@cullet/erp-core 1.3.0 → 1.4.0

package/src/core/abac/abac-request.ts

@@ -0,0 +1,29 @@
+import type { RequestedBy } from "../application/commands/requested-by.js";
+
+/**
+ * The attribute bags an ABAC decision reasons over, grouped by the four standard
+ * categories. Each is a flat record; {@link abacContext} nests them under
+ * `subject` / `resource` / `action` / `env` so a rule's condition can reference
+ * fields like `resource.status` or `env.businessHours`.
+ */
+type AbacAttributes = {
+    readonly subject?: Record<string, unknown>;
+    readonly resource?: Record<string, unknown>;
+    readonly action?: Record<string, unknown>;
+    readonly environment?: Record<string, unknown>;
+};
+
+/**
+ * The question put to the {@link AbacAuthorizer}: *do these attributes authorize
+ * this action?* Carries the acting {@link RequestedBy} (reused as the subject),
+ * an audit-friendly `action` label, an optional type/id resource reference, and
+ * the {@link AbacAttributes} the rules evaluate.
+ */
+interface AbacRequest {
+    readonly actor: RequestedBy;
+    readonly action: string;
+    readonly resource?: { readonly type: string; readonly id?: string };
+    readonly attributes: AbacAttributes;
+}
+
+export type { AbacAttributes, AbacRequest };

package/src/core/abac/attributes.ts

@@ -0,0 +1,39 @@
+import type { PolicyContext } from "../policies/engines/gate-types.js";
+
+import type { AbacRequest } from "./abac-request.js";
+
+/**
+ * Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the
+ * condition evaluator reads (it resolves dotted fields like `resource.status` by
+ * walking nested objects). The actor lands as `subject.id`; the four attribute
+ * bags nest under `subject` / `resource` / `action` / `env`; a `resource`
+ * reference adds `resource.type` / `resource.id`. The actor id and the resource
+ * reference win over any same-named keys in the attribute bags.
+ *
+ * Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,
+ * or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so
+ * rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.
+ */
+export function abacContext(request: AbacRequest): PolicyContext {
+    const attributes = request.attributes;
+
+    const subject: Record<string, unknown> = {
+        ...attributes.subject,
+        id: request.actor.raw,
+    };
+
+    const resource: Record<string, unknown> = { ...attributes.resource };
+    if (request.resource) {
+        resource.type = request.resource.type;
+        if (request.resource.id !== undefined) {
+            resource.id = request.resource.id;
+        }
+    }
+
+    return {
+        subject,
+        resource,
+        action: { ...attributes.action },
+        env: { ...attributes.environment },
+    };
+}

