@cullet/erp-core 1.4.0 → 2.0.0

package/dist/policy-service.d.cts

@@ -1,5 +1,5 @@
 import { r as Result } from "./result.cjs";
-import { O as GatePayload, a as PolicyDecisionId, c as TenantId, i as PolicyReporter, o as PolicyDefinitionId, s as SchoolId, y as GateOutcome } from "./core-config.cjs";
+import { D as GatePayload, a as PolicyDefinitionId, i as PolicyDecisionId, o as SchoolId, s as TenantId, t as CoreConfig, v as GateOutcome } from "./core-config.cjs";
 import { a as ComputeOutcome, l as ComputePayload, n as ComputeRegistry, t as GateEngineRegistry } from "./gate-engine-registry.cjs";
 
 //#region src/core/policies/catalog/catalog-types.d.ts
@@ -265,6 +265,17 @@ interface PolicyDefinitionRepository {
  * Seed data provided by the use case / caller.
  * Contains raw IDs and inputs that the context system will resolve into paths.
  * Each resolver is responsible for validating and extracting what it needs from fields.
+ *
+ * `tenantId`/`schoolId` are required on every seed, including evaluations scoped
+ * at TENANT or GLOBAL level. The `schoolId`/`SCHOOL` vocabulary is deliberately
+ * school-first: erp-core is a school ERP core, and a full-control copy targeting
+ * another domain is expected to rename these ids to its own leaf scope.
+ *
+ * `fields` is an open bag, but two keys are reserved by the pipeline and carry
+ * meaning beyond "just data":
+ * - `now` (a `Date`) pins the evaluation clock;
+ * - `asOf` (a `Date`) supplies the instant for `asOfSource: "CALLER_PROVIDED"`.
+ * See {@link EvaluateInput} and {@link PolicyAsOfResolver}.
  */
 interface ContextSeed {
   readonly tenantId: TenantId;
@@ -295,6 +306,11 @@ interface ContextResolverResilienceOptions {
 /**
  * A resolver that knows how to produce a value for a specific context path.
  * Designed as async to allow future DB/API lookups without breaking the interface.
+ *
+ * Resolvers MUST be idempotent, side-effect-free reads. The builder's timeout
+ * is a race with no cancellation, so a timed-out resolver keeps running; with
+ * retry enabled it may also be invoked several times for one path. Anything but
+ * a pure lookup here risks duplicated effects.
  */
 interface ContextValueResolver {
   readonly path: string;
@@ -351,6 +367,13 @@ declare class PolicyContextBuilder {
   /**
    * Resolves all required context paths and returns a flat context object.
    * If any required path cannot be resolved, returns an error.
+   *
+   * Resolution is deliberately sequential and fail-fast: paths resolve in
+   * order and the first failure returns immediately, so later resolvers never
+   * run once one path fails. This trades the latency-hiding of parallel
+   * resolution for skipping downstream (potentially expensive) lookups on a
+   * doomed evaluation. It is a tested contract, not an oversight — flip it to
+   * `Promise.all` only if you also accept that every resolver always runs.
    */
   build(requirements: readonly string[], seed: ContextSeed): Promise<Result<Record<string, unknown>, string>>;
 }
@@ -359,6 +382,18 @@ declare class PolicyContextBuilder {
 interface DeriveAsOfOptions {
   readonly maxFutureYears?: number;
 }
+/**
+ * Derives the `asOf` instant an evaluation is pinned to.
+ *
+ * With `asOfSource: "CALLER_PROVIDED"` the instant comes from the reserved
+ * `seed.fields.asOf` key (a `Date`); with `"NOW"` it is the evaluation clock.
+ *
+ * The bound is intentionally asymmetric: a caller-provided `asOf` may be at
+ * most `maxFutureYears` in the future (a fat-finger / clock-skew guard against
+ * selecting a not-yet-in-force policy), but is unbounded in the past — querying
+ * how a policy stood at any historical instant is a first-class use of a
+ * temporal engine, so back-dating is never capped.
