@cullet/erp-core 1.0.5 → 1.0.7

package/src/core/policies/service/policy-service.ts

@@ -1,31 +1,38 @@
-import { PolicyAsOfResolver, type DeriveAsOfOptions } from "../asof";
-import { type PolicyCatalog, PolicyCatalogEntry, PolicyKey } from "../catalog";
-import type { ContextSeed, PolicyContextBuilder } from "../context";
-import { ContextSeedValidator } from "../context";
+import { PolicyAsOfResolver, type DeriveAsOfOptions } from "../asof/index.js";
+import {
+    type PolicyCatalog,
+    PolicyCatalogEntry,
+    PolicyKey,
+} from "../catalog/index.js";
+import type { ContextSeed, PolicyContextBuilder } from "../context/index.js";
+import { ContextSeedValidator } from "../context/index.js";
 import {
     PolicyDefinition,
     type PolicyDefinitionRepository,
     type PolicyScope,
-} from "../defs";
-import type { PolicyDecisionId, PolicyDefinitionId } from "../policy-ids";
+} from "../defs/index.js";
+import type { PolicyDecisionId, PolicyDefinitionId } from "../policy-ids.js";
 import {
     type ComputeOutcome,
     ComputeRegistry,
     GateEngineRegistry,
     type GateOutcome,
     type PolicyContext,
-} from "../engines";
-import { PolicyResolver } from "../resolver";
-import { Result } from "../../result/result";
-import { isValidDate } from "../../shared/temporal-guards";
+} from "../engines/index.js";
+import { PolicyResolver } from "../resolver/index.js";
+import { Result } from "../../result/result.js";
+import { isValidDate } from "../../shared/temporal-guards.js";
 
-import type { PolicyEvent, PolicyReporter } from "../../config/policy-reporter";
-import { SilentPolicyReporter } from "../../config/silent-policy-reporter";
+import type {
+    PolicyEvent,
+    PolicyReporter,
+} from "../../config/policy-reporter.js";
+import { SilentPolicyReporter } from "../../config/silent-policy-reporter.js";
 
 import {
     PolicyEvaluationErrors,
     type PolicyEvaluationError,
-} from "./policy-evaluation-error";
+} from "./policy-evaluation-error.js";
 
 // ─── Input ──────────────────────────────────────────────────────────────────
 
@@ -57,7 +64,7 @@ export interface PolicyServiceParams {
 /** Union of all possible policy decision Outcomes. */
 export type PolicyDecision = GateOutcome | ComputeOutcome;
 
-export type { PolicyEvaluationError } from "./policy-evaluation-error";
+export type { PolicyEvaluationError } from "./policy-evaluation-error.js";
 
 export interface PolicyEvaluationResult {
     readonly decisionId: PolicyDecisionId;

package/src/core/policies/utils/date.ts

@@ -1,4 +1,4 @@
-import { isValidDate } from "../../shared/temporal-guards";
+import { isValidDate } from "../../shared/temporal-guards.js";
 
 export class PolicyDateUtils {
     static isValid(value: Date): boolean {

package/src/core/policies/utils/hash.ts

@@ -1,5 +1,5 @@
-import { sha256Hex, stableStringify } from "../../shared/hashing";
-import { isValidDate } from "../../shared/temporal-guards";
+import { sha256Hex, stableStringify } from "../../shared/hashing.js";
+import { isValidDate } from "../../shared/temporal-guards.js";
 
 /**
  * Produces a deterministic SHA-256 hex digest of a canonical JSON representation.
@@ -16,7 +16,11 @@ export class PolicyHashing {
         return sha256Hex(input);
     }
 
-    private static assertHashable(value: unknown, path: string): void {
+    private static assertHashable(
+        value: unknown,
+        path: string,
+        seen: WeakSet<object>,
+    ): void {
         if (value === null) {
             return;
         }
@@ -54,22 +58,30 @@ export class PolicyHashing {
             return;
         }
 
+        if (seen.has(value as object)) {
+            throw new TypeError(
+                `canonicalJson does not accept circular references (at ${path})`,
+            );
+        }
+        seen.add(value as object);
+
         if (Array.isArray(value)) {
             value.forEach((item, index) => {
-                PolicyHashing.assertHashable(item, `${path}[${index}]`);
+                PolicyHashing.assertHashable(item, `${path}[${index}]`, seen);
             });
-            return;
+        } else {
+            for (const [key, nested] of Object.entries(
+                value as Record<string, unknown>,
+            )) {
+                PolicyHashing.assertHashable(nested, `${path}.${key}`, seen);
+            }
         }
 