package/src/core/abac/authorizer.ts

@@ -0,0 +1,108 @@
+import { type CoreConfig, coreConfig } from "../config/index.js";
+import { AuthorizationError } from "../errors/authorization-error.js";
+import { ConditionEvaluatorV1 } from "../policies/engines/v1/condition-evaluator.js";
+import { Result } from "../result/result.js";
+
+import type { AbacRequest } from "./abac-request.js";
+import { abacContext } from "./attributes.js";
+import { combine, type CombiningAlgorithm } from "./combining.js";
+import type { AbacPolicySet } from "./domain/policy-set.js";
+import type { AbacRule } from "./domain/rule.js";
+
+// ABAC reuses the gate engine's v1 condition matcher; the version stamps the
+// evaluation reports the shared reporter emits.
+const ENGINE_VERSION = 1;
+
+/** The successful decision returned by {@link AbacAuthorizer.authorize}. */
+interface AbacDecision {
+    /** The audited business action that was allowed. */
+    readonly action: string;
+    readonly effect: "PERMIT";
+    /** The id of the rule that permitted, or `"<default>"` when the set's default did. */
+    readonly matchedRule: string;
+    readonly algorithm: CombiningAlgorithm;
+    /** When the decision was made, ISO-8601. */
+    readonly grantedAtIso: string;
+}
+
+/**
+ * The pure ABAC decisor. Given an {@link AbacRequest} and an
+ * {@link AbacPolicySet}, it flattens the request's attributes into a context,
+ * matches each rule's condition with the gate engine's pure condition evaluator
+ * (reused, not reimplemented), resolves the effects through the set's combining
+ * algorithm, and returns a {@link Result} — never throwing, mirroring the
+ * "errors as values" contract of `RbacAuthorizer`/`GateEngineV1`.
+ *
+ * A denial maps to {@link AuthorizationError.policyDenied}, attributed to the
+ * deciding rule's `id`/`version`; a condition-evaluation failure (a missing
+ * attribute, a wrong-typed operand) fails closed as
+ * {@link AuthorizationError.forbidden}. Loading the dynamic attributes is the
+ * consumer's job (behind an `AbacAuthorizerPort` adapter); this class only decides.
+ */
+class AbacAuthorizer {
+    private readonly coreConfig: CoreConfig;
+
+    constructor(params: { readonly coreConfig?: CoreConfig } = {}) {
+        this.coreConfig = params.coreConfig ?? coreConfig;
+    }
+
+    authorize(
+        request: AbacRequest,
+        policies: AbacPolicySet,
+    ): Result<AbacDecision, AuthorizationError> {
+        const context = abacContext(request);
+        const evaluator = new ConditionEvaluatorV1(
+            context,
+            this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION),
+        );
+
+        const applicable: AbacRule[] = [];
+        for (const rule of policies.rules) {
+            const matched = evaluator.evaluate(rule.condition);
+            if (matched.isErr()) {
+                // Fail closed: a technical evaluation error is never a silent PERMIT.
+                return Result.err(
+                    AuthorizationError.forbidden({
+                        action: request.action,
+                        resource: request.resource,
+                        actor: { userId: request.actor.raw },
+                        details: matched.errorOrNull() ?? undefined,
+                    }),
+                );
+            }
+            if (matched.getOrThrow()) {
+                applicable.push(rule);
+            }
+        }
+