+ */
 declare class PolicyAsOfResolver {
   private static resolveMaxFutureYears;
   static derive(source: AsOfSource, seed: ContextSeed, now: Date, options?: DeriveAsOfOptions): Result<Date, string>;
@@ -455,6 +490,21 @@ declare class PolicyEvaluationErrors {
  * `contextVersion` pins which context schema applies, and `seed` carries the
  * raw facts the context builder expands. `decisionId` is the caller's
  * idempotency/audit handle, echoed back on the result.
+ *
+ * `contextVersion` is a caller assertion, not a proof: it filters which
+ * definitions are compatible, but nothing checks that the context actually
+ * built matches the declared version — supplying the right number is the
+ * caller's contract.
+ *
+ * Two `seed.fields` keys are reserved and change what "now" means for this
+ * evaluation:
+ * - `now` (a `Date`) pins the evaluation clock — it feeds `evaluatedAt`, the
+ *   `asOf` derivation, and therefore which effective-dated definitions are in
+ *   force. Leave it unset to use wall-clock time.
+ * - `asOf` (a `Date`) is consumed when the policy's `asOfSource` is
+ *   `CALLER_PROVIDED` (see {@link PolicyAsOfResolver}).
+ * Whoever assembles `fields` from untrusted input owns the consequence: a
+ * caller who can set these keys can shift which policy version is selected.
  */
 interface EvaluateInput {
   readonly decisionId: PolicyDecisionId;
@@ -464,14 +514,13 @@ interface EvaluateInput {
   readonly seed: ContextSeed;
 }
 /**
- * Cross-cutting knobs for a {@link PolicyService}: how the as-of instant is
- * derived ({@link asOf}) and where evaluation telemetry is sent
- * ({@link reporter}). Both are optional; the service defaults to a silent
- * reporter so telemetry is opt-in.
+ * Cross-cutting knobs for a {@link PolicyService}: today just how the as-of
+ * instant is derived ({@link asOf}). Telemetry is not configured here — it
+ * flows through the injected {@link CoreConfig}, the core's single
+ * observability seam, so a host wires reporting in one place.
  */
 interface PolicyServiceOptions {
   readonly asOf?: DeriveAsOfOptions;
-  readonly reporter?: PolicyReporter;
 }
 /**
  * The collaborators a {@link PolicyService} is wired with. Each is an injected
@@ -486,6 +535,12 @@ interface PolicyServiceParams {
   readonly resolver: PolicyResolver;
   readonly gateEngines: GateEngineRegistry;
   readonly computeRegistry: ComputeRegistry;
+  /**
+   * The observability seam telemetry is emitted through. Defaults to the
+   * shared {@link coreConfig} singleton; inject an isolated instance for
+   * tests or multi-tenant hosts.
+   */
+  readonly coreConfig?: CoreConfig;
   readonly options?: PolicyServiceOptions;
 }
 /** Union of all possible policy decision Outcomes. */
@@ -494,8 +549,11 @@ type PolicyDecision = GateOutcome | ComputeOutcome;
  * The full record of one successful evaluation. Beyond the business
  * {@link decision}, it pins the exact definition that produced it — id, key,
  * version, payload hash, and engine version — together with the `asOf` instant
- * the policy was selected for and the wall-clock `evaluatedAt`. That provenance
- * is what makes a decision reproducible and auditable after the fact.
+ * the policy was selected for and `evaluatedAt`, the instant evaluation ran at.
+ * `evaluatedAt` is wall-clock time unless the caller pinned it via
+ * `seed.fields.now` (see {@link EvaluateInput}), in which case it echoes that.
+ * That provenance is what makes a decision reproducible and auditable after the
+ * fact.
  */
 interface PolicyEvaluationResult {
   readonly decisionId: PolicyDecisionId;
@@ -527,7 +585,7 @@ interface PolicyEvaluationResult {
  * evaluation — which keeps observability strictly side-band.
  */
 declare class PolicyService {
-  #private;
+  private readonly coreConfig;
   private readonly catalog;
   private readonly contextBuilder;
   private readonly defRepo;
@@ -553,6 +611,11 @@ declare class PolicyService {
    * @returns A `Result` carrying the decision or the evaluation error.