-        for (const [key, nested] of Object.entries(
-            value as Record<string, unknown>,
-        )) {
-            PolicyHashing.assertHashable(nested, `${path}.${key}`);
-        }
+        seen.delete(value as object);
     }
 
     static canonicalJson(value: unknown): string {
-        PolicyHashing.assertHashable(value, "$");
+        PolicyHashing.assertHashable(value, "$", new WeakSet<object>());
 
         return stableStringify(value);
     }

package/src/core/policies/utils/index.ts

@@ -1,3 +1,3 @@
-export { Result, Ok, Err } from "./result";
-export { PolicyHashing } from "./hash";
-export { PolicyDateUtils } from "./date";
+export { Result, Ok, Err } from "./result.js";
+export { PolicyHashing } from "./hash.js";
+export { PolicyDateUtils } from "./date.js";

package/src/core/policies/utils/result.ts

@@ -1,4 +1,4 @@
 // Re-export the core Result class.
 // The policies module uses Result<T, string> as its standard Result type.
 
-export { Err, Ok, Result } from "../../result/result";
+export { Err, Ok, Result } from "../../result/result.js";

package/src/core/result/outcome.ts

@@ -1,6 +1,6 @@
 // core/domain/outcome.ts
 
-import { InvariantViolationException } from "../exceptions/invariant-violation-exception";
+import { InvariantViolationException } from "../exceptions/invariant-violation-exception.js";
 
 /**
  * Outcome — Business decision abstraction.

package/src/core/shared/aggregate-version.ts

@@ -1,4 +1,4 @@
-import { InvariantViolationException } from "../exceptions/invariant-violation-exception";
+import { InvariantViolationException } from "../exceptions/invariant-violation-exception.js";
 
 function assertValidAggregateVersion(aggregateVersion: number): void {
     if (!Number.isInteger(aggregateVersion) || aggregateVersion < 0) {

package/src/core/shared/hashing.ts

@@ -1,12 +1,23 @@
 import { createHash } from "node:crypto";
 
+const CIRCULAR_STRUCTURE_MESSAGE =
+    "Cannot stably stringify a circular structure";
+
 function sha256Hex(value: string): string {
     return createHash("sha256").update(value, "utf8").digest("hex");
 }
 
-function sortKeysDeep(value: unknown): unknown {
+// `seen` holds the current traversal branch so true cycles are rejected while
+// repeated (acyclic) references are still serialized — matching JSON.stringify.
+function sortKeysDeep(value: unknown, seen: WeakSet<object>): unknown {
     if (Array.isArray(value)) {
-        return value.map((item) => sortKeysDeep(item));
+        if (seen.has(value)) {
+            throw new TypeError(CIRCULAR_STRUCTURE_MESSAGE);
+        }
+        seen.add(value);
+        const mapped = value.map((item) => sortKeysDeep(item, seen));
+        seen.delete(value);
+        return mapped;
     }
 
     if (value instanceof Date) {
@@ -14,12 +25,17 @@ function sortKeysDeep(value: unknown): unknown {
     }
 
     if (value && typeof value === "object") {
+        if (seen.has(value)) {
+            throw new TypeError(CIRCULAR_STRUCTURE_MESSAGE);
+        }
+        seen.add(value);
         const record = value as Record<string, unknown>;
         const ordered = Object.create(null) as Record<string, unknown>;
 
         for (const key of Object.keys(record).sort()) {
-            ordered[key] = sortKeysDeep(record[key]);
+            ordered[key] = sortKeysDeep(record[key], seen);
         }
+        seen.delete(value);
 
         return ordered;
     }
@@ -27,8 +43,21 @@ function sortKeysDeep(value: unknown): unknown {
     return value;
 }
 