+        const { effect, decidingRule } = combine(
+            policies.algorithm,
+            applicable,
+            policies.defaultEffect,
+        );
+
+        if (effect === "PERMIT") {
+            return Result.ok({
+                action: request.action,
+                effect: "PERMIT",
+                matchedRule: decidingRule?.id ?? "<default>",
+                algorithm: policies.algorithm,
+                grantedAtIso: new Date().toISOString(),
+            });
+        }
+
+        return Result.err(
+            AuthorizationError.policyDenied({
+                policyId: decidingRule?.id ?? "<default-deny>",
+                policyVersion: decidingRule?.version ?? 0,
+                evaluatedAtIso: new Date().toISOString(),
+                action: request.action,
+                resource: request.resource,
+                actor: { userId: request.actor.raw },
+                reasonCode: decidingRule?.id,
+            }),
+        );
+    }
+}
+
+export { AbacAuthorizer, type AbacDecision };

package/src/core/abac/combining.ts

@@ -0,0 +1,63 @@
+import type { AbacRule, RuleEffect } from "./domain/rule.js";
+
+/**
+ * How an {@link AbacPolicySet} resolves several applicable rules into one effect.
+ *
+ * - `deny-overrides` (default, secure): any applicable DENY wins; otherwise the
+ *   first PERMIT; otherwise the set's default effect.
+ * - `permit-overrides`: any applicable PERMIT wins; otherwise the first DENY;
+ *   otherwise the default effect.
+ * - `first-applicable`: the effect of the first rule that matches; otherwise the
+ *   default effect.
+ */
+export type CombiningAlgorithm =
+    | "deny-overrides"
+    | "permit-overrides"
+    | "first-applicable";
+
+/** The resolved decision plus the rule (if any) that produced it. */
+export interface CombineResult {
+    readonly effect: RuleEffect;
+    readonly decidingRule?: AbacRule;
+}
+
+function firstWithEffect(
+    rules: readonly AbacRule[],
+    effect: RuleEffect,
+): AbacRule | undefined {
+    return rules.find((rule) => rule.effect === effect);
+}
+
+/**
+ * Applies `algorithm` to the already-matched `applicable` rules, falling back to
+ * `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and
+ * total; the returned `decidingRule` is absent exactly when `defaultEffect` was
+ * used.
+ */
+export function combine(
+    algorithm: CombiningAlgorithm,
+    applicable: readonly AbacRule[],
+    defaultEffect: RuleEffect,
+): CombineResult {
+    switch (algorithm) {
+        case "deny-overrides": {
+            const deny = firstWithEffect(applicable, "DENY");
+            if (deny) return { effect: "DENY", decidingRule: deny };
+            const permit = firstWithEffect(applicable, "PERMIT");
+            if (permit) return { effect: "PERMIT", decidingRule: permit };
+            return { effect: defaultEffect };
+        }
+        case "permit-overrides": {
+            const permit = firstWithEffect(applicable, "PERMIT");
+            if (permit) return { effect: "PERMIT", decidingRule: permit };
+            const deny = firstWithEffect(applicable, "DENY");
+            if (deny) return { effect: "DENY", decidingRule: deny };
+            return { effect: defaultEffect };
+        }
+        case "first-applicable": {
+            const first = applicable[0];
+            if (first) return { effect: first.effect, decidingRule: first };
+            return { effect: defaultEffect };
+        }
+    }
+}