    */
   evaluate(input: EvaluateInput): Promise<Result<PolicyEvaluationResult, PolicyEvaluationError>>;
+  private runEvaluation;
+  private resolveCatalogVariant;
+  private resolveCatalogFamily;
+  private findCandidates;
+  private executeEngine;
 }
 //#endregion
 export { PolicyScope as A, BasePolicyDefinitionProps as C, PolicyDefinition as D, GatePolicyDefinitionProps as E, PolicyKey as F, AsOfSource as I, PolicyKind as L, ScopeChain as M, PolicyCatalog as N, PolicyDefinitionProps as O, PolicyCatalogEntryProps as P, PolicyOwner as R, PolicyDefinitionRepository as S, FindCandidatesParams as T, ContextResolverResilienceOptions as _, PolicyServiceOptions as a, ContextSeed as b, PolicyEvaluationErrors as c, PolicyAsOfResolver as d, PolicyContextBuilder as f, ContextResolverCircuitBreakerOptions as g, registerNamespacedContextResolversIn as h, PolicyService as i, PolicyScopeMatcher as j, PolicyDefinitionStatus as k, PolicyResolver as l, ContextResolverRegistry as m, PolicyDecision as n, PolicyServiceParams as o, PolicyContextBuilderOptions as p, PolicyEvaluationResult as r, PolicyEvaluationError as s, EvaluateInput as t, DeriveAsOfOptions as u, ContextResolverRetryOptions as v, ComputePolicyDefinitionProps as w, ContextSeedValidator as x, ContextValueResolver as y, PolicyScopeLevel as z };

package/dist/policy-service.d.ts

@@ -1,5 +1,5 @@
 import { r as Result } from "./result.js";
-import { O as GatePayload, a as PolicyDecisionId, c as TenantId, i as PolicyReporter, o as PolicyDefinitionId, s as SchoolId, y as GateOutcome } from "./core-config.js";
+import { D as GatePayload, a as PolicyDefinitionId, i as PolicyDecisionId, o as SchoolId, s as TenantId, t as CoreConfig, v as GateOutcome } from "./core-config.js";
 import { a as ComputeOutcome, l as ComputePayload, n as ComputeRegistry, t as GateEngineRegistry } from "./gate-engine-registry.js";
 
 //#region src/core/policies/catalog/catalog-types.d.ts
@@ -265,6 +265,17 @@ interface PolicyDefinitionRepository {
  * Seed data provided by the use case / caller.
  * Contains raw IDs and inputs that the context system will resolve into paths.
  * Each resolver is responsible for validating and extracting what it needs from fields.
+ *
+ * `tenantId`/`schoolId` are required on every seed, including evaluations scoped
+ * at TENANT or GLOBAL level. The `schoolId`/`SCHOOL` vocabulary is deliberately
+ * school-first: erp-core is a school ERP core, and a full-control copy targeting
+ * another domain is expected to rename these ids to its own leaf scope.
+ *
+ * `fields` is an open bag, but two keys are reserved by the pipeline and carry
+ * meaning beyond "just data":
+ * - `now` (a `Date`) pins the evaluation clock;
+ * - `asOf` (a `Date`) supplies the instant for `asOfSource: "CALLER_PROVIDED"`.
+ * See {@link EvaluateInput} and {@link PolicyAsOfResolver}.
  */
 interface ContextSeed {
   readonly tenantId: TenantId;
@@ -295,6 +306,11 @@ interface ContextResolverResilienceOptions {
 /**
  * A resolver that knows how to produce a value for a specific context path.
  * Designed as async to allow future DB/API lookups without breaking the interface.
+ *
+ * Resolvers MUST be idempotent, side-effect-free reads. The builder's timeout
+ * is a race with no cancellation, so a timed-out resolver keeps running; with
+ * retry enabled it may also be invoked several times for one path. Anything but
+ * a pure lookup here risks duplicated effects.
  */
 interface ContextValueResolver {
   readonly path: string;
@@ -351,6 +367,13 @@ declare class PolicyContextBuilder {
   /**
    * Resolves all required context paths and returns a flat context object.
    * If any required path cannot be resolved, returns an error.