+/**
+ * Deterministic JSON string with object keys sorted recursively, so key order
+ * does not affect the output.
+ *
+ * Follows `JSON.stringify` semantics for the values it serializes: `undefined`,
+ * functions and symbols are dropped, non-finite numbers become `null`, `bigint`
+ * throws, and `Map`/`Set` serialize as `{}`. Distinct payloads can therefore
+ * collapse to the same string — for collision-resistant hashing use
+ * `PolicyHashing.canonicalJson` (policies/utils), which rejects those values
+ * up front.
+ *
+ * @throws {TypeError} On circular references (mirroring `JSON.stringify`).
+ */
 function stableStringify(value: unknown): string {
-    return JSON.stringify(sortKeysDeep(value));
+    return JSON.stringify(sortKeysDeep(value, new WeakSet<object>()));
 }
 
 function payloadHash(value: unknown): string {

package/src/core/shared/immutable.ts

@@ -14,13 +14,24 @@ type DeepReadonly<T> = T extends PrimitiveValue | Date
       : { readonly [TKey in keyof T]: DeepReadonly<T[TKey]> };
 
 function deepFreeze<T>(value: T): T {
+    return deepFreezeInternal(value, new WeakSet<object>());
+}
+
+function deepFreezeInternal<T>(value: T, seen: WeakSet<object>): T {
     if (typeof value !== "object" || value === null || value instanceof Date) {
         return value;
     }
 
+    // A value already on `seen` has been visited on this pass (cyclic graph or a
+    // shared reference); revisiting it would recurse forever.
+    if (seen.has(value)) {
+        return value;
+    }
+    seen.add(value);
+
     if (Array.isArray(value)) {
         for (const item of value) {
-            deepFreeze(item);
+            deepFreezeInternal(item, seen);
         }
 
         return Object.freeze(value);
@@ -29,7 +40,7 @@ function deepFreeze<T>(value: T): T {
     const objectValue = value as Record<PropertyKey, object | PrimitiveValue>;
 
     for (const propertyKey of Reflect.ownKeys(objectValue)) {
-        deepFreeze(objectValue[propertyKey]);
+        deepFreezeInternal(objectValue[propertyKey], seen);
     }
 
     return Object.freeze(value);

package/src/core/shared/temporal-guards.ts

@@ -1,4 +1,4 @@
-import { InvariantViolationException } from "../exceptions/invariant-violation-exception";
+import { InvariantViolationException } from "../exceptions/invariant-violation-exception.js";
 
 function isValidDate(value: unknown): value is Date {
     return value instanceof Date && !Number.isNaN(value.getTime());

package/src/core/versioning/domain-event-contracts.ts

@@ -1,8 +1,8 @@
-import { UseCase } from "../application/use-case";
-import { Entity } from "../domain/entity";
-import { ValueObject } from "../domain/value-object";
-import { assertValidAggregateVersion } from "../shared/aggregate-version";
-import { type ContractVersion } from "./version";
+import { UseCase } from "../application/use-case.js";
+import { Entity } from "../domain/entity.js";
+import { ValueObject } from "../domain/value-object.js";
+import { assertValidAggregateVersion } from "../shared/aggregate-version.js";
+import { type ContractVersion } from "./version.js";
 
 interface DomainEventContractSelection {
     readonly entity?: boolean;

package/src/examples/rulesets/entity/order-creation-rules-v1.ts

@@ -1,5 +1,5 @@
-import { DomainException } from "../../../core/domain/rulesets/entity-ruleset.contracts";
-import { type OrderCreationData, type OrderCreationRuleset } from "./order";
+import { DomainException } from "../../../core/domain/rulesets/entity-ruleset.contracts.js";
+import { type OrderCreationData, type OrderCreationRuleset } from "./order.js";
 
 class OrderCreationValidationError extends DomainException {}
 

package/src/examples/rulesets/entity/order-invariants-v1.ts

@@ -1,12 +1,12 @@
 import {
     DomainException,
     type RulesetId,
-} from "../../../core/domain/rulesets/entity-ruleset.contracts";
+} from "../../../core/domain/rulesets/entity-ruleset.contracts.js";
 import {
     type Order,
     type OrderInvariantRuleset,
     type OrderItem,
-} from "./order";
+} from "./order.js";
 
 class OrderInvariantError extends DomainException {}
 

package/src/examples/rulesets/entity/order-invariants-v2.ts

@@ -1,9 +1,9 @@
 import {
     DomainException,
     type RulesetId,
-} from "../../../core/domain/rulesets/entity-ruleset.contracts";
-import { type Order } from "./order";
-import { OrderInvariantsV1 } from "./order-invariants-v1";
+} from "../../../core/domain/rulesets/entity-ruleset.contracts.js";
+import { type Order } from "./order.js";
+import { OrderInvariantsV1 } from "./order-invariants-v1.js";
 