package/src/core/abac/composite-authorizer.ts

@@ -0,0 +1,45 @@
+import { Result } from "../result/result.js";
+import type { AbacAuthorizerPort } from "../application/ports/abac-authorizer.port.js";
+import type { AuthorizerPort } from "../application/ports/authorizer.port.js";
+import type { AuthorizationError } from "../errors/authorization-error.js";
+import type { AccessRequest } from "../rbac/access-request.js";
+
+import type { AbacAttributes } from "./abac-request.js";
+
+/**
+ * The request a {@link CompositeAuthorizer} accepts — one object that satisfies
+ * both the RBAC {@link AccessRequest} (its `required`/`scope`) and the ABAC
+ * request (its `attributes`).
+ */
+type CompositeAccessRequest = AccessRequest & {
+    readonly attributes: AbacAttributes;
+};
+
+/**
+ * Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid
+ * "does the actor hold the capability, *and* do the attributes allow it here?"
+ * flow. Short-circuits with the RBAC denial when the actor is not even capable,
+ * so the boundary sees the most specific 403.
+ *
+ * Only the two port interfaces are referenced (both erased at runtime), so this
+ * pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the
+ * consumer wires up.
+ */
+class CompositeAuthorizer {
+    constructor(
+        private readonly rbac: AuthorizerPort,
+        private readonly abac: AbacAuthorizerPort,
+    ) {}
+
+    async authorize(
+        request: CompositeAccessRequest,
+    ): Promise<Result<void, AuthorizationError>> {
+        const coarse = await this.rbac.authorize(request);
+        if (coarse.isErr()) {
+            return coarse;
+        }
+        return this.abac.authorize(request);
+    }
+}
+
+export { CompositeAuthorizer, type CompositeAccessRequest };

package/src/core/abac/domain/policy-set.ts

@@ -0,0 +1,52 @@
+import type { CombiningAlgorithm } from "../combining.js";
+
+import type { AbacRule, RuleEffect } from "./rule.js";
+
+/**
+ * An ordered collection of {@link AbacRule}s plus how to combine them
+ * ({@link CombiningAlgorithm}) and what to decide when no rule applies
+ * ({@link defaultEffect}). This is where ABAC goes beyond a single gate
+ * condition: several PERMIT/DENY rules resolved by an explicit algorithm.
+ *
+ * Closed by default — the combining algorithm defaults to `"deny-overrides"` and
+ * the default effect to `"DENY"`, so a request matching nothing is denied. A
+ * plain holder (not a value object); build through {@link of}.
+ */
+class AbacPolicySet {
+    private constructor(
+        private readonly _rules: readonly AbacRule[],
+        private readonly _algorithm: CombiningAlgorithm,
+        private readonly _defaultEffect: RuleEffect,
+    ) {
+        Object.freeze(this._rules);
+        Object.freeze(this);
+    }
+
+    static of(
+        rules: readonly AbacRule[],
+        options: {
+            readonly algorithm?: CombiningAlgorithm;
+            readonly defaultEffect?: RuleEffect;
+        } = {},
+    ): AbacPolicySet {
+        return new AbacPolicySet(
+            [...rules],
+            options.algorithm ?? "deny-overrides",
+            options.defaultEffect ?? "DENY",
+        );
+    }
+
+    get rules(): readonly AbacRule[] {
+        return this._rules;
+    }
+
+    get algorithm(): CombiningAlgorithm {
+        return this._algorithm;
+    }
+
+    get defaultEffect(): RuleEffect {
+        return this._defaultEffect;
+    }
+}
+
+export { AbacPolicySet };