+   *
+   * Resolution is deliberately sequential and fail-fast: paths resolve in
+   * order and the first failure returns immediately, so later resolvers never
+   * run once one path fails. This trades the latency-hiding of parallel
+   * resolution for skipping downstream (potentially expensive) lookups on a
+   * doomed evaluation. It is a tested contract, not an oversight — flip it to
+   * `Promise.all` only if you also accept that every resolver always runs.
    */
   build(requirements: readonly string[], seed: ContextSeed): Promise<Result<Record<string, unknown>, string>>;
 }
@@ -359,6 +382,18 @@ declare class PolicyContextBuilder {
 interface DeriveAsOfOptions {
   readonly maxFutureYears?: number;
 }
+/**
+ * Derives the `asOf` instant an evaluation is pinned to.
+ *
+ * With `asOfSource: "CALLER_PROVIDED"` the instant comes from the reserved
+ * `seed.fields.asOf` key (a `Date`); with `"NOW"` it is the evaluation clock.
+ *
+ * The bound is intentionally asymmetric: a caller-provided `asOf` may be at
+ * most `maxFutureYears` in the future (a fat-finger / clock-skew guard against
+ * selecting a not-yet-in-force policy), but is unbounded in the past — querying
+ * how a policy stood at any historical instant is a first-class use of a
+ * temporal engine, so back-dating is never capped.
+ */
 declare class PolicyAsOfResolver {
   private static resolveMaxFutureYears;
   static derive(source: AsOfSource, seed: ContextSeed, now: Date, options?: DeriveAsOfOptions): Result<Date, string>;
@@ -455,6 +490,21 @@ declare class PolicyEvaluationErrors {
  * `contextVersion` pins which context schema applies, and `seed` carries the
  * raw facts the context builder expands. `decisionId` is the caller's
  * idempotency/audit handle, echoed back on the result.
+ *
+ * `contextVersion` is a caller assertion, not a proof: it filters which
+ * definitions are compatible, but nothing checks that the context actually
+ * built matches the declared version — supplying the right number is the
+ * caller's contract.
+ *
+ * Two `seed.fields` keys are reserved and change what "now" means for this
+ * evaluation:
+ * - `now` (a `Date`) pins the evaluation clock — it feeds `evaluatedAt`, the
+ *   `asOf` derivation, and therefore which effective-dated definitions are in
+ *   force. Leave it unset to use wall-clock time.
+ * - `asOf` (a `Date`) is consumed when the policy's `asOfSource` is
+ *   `CALLER_PROVIDED` (see {@link PolicyAsOfResolver}).
+ * Whoever assembles `fields` from untrusted input owns the consequence: a
+ * caller who can set these keys can shift which policy version is selected.
  */
 interface EvaluateInput {
   readonly decisionId: PolicyDecisionId;
@@ -464,14 +514,13 @@ interface EvaluateInput {
   readonly seed: ContextSeed;
 }
 /**
- * Cross-cutting knobs for a {@link PolicyService}: how the as-of instant is
- * derived ({@link asOf}) and where evaluation telemetry is sent
- * ({@link reporter}). Both are optional; the service defaults to a silent
- * reporter so telemetry is opt-in.
+ * Cross-cutting knobs for a {@link PolicyService}: today just how the as-of
+ * instant is derived ({@link asOf}). Telemetry is not configured here — it
+ * flows through the injected {@link CoreConfig}, the core's single
+ * observability seam, so a host wires reporting in one place.
  */
 interface PolicyServiceOptions {
   readonly asOf?: DeriveAsOfOptions;
-  readonly reporter?: PolicyReporter;
 }
 /**
  * The collaborators a {@link PolicyService} is wired with. Each is an injected
@@ -486,6 +535,12 @@ interface PolicyServiceParams {
   readonly resolver: PolicyResolver;
   readonly gateEngines: GateEngineRegistry;
   readonly computeRegistry: ComputeRegistry;
+  /**
+   * The observability seam telemetry is emitted through. Defaults to the
+   * shared {@link coreConfig} singleton; inject an isolated instance for
+   * tests or multi-tenant hosts.