 class OrderCancellationWindowError extends DomainException {}
 

package/src/examples/rulesets/entity/order.ts

@@ -2,7 +2,7 @@ import {
     type CreationRuleset,
     type InvariantRuleset,
     type RulesetId,
-} from "../../../core/domain/rulesets/entity-ruleset.contracts";
+} from "../../../core/domain/rulesets/entity-ruleset.contracts.js";
 
 type OrderStatus = "open" | "cancelled" | "shipped" | "delivered";
 

package/src/examples/rulesets/value-object/cpf-rules-v1.ts

@@ -1,7 +1,7 @@
 import {
     DomainException,
     type ValueObjectRuleset,
-} from "../../../core/domain/rulesets/value-object-ruleset.contracts";
+} from "../../../core/domain/rulesets/value-object-ruleset.contracts.js";
 
 class CPFValidationError extends DomainException {}
 

package/src/examples/rulesets/value-object/cpf-rules-v2.ts

@@ -1,8 +1,8 @@
 import {
     DomainException,
     type ValueObjectRuleset,
-} from "../../../core/domain/rulesets/value-object-ruleset.contracts";
-import { CPFRulesV1 } from "./cpf-rules-v1";
+} from "../../../core/domain/rulesets/value-object-ruleset.contracts.js";
+import { CPFRulesV1 } from "./cpf-rules-v1.js";
 
 class CPFBlocklistError extends DomainException {}
 

package/src/examples/rulesets/value-object/cpf.ts

@@ -1,7 +1,7 @@
 import {
     type RulesetId,
     type ValueObjectRuleset,
-} from "../../../core/domain/rulesets/value-object-ruleset.contracts";
+} from "../../../core/domain/rulesets/value-object-ruleset.contracts.js";
 
 interface CPFStatic {
     create(raw: string, ruleset: ValueObjectRuleset<string>): CPF;

package/src/examples/rulesets/value-object/customer.ts

@@ -1,9 +1,9 @@
-import { CPF } from "./cpf";
-import { PersonName } from "./person-name";
+import { CPF } from "./cpf.js";
+import { PersonName } from "./person-name.js";
 import {
     type RulesetId,
     type ValueObjectRuleset,
-} from "../../../core/domain/rulesets/value-object-ruleset.contracts";
+} from "../../../core/domain/rulesets/value-object-ruleset.contracts.js";
 
 interface CustomerCreateData {
     readonly cpf: string;

package/src/examples/rulesets/value-object/person-name-rules-v1.ts

@@ -1,7 +1,7 @@
 import {
     DomainException,
     type ValueObjectRuleset,
-} from "../../../core/domain/rulesets/value-object-ruleset.contracts";
+} from "../../../core/domain/rulesets/value-object-ruleset.contracts.js";
 
 class PersonNameValidationError extends DomainException {}
 

package/src/examples/rulesets/value-object/person-name-rules-v2.ts

@@ -1,8 +1,8 @@
 import {
     DomainException,
     type ValueObjectRuleset,
-} from "../../../core/domain/rulesets/value-object-ruleset.contracts";
-import { PersonNameRulesV1 } from "./person-name-rules-v1";
+} from "../../../core/domain/rulesets/value-object-ruleset.contracts.js";
+import { PersonNameRulesV1 } from "./person-name-rules-v1.js";
 
 class PersonNameCharacterError extends DomainException {}
 

package/src/examples/rulesets/value-object/person-name.ts

@@ -1,7 +1,7 @@
 import {
     type RulesetId,
     type ValueObjectRuleset,
-} from "../../../core/domain/rulesets/value-object-ruleset.contracts";
+} from "../../../core/domain/rulesets/value-object-ruleset.contracts.js";
 
 interface PersonNameStatic {
     create(raw: string, ruleset: ValueObjectRuleset<string>): PersonName;

package/src/version.ts

@@ -4,4 +4,4 @@
 // Mantemos a versao aqui, dentro de src/, para que a copia full-control seja
 // auto-contida: ao copiar so o conteudo de src/, o entry nao depende de um
 // `../package.json` que deixaria de existir no projeto consumidor.
-export const version = "1.0.5";
+export const version = "1.0.7";