package/src/core/abac/domain/rule.ts

@@ -0,0 +1,197 @@
+import { ValidationCode } from "../../exceptions/validation-code.js";
+import { InvalidValueException } from "../../exceptions/validation-exception.js";
+import { ValidationField } from "../../exceptions/validation-field.js";
+import { ValueObject } from "../../domain/value-object.js";
+import type {
+    ConditionNode,
+    ConditionOp,
+} from "../../policies/engines/v1/condition-types.js";
+
+/** Whether a matching {@link AbacRule} permits or denies the action. */
+type RuleEffect = "PERMIT" | "DENY";
+
+/**
+ * The serializable shape of a rule: a stable `id`/`version` (surfaced on a
+ * denial as `policyId`/`policyVersion`), the {@link RuleEffect}, and the
+ * {@link ConditionNode} that decides whether the rule applies to a request's
+ * flattened attributes.
+ */
+type AbacRuleProps = {
+    readonly id: string;
+    readonly version: number;
+    readonly effect: RuleEffect;
+    readonly condition: ConditionNode;
+    readonly description?: string;
+};
+
+const RULE_FIELD = ValidationField.of("abacRule");
+
+const CONDITION_OPS = new Set<ConditionOp>([
+    "eq",
+    "neq",
+    "gt",
+    "gte",
+    "lt",
+    "lte",
+    "in",
+    "notIn",
+    "isNull",
+    "isNotNull",
+]);
+
+const RULE_EFFECTS = new Set<RuleEffect>(["PERMIT", "DENY"]);
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * A single attribute-based rule: an {@link RuleEffect} that takes hold when its
+ * {@link ConditionNode} matches the request's flattened attributes. The
+ * condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves
+ * combined with `and`/`or`/`not`), so a consumer learns one condition language
+ * across the whole kit.
+ *
+ * A zod-free value object: it validates its own shape on construction (throwing
+ * {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are
+ * authored in TypeScript — trusted data, not untrusted JSON — the structural
+ * check is a hand-rolled walk of the condition tree rather than a schema parse.
+ * Build one through {@link of}; the constructor is private.
+ */
+class AbacRule extends ValueObject<AbacRuleProps, AbacRuleProps> {
+    private constructor(props: AbacRuleProps) {
+        super(props);
+        this.finalize();
+    }
+
+    /**
+     * Builds a rule, validating that `id` is non-blank, `version` is an integer
+     * ≥ 1, `effect` is `"PERMIT"`/`"DENY"`, and `condition` is a well-formed
+     * condition node. Throws {@link InvalidValueException} otherwise.
+     */
+    static of(props: AbacRuleProps): AbacRule {
+        if (typeof props.id !== "string" || props.id.trim().length === 0) {
+            throw new InvalidValueException(
+                RULE_FIELD.nested("id"),
+                ValidationCode.BLANK,
+                `abac rule id must be a non-empty string, got "${props.id}"`,
+            );
+        }
+
+        if (!Number.isInteger(props.version) || props.version < 1) {
+            throw new InvalidValueException(
+                RULE_FIELD.nested("version"),
+                ValidationCode.OUT_OF_RANGE,
+                `abac rule version must be an integer >= 1, got "${props.version}"`,
+            );
+        }
+
+        if (!RULE_EFFECTS.has(props.effect)) {
+            throw new InvalidValueException(
+                RULE_FIELD.nested("effect"),
+                ValidationCode.INVALID_FORMAT,
+                `abac rule effect must be "PERMIT" or "DENY", got "${String(props.effect)}"`,
+            );
+        }
+
+        AbacRule.assertConditionShape(props.condition);
+
+        return new AbacRule(props);
+    }
+
+    // Mirrors what the shared condition evaluator would reject at eval time
+    // (empty and/or nodes, malformed leaves) but fails fast at construction.
+    private static assertConditionShape(node: unknown): void {
+        if (!isPlainObject(node)) {
+            AbacRule.rejectCondition(
+                "abac rule condition must be a leaf { field, op } or an { and | or | not } node",
+            );
+        }
+
+        if ("and" in node || "or" in node) {
+            const key = "and" in node ? "and" : "or";
+            const children = node[key];
+            if (!Array.isArray(children) || children.length === 0) {
+                AbacRule.rejectCondition(
+                    `abac rule "${key}" node must hold a non-empty array of child conditions`,
+                );
+            }
+            for (const child of children) {
+                AbacRule.assertConditionShape(child);
+            }
+            return;
+        }
+
+        if ("not" in node) {
+            AbacRule.assertConditionShape(node.not);
+            return;
+        }
+
+        if ("field" in node && "op" in node) {
+            if (
+                typeof node.field !== "string" ||
+                node.field.trim().length === 0
+            ) {
+                AbacRule.rejectCondition(
+                    `abac rule condition leaf "field" must be a non-empty string, got "${String(node.field)}"`,
+                );
+            }
+            if (
+                typeof node.op !== "string" ||
+                !CONDITION_OPS.has(node.op as ConditionOp)
+            ) {
+                AbacRule.rejectCondition(
+                    `abac rule condition leaf "op" is not a supported operator, got "${String(node.op)}"`,
+                );
+            }
+            return;
+        }
+
+        AbacRule.rejectCondition(
+            "abac rule condition must be a leaf { field, op } or an { and | or | not } node",
+        );
+    }
+
+    private static rejectCondition(message: string): never {
+        throw new InvalidValueException(
+            RULE_FIELD.nested("condition"),
+            ValidationCode.INVALID_FORMAT,
+            message,
+        );
+    }
+
+    get id(): string {
+        return this.value.id;
+    }
+
+    get version(): number {
+        return this.value.version;
+    }
+
+    get effect(): RuleEffect {
+        return this.value.effect;
+    }
+
+    /** The condition tree evaluated against a request's flattened attributes. */
+    get condition(): ConditionNode {
+        return this.value.condition as ConditionNode;
+    }
+
+    get description(): string | undefined {
+        return this.value.description;
+    }
+
+    toPrimitive(): AbacRuleProps {
+        return {
+            id: this.value.id,
+            version: this.value.version,
+            effect: this.value.effect,
+            condition: this.value.condition as ConditionNode,
+            ...(this.value.description !== undefined
+                ? { description: this.value.description }
+                : {}),
+        };
+    }
+}
+
+export { AbacRule, type AbacRuleProps, type RuleEffect };