+   */
+  readonly coreConfig?: CoreConfig;
   readonly options?: PolicyServiceOptions;
 }
 /** Union of all possible policy decision Outcomes. */
@@ -494,8 +549,11 @@ type PolicyDecision = GateOutcome | ComputeOutcome;
  * The full record of one successful evaluation. Beyond the business
  * {@link decision}, it pins the exact definition that produced it — id, key,
  * version, payload hash, and engine version — together with the `asOf` instant
- * the policy was selected for and the wall-clock `evaluatedAt`. That provenance
- * is what makes a decision reproducible and auditable after the fact.
+ * the policy was selected for and `evaluatedAt`, the instant evaluation ran at.
+ * `evaluatedAt` is wall-clock time unless the caller pinned it via
+ * `seed.fields.now` (see {@link EvaluateInput}), in which case it echoes that.
+ * That provenance is what makes a decision reproducible and auditable after the
+ * fact.
  */
 interface PolicyEvaluationResult {
   readonly decisionId: PolicyDecisionId;
@@ -527,7 +585,7 @@ interface PolicyEvaluationResult {
  * evaluation — which keeps observability strictly side-band.
  */
 declare class PolicyService {
-  #private;
+  private readonly coreConfig;
   private readonly catalog;
   private readonly contextBuilder;
   private readonly defRepo;
@@ -553,6 +611,11 @@ declare class PolicyService {
    * @returns A `Result` carrying the decision or the evaluation error.
    */
   evaluate(input: EvaluateInput): Promise<Result<PolicyEvaluationResult, PolicyEvaluationError>>;
+  private runEvaluation;
+  private resolveCatalogVariant;
+  private resolveCatalogFamily;
+  private findCandidates;
+  private executeEngine;
 }
 //#endregion
 export { PolicyScope as A, BasePolicyDefinitionProps as C, PolicyDefinition as D, GatePolicyDefinitionProps as E, PolicyKey as F, AsOfSource as I, PolicyKind as L, ScopeChain as M, PolicyCatalog as N, PolicyDefinitionProps as O, PolicyCatalogEntryProps as P, PolicyOwner as R, PolicyDefinitionRepository as S, FindCandidatesParams as T, ContextResolverResilienceOptions as _, PolicyServiceOptions as a, ContextSeed as b, PolicyEvaluationErrors as c, PolicyAsOfResolver as d, PolicyContextBuilder as f, ContextResolverCircuitBreakerOptions as g, registerNamespacedContextResolversIn as h, PolicyService as i, PolicyScopeMatcher as j, PolicyDefinitionStatus as k, PolicyResolver as l, ContextResolverRegistry as m, PolicyDecision as n, PolicyServiceParams as o, PolicyContextBuilderOptions as p, PolicyEvaluationResult as r, PolicyEvaluationError as s, EvaluateInput as t, DeriveAsOfOptions as u, ContextResolverRetryOptions as v, ComputePolicyDefinitionProps as w, ContextSeedValidator as x, ContextValueResolver as y, PolicyScopeLevel as z };

package/dist/policy-service.js

@@ -1,12 +1,13 @@
-import { n as sha256Hex, r as stableStringify } from "./hashing.js";
+import { t as InvariantViolationException } from "./invariant-violation-exception.js";
+import { r as isValidDate } from "./temporal-guards.js";
+import { t as canonicalStringify } from "./stable-stringify.js";
+import { n as sha256Hex } from "./hashing.js";
 import { t as UnexpectedError } from "./unexpected-error.js";
 import { t as ValidationCode } from "./validation-code.js";
 import { t as ValidationField } from "./validation-field.js";
-import { t as InvariantViolationException } from "./invariant-violation-exception.js";
 import { t as InvalidValueException } from "./validation-exception.js";
-import { r as isValidDate } from "./temporal-guards.js";
 import { r as Result } from "./result.js";
-import { a as SilentPolicyReporter, n as PolicyContextPath } from "./condition-evaluator.js";
+import { n as PolicyContextPath, r as coreConfig } from "./condition-evaluator.js";
 //#region src/core/policies/context/context-builder.ts
 const DEFAULT_RESOLVER_RETRY_OPTIONS = {
 	maxAttempts: 1,
@@ -153,6 +154,13 @@ var PolicyContextBuilder = class PolicyContextBuilder {
 	/**
 	* Resolves all required context paths and returns a flat context object.
