptions(this.version),\n        );\n\n        const isAllowedResult = conditionEvaluator.evaluateWithTrace(\n            gatePayload.allowIf,\n        );\n        if (isAllowedResult.isErr()) {\n            return Result.err(isAllowedResult.errorOrNull()!);\n        }\n\n        const isAllowed = isAllowedResult.getOrNull()!;\n        if (isAllowed.matched) {\n            return this.allow();\n        }\n\n        return this.outcomeFromStatus(\n            gatePayload.defaultOutcome,\n            this.buildDenyViolation(isAllowed),\n        );\n    }\n}\n"],"mappings":";;;AAsBA,IAAa,eAAb,MAAyD;CAIrD,YAAY,SAA+C,CAAC,GAAG;iBAHrC;EAItB,KAAK,aAAa,OAAO,cAAc;CAC3C;CAEA,QAA6C;EACzC,OAAO,OAAO,GAAG,QAAQ,GAAG,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;CAC5D;CAEA,KAAa,WAAyD;EAClE,OAAO,OAAO,GACV,QAAQ,GAAG,QAAQ,EACf,YAAY,CAAC,SAAS,EAC1B,CAAC,CACL;CACJ;CAEA,kBACI,QACA,WAC2B;EAC3B,OAAO,WAAW,UAAU,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;CAClE;CAEA,WAAmB,MAAgD;EAC/D,OAAO,WAAW,QAAQ,QAAQ;CACtC;CAEA,eAAuB,MAAgD;EACnE,OAAO;GACH,MAAM;GACN,OAAO,KAAK;GACZ,IAAI,KAAK;GACT,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;EACzD;CACJ;CAEA,eAAuB,MAA4C;EAC/D,IAAI,KAAK,WAAW,IAAI,GACpB,OAAO,KAAK,eAAe,IAAI;EAGnC,IAAI,SAAS,MACT,OAAO;GACH,MAAM;GACN,YAAY,KAAK,IAAI;EACzB;EAGJ,IAAI,QAAQ,MACR,OAAO;GACH,MAAM;GACN,YAAY,KAAK,GAAG;EACxB;EAGJ,OAAO,EACH,MAAM,MACV;CACJ;CAEA,mBACI,iBACe;EACf,OAAO;GACH,MAAM;GACN,SAAS,kBAAkB,gBAAgB,MAAM;GACjD,OAAO;IACH,eAAe,gBAAgB,MAAM;IACrC,cAAc,KAAK,eACf,gBAAgB,MAAM,YAC1B;IACA,mBAAmB,KAAK,eACpB,gBAAgB,MAAM,iBAC1B;IACA,uBACI,gBAAgB,MAAM;IAC1B,yBACI,gBAAgB,MAAM;IAC1B,OAAO,gBAAgB,MAAM,kBAAkB;IAC/C,IAAI,gBAAgB,MAAM,kBAAkB;GAChD;EACJ;CACJ;CAEA,iBAAyB,SAGvB;EACE,IAAI,eAAe,SACf,OAAO;GACH,SAAS,QAAQ;GACjB,gBAAgB;EACpB;EAGJ,OAAO;CACX;;;;;;;;;;CAWA,SACI,SACA,SAC2B;EAC3B,MAAM,cAAc,KAAK,iBAAiB,OAAO;EAMjD,MAAM,kBAAkB,IALO,qBAC3B,SACA,KAAK,WAAW,8BAA8B,KAAK,OAAO,CAGrB,EAAE,kBACvC,YAAY,OAChB;EACA,IAAI,gBAAgB,MAAM,GACtB,OAAO,OAAO,IAAI,gBAAgB,YAAY,CAAE;EAGpD,MAAM,YAAY,gBAAgB,UAAU;EAC5C,IAAI,UAAU,SACV,OAAO,KAAK,MAAM;EAGtB,OAAO,KAAK,kBACR,YAAY,gBACZ,KAAK,mBAAmB,SAAS,CACrC;CACJ;AACJ"}

package/dist/policy-service.js

@@ -16,7 +16,7 @@ var PolicyHashing = class PolicyHashing {
 	static sha256(input) {
 		return sha256Hex(input);
 	}
-	static assertHashable(value, path) {
+	static assertHashable(value, path, seen) {
 		if (value === null) return;
 		const type = typeof value;
 		if (type === "undefined") throw new TypeError(`canonicalJson does not accept undefined values (at ${path})`);
@@ -27,16 +27,16 @@ var PolicyHashing = class PolicyHashing {
 			if (!isValidDate(value)) throw new TypeError(`canonicalJson does not accept Invalid Date (at ${path})`);
 			return;
 		}
-		if (Array.isArray(value)) {
-			value.forEach((item, index) => {
-				PolicyHashing.assertHashable(item, `${path}[${index}]`);
-			});
-			return;
-		}
-		for (const [key, nested] of Object.entries(value)) PolicyHashing.assertHashable(nested, `${path}.${key}`);
+		if (seen.has(value)) throw new TypeError(`canonicalJson does not accept circular references (at ${path})`);
+		seen.add(value);
+		if (Array.isArray(value)) value.forEach((item, index) => {
+			PolicyHashing.assertHashable(item, `${path}[${index}]`, seen);
+		});
+		else for (const [key, nested] of Object.entries(value)) PolicyHashing.assertHashable(nested, `${path}.${key}`, seen);
+		seen.delete(value);
 	}
 	static canonicalJson(value) {
-		PolicyHashing.assertHashable(value, "$");
+		PolicyHashing.assertHashable(value, "$", /* @__PURE__ */ new WeakSet());
 		return stableStringify(value);
 	}
 	static computePayloadHash(payload, policyKey, policyVersion) {
@@ -345,13 +345,16 @@ var InMemoryPolicyDefinitionRepository = class {
 //#region src/core/policies/defs/policy-semver.ts
 const POLICY_SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
 function parseSemver(version) {
-	const [core, preRelease = null] = version.split("+")[0].split("-");
+	const withoutBuild = version.split("+")[0];
+	const dashIndex = withoutBuild.indexOf("-");
+	const core = dashIndex === -1 ? withoutBuild : withoutBuild.slice(0, dashIndex);
+	const preRelease = dashIndex === -1 ? null : withoutBuild.slice(dashIndex + 1);
 	const [major, minor, patch] = core.split(".").map(Number);
 	return {
 		major,
 		minor,
 		patch,
-		preRelease: preRelease ?? null
+		preRelease
 	};
 }
 function comparePreRelease(a, b) {