package/src/core/abac/index.ts

@@ -0,0 +1,21 @@
+// Barrel for the zod-free ABAC module: the pure rule/policy-set primitives, the
+// combining algorithms, the attribute→context flattening, the pure decisor, the
+// optional RBAC+ABAC composite, and the AbacAuthorizerPort seam (which physically
+// lives under application/ports/ but is surfaced here as the ABAC public home).
+
+export type { AbacAuthorizerPort } from "../application/ports/abac-authorizer.port.js";
+
+export type { AbacAttributes, AbacRequest } from "./abac-request.js";
+export { abacContext } from "./attributes.js";
+export { AbacAuthorizer, type AbacDecision } from "./authorizer.js";
+export type { CombiningAlgorithm } from "./combining.js";
+export {
+    type CompositeAccessRequest,
+    CompositeAuthorizer,
+} from "./composite-authorizer.js";
+export { AbacPolicySet } from "./domain/policy-set.js";
+export {
+    AbacRule,
+    type AbacRuleProps,
+    type RuleEffect,
+} from "./domain/rule.js";

package/src/core/application/ports/abac-authorizer.port.ts

@@ -0,0 +1,20 @@
+import type { AbacRequest } from "../../abac/abac-request.js";
+import type { AuthorizationError } from "../../errors/authorization-error.js";
+import type { Result } from "../../result/result.js";
+
+/**
+ * The seam an application layer injects to authorize an action by attributes —
+ * symmetric to {@link AuthorizerPort} (RBAC). The use case depends only on this
+ * contract; an adapter in the consumer's stack resolves the dynamic attributes
+ * (resource state, environment, RBAC facts) and delegates the decision to the
+ * pure `AbacAuthorizer`.
+ *
+ * Returns the decision as a {@link Result}: `ok(void)` when permitted, or
+ * `err(AuthorizationError)` carrying `reason: "policy_denied"` (or `"forbidden"`
+ * on a fail-closed evaluation error) that the HTTP boundary maps to a 403.
+ */
+interface AbacAuthorizerPort {
+    authorize(request: AbacRequest): Promise<Result<void, AuthorizationError>>;
+}
+
+export type { AbacAuthorizerPort };

package/src/core/application/ports/authorizer.port.ts

@@ -0,0 +1,22 @@
+import type { AuthorizationError } from "../../errors/authorization-error.js";
+import type { AccessRequest } from "../../rbac/access-request.js";
+import type { Result } from "../../result/result.js";
+
+/**
+ * The seam an application layer injects to authorize an action — symmetric to
+ * {@link PolicyPort}. The use case depends only on this contract; an adapter in
+ * the consumer's stack loads the actor's grants (from its own store) and
+ * delegates the decision to the pure `RbacAuthorizer`.
+ *
+ * Returns the decision as a {@link Result}: `ok(void)` when allowed, or
+ * `err(AuthorizationError)` carrying the discriminated `reason` the HTTP
+ * boundary maps to a 403. Promised here under `[extension-points]` in
+ * KIT_CONTEXT.md.
+ */
+interface AuthorizerPort {
+    authorize(
+        request: AccessRequest,
+    ): Promise<Result<void, AuthorizationError>>;
+}
+
+export type { AuthorizerPort };

package/src/core/errors/authorization-error.ts

@@ -158,6 +158,32 @@ class AuthorizationError extends AppError {
         });
     }
 
+    /**
+     * The actor holds no role at all that bears on the action — the most basic
+     * denial, distinct from {@link AuthorizationError.missingCapability} (which
+     * means the actor *has* roles, just none granting the required capability).
+     * The expected {@link AuthorizationRequirement} is recorded so the boundary
+     * can tell the caller what grant is missing.
+     *
+     * @param input - Factory options plus the `required` role/capability/scope.
+     */
+    static missingRole(
+        input: AuthorizationErrorFactoryOptions & {
+            required: AuthorizationRequirement;
+        },
+    ): AuthorizationError {
+        return new AuthorizationError({
+            message: "Missing required role to perform the action",
+            code: ErrorCodes.authorization.missingRole,
+            reason: "missing_role",
+            metadata: {
+                reason: "missing_role",
+                ...extractMetadataOnly(input),
+            },
+            ...extractAppErrorOptions(input),
+        });
+    }
+
     /**
      * The actor lacks a required role or capability. The expected
      * {@link AuthorizationRequirement} is recorded so the boundary can tell the

package/src/core/errors/error-codes.ts

@@ -8,6 +8,7 @@ const ErrorCodes = {
     authorization: {
         forbidden: "sec.authz.forbidden",
         policyDenied: "sec.authz.policy_denied",
+        missingRole: "sec.authz.missing_role",
         missingCapability: "sec.authz.missing_capability",
         outOfScope: "sec.authz.out_of_scope",
     },

package/src/core/index.ts

@@ -9,6 +9,13 @@ export {
     type ValueObjectPluginContract,
 } from "./domain/value-object.js";
 export * from "./domain/rulesets/index.js";
+// RBAC primitives (zod-free). Re-exported from the root for convenience;
+// consumers that want to stay off `zod` should prefer the dedicated `./rbac`
+// subpath, since the root barrel pulls in `./policies` (and therefore `zod`).
+export * from "./rbac/index.js";
+// ABAC primitives (zod-free), same rationale as RBAC re: the dedicated `./abac`
+// subpath for staying off `zod`.
+export * from "./abac/index.js";
 export * from "./plugins/index.js";
 export * from "./versioning/index.js";
 // NOTE: `./policies` re-exports Result/Ok/Err/Outcome/CommonOutcomeStatus and