 	* If any required path cannot be resolved, returns an error.
+	*
+	* Resolution is deliberately sequential and fail-fast: paths resolve in
+	* order and the first failure returns immediately, so later resolvers never
+	* run once one path fails. This trades the latency-hiding of parallel
+	* resolution for skipping downstream (potentially expensive) lookups on a
+	* doomed evaluation. It is a tested contract, not an oversight — flip it to
+	* `Promise.all` only if you also accept that every resolver always runs.
 	*/
 	async build(requirements, seed) {
 		const context = {};
@@ -250,6 +258,8 @@ var ContextSeedValidator = class ContextSeedValidator {
 * Array item order is preserved on purpose; callers that treat arrays as sets
 * must normalize or sort them before hashing.
 *
+* The strict canonical form is owned by `shared/stable-stringify`
+* ({@link canonicalStringify}); this class just composes it with SHA-256.
 * Values that JSON.stringify would silently drop or coerce (undefined,
 * non-finite numbers, functions, symbols, bigint) are rejected up-front to
 * prevent semantically different payloads from collapsing to the same hash.
@@ -258,28 +268,8 @@ var PolicyHashing = class PolicyHashing {
 	static sha256(input) {
 		return sha256Hex(input);
 	}
-	static assertHashable(value, path, seen) {
-		if (value === null) return;
-		const type = typeof value;
-		if (type === "undefined") throw new TypeError(`canonicalJson does not accept undefined values (at ${path})`);
-		if (type === "number" && !Number.isFinite(value)) throw new TypeError(`canonicalJson does not accept non-finite numbers (at ${path}, value: ${String(value)})`);
-		if (type === "bigint" || type === "function" || type === "symbol") throw new TypeError(`canonicalJson does not accept ${type} values (at ${path})`);
-		if (type !== "object") return;
-		if (value instanceof Date) {
-			if (!isValidDate(value)) throw new TypeError(`canonicalJson does not accept Invalid Date (at ${path})`);
-			return;
-		}
-		if (seen.has(value)) throw new TypeError(`canonicalJson does not accept circular references (at ${path})`);
-		seen.add(value);
-		if (Array.isArray(value)) value.forEach((item, index) => {
-			PolicyHashing.assertHashable(item, `${path}[${index}]`, seen);
-		});
-		else for (const [key, nested] of Object.entries(value)) PolicyHashing.assertHashable(nested, `${path}.${key}`, seen);
-		seen.delete(value);
-	}
 	static canonicalJson(value) {
-		PolicyHashing.assertHashable(value, "$", /* @__PURE__ */ new WeakSet());
-		return stableStringify(value);
+		return canonicalStringify(value);
 	}
 	static computePayloadHash(payload, policyKey, policyVersion) {
 		const canonical = PolicyHashing.canonicalJson({
@@ -394,7 +384,7 @@ var PolicyCatalogEntry = class PolicyCatalogEntry {
 		return this.tags.includes(tag);
 	}
 	equals(other) {
-		return this.key.equals(other.key);
+		return this.toVariantKey() === other.toVariantKey();
 	}
 	toJSON() {
 		return {
@@ -489,7 +479,7 @@ var PolicyCatalog = class {
 		if (!family || family.length === 0) return Result.err(`Policy not found in catalog: "${params.key}"`);
 		const exactMatch = family.find((entry) => entry.matchesVersion(params));
 		if (exactMatch) return Result.ok(exactMatch);
-		if (family.length === 1 && !family[0].hasExplicitVersionSelector()) return Result.ok(family[0]);
+		if (family.length === 1 && family[0].kind === params.kind && !family[0].hasExplicitVersionSelector()) return Result.ok(family[0]);
 		const versionDetails = [
 			params.kind,
 			params.gateEngineVersion !== void 0 ? `gateEngineVersion=${params.gateEngineVersion}` : null,
@@ -581,7 +571,6 @@ var PolicyScopeMatcher = class PolicyScopeMatcher {
 //#region src/core/policies/defs/in-memory-policy-definition-repo.ts
 var InMemoryPolicyDefinitionRepository = class {
 	constructor(definitions) {
-		this.definitions = definitions;
 		this.definitionsByPolicyKey = definitions.reduce((index, definition) => {
 			const existingDefinitions = index.get(definition.policyKey) ?? [];
 			existingDefinitions.push(definition);
@@ -725,6 +714,18 @@ var PolicyDefinition = class PolicyDefinition {
 //#endregion
 //#region src/core/policies/asof/asof.ts
 const DEFAULT_MAX_AS_OF_FUTURE_YEARS = 10;
+/**
+* Derives the `asOf` instant an evaluation is pinned to.
+*
+* With `asOfSource: "CALLER_PROVIDED"` the instant comes from the reserved
+* `seed.fields.asOf` key (a `Date`); with `"NOW"` it is the evaluation clock.
+*
+* The bound is intentionally asymmetric: a caller-provided `asOf` may be at
+* most `maxFutureYears` in the future (a fat-finger / clock-skew guard against
+* selecting a not-yet-in-force policy), but is unbounded in the past — querying
+* how a policy stood at any historical instant is a first-class use of a
+* temporal engine, so back-dating is never capped.
+*/
 var PolicyAsOfResolver = class PolicyAsOfResolver {
 	static resolveMaxFutureYears(options) {
 		const maxFutureYears = options.maxFutureYears ?? DEFAULT_MAX_AS_OF_FUTURE_YEARS;
@@ -866,7 +867,6 @@ var PolicyEvaluationErrors = class {
 * evaluation — which keeps observability strictly side-band.
 */
 var PolicyService = class {
-	#reporter;
 	constructor(params) {
 		this.catalog = params.catalog;
 		this.contextBuilder = params.contextBuilder;
@@ -875,12 +875,7 @@ var PolicyService = class {
 		this.gateEngines = params.gateEngines;
 		this.computeRegistry = params.computeRegistry;
 		this.options = params.options ?? {};
-		this.#reporter = this.options.reporter ?? new SilentPolicyReporter();
-	}
-	#reportSafely(event) {
-		try {
-			this.#reporter.report(event);
-		} catch {}
+		this.coreConfig = params.coreConfig ?? coreConfig;
 	}
 	resolveEvaluationNow(seed) {
 		const candidate = seed.fields["now"];
@@ -904,10 +899,10 @@ var PolicyService = class {
 	* @returns A `Result` carrying the decision or the evaluation error.
 	*/
 	async evaluate(input) {
-		const result = await this.#evaluate(input);
+		const result = await this.runEvaluation(input);
 		if (result.isErr()) {
 			const error = result.errorOrNull();
-			this.#reportSafely({
+			this.coreConfig.reportSafely({
 				kind: "policy-evaluation-failed",
 				level: "error",
 				policyKey: "policyKey" in error ? error.policyKey : void 0,
@@ -918,7 +913,7 @@ var PolicyService = class {
 			});
 		} else {
 			const ok = result.getOrNull();
-			this.#reportSafely({
+			this.coreConfig.reportSafely({
 				kind: "policy-evaluation-completed",
 				level: "info",
 				policyKey: ok.ref.policyKey,
@@ -929,11 +924,11 @@ var PolicyService = class {
 		}
 		return result;
 	}
-	async #evaluate(input) {
+	async runEvaluation(input) {
 		const seedResult = ContextSeedValidator.validate(input.seed);
 		if (seedResult.isErr()) return Result.err(PolicyEvaluationErrors.invalidContext("SEED_VALIDATION", input.policyKey, seedResult.errorOrNull()));
 		const seed = seedResult.getOrNull();
-		const catalogFamilyResult = this.#resolveCatalogFamily(input.policyKey);
+		const catalogFamilyResult = this.resolveCatalogFamily(input.policyKey);
 		if (catalogFamilyResult.isErr()) return Result.err(catalogFamilyResult.errorOrNull());
 		const { key: policyKey, family } = catalogFamilyResult.getOrNull();
 		const familyEntry = family[0];
@@ -943,10 +938,10 @@ var PolicyService = class {
 		const asOfResult = PolicyAsOfResolver.derive(familyEntry.asOfSource, seed, now, this.options.asOf);
 		if (asOfResult.isErr()) return Result.err(PolicyEvaluationErrors.invalidContext("AS_OF_DERIVATION", policyKey, asOfResult.errorOrNull()));
 		const asOf = asOfResult.getOrNull();
-		const definitionResult = this.#findCandidates(policyKey, familyEntry.kind, asOf, input);
+		const definitionResult = this.findCandidates(policyKey, familyEntry.kind, asOf, input);
 		if (definitionResult.isErr()) return Result.err(definitionResult.errorOrNull());
 		const { definition: policyDefinition, catalogEntry: versionedCatalogEntry } = definitionResult.getOrNull();
-		this.#reportSafely({
+		this.coreConfig.reportSafely({
 			kind: "policy-resolution",
 			level: "info",
 			policyKey,
@@ -959,7 +954,7 @@ var PolicyService = class {
 		const ctxResult = await this.contextBuilder.build(versionedCatalogEntry.contextRequirements, seed);
 		if (ctxResult.isErr()) return Result.err(PolicyEvaluationErrors.invalidContext("CONTEXT_BUILD", policyKey, ctxResult.errorOrNull()));
 		const context = ctxResult.getOrNull();
-		const decisionResult = this.#executeEngine(policyKey, policyDefinition, context);
+		const decisionResult = this.executeEngine(policyKey, policyDefinition, context);
 		if (decisionResult.isErr()) return Result.err(decisionResult.errorOrNull());
 		const decision = decisionResult.getOrNull();
 		const result = {
@@ -979,7 +974,7 @@ var PolicyService = class {
 		};
 		return Result.ok(result);
 	}
-	#resolveCatalogVariant(definition) {
+	resolveCatalogVariant(definition) {
 		return this.catalog.getVersioned({
 			key: definition.policyKey,
 			kind: definition.kind,
@@ -987,7 +982,7 @@ var PolicyService = class {
 			payloadSchemaVersion: definition.payloadSchemaVersion
 		});
 	}
-	#resolveCatalogFamily(rawKey) {
+	resolveCatalogFamily(rawKey) {
 		const keyResult = PolicyKey.parse(rawKey);
 		if (keyResult.isErr()) return Result.err(PolicyEvaluationErrors.invalidPolicyKey(rawKey, keyResult.errorOrNull()));
 		const policyKey = keyResult.getOrNull().toString();
@@ -998,7 +993,7 @@ var PolicyService = class {
 			family: catalogFamilyResult.getOrNull()
 		});
 	}
-	#findCandidates(policyKey, policyKind, asOf, input) {
+	findCandidates(policyKey, policyKind, asOf, input) {
 		const candidates = this.defRepo.findCandidates({
 			policyKey,
 			kind: policyKind,
@@ -1010,7 +1005,7 @@ var PolicyService = class {
 		const compatibleCandidatesByDefinitionId = /* @__PURE__ */ new Map();
 		const incompatibleVariantErrorsByDefinitionId = /* @__PURE__ */ new Map();
 		for (const candidate of candidates) {
-			const compatibilityResult = this.#resolveCatalogVariant(candidate);
+			const compatibilityResult = this.resolveCatalogVariant(candidate);
 			if (compatibilityResult.isErr()) {
 				incompatibleVariantErrorsByDefinitionId.set(candidate.id, compatibilityResult.errorOrNull());
 				continue;
@@ -1042,7 +1037,7 @@ var PolicyService = class {
 		if (resolvedCandidate === void 0) return Result.err(PolicyEvaluationErrors.policyDefinitionNotFound(policyKey, asOf, input.contextVersion, `Resolved definition "${bestDefinition.id}" is not present among compatible catalog variants`));
 		return Result.ok(resolvedCandidate);
 	}
-	#executeEngine(policyKey, definition, context) {
+	executeEngine(policyKey, definition, context) {
 		if (definition.isGate()) {
 			const gateResult = this.gateEngines.evaluate(definition.gateEngineVersion, definition.payloadJson, context);
 			if (gateResult.isErr()) return Result.err(PolicyEvaluationErrors.engineFailure(policyKey, "GATE", definition.gateEngineVersion, gateResult.errorOrNull()));