@cullet/erp-core 1.4.0 → 2.0.0

package/dist/plugin.cjs

@@ -3,11 +3,23 @@
 * Registry that holds a set of plugins implementing a shared {@link PluginContract}
 * and resolves which of them answer a given extension point.
 *
-* Plugins are kept sorted by priority (descending). For a given method,
-* {@link invoke} either delegates to the highest-priority enabled plugin
-* (`'first'`) or folds every enabled plugin into a single value (`'pipeline'`).
-* When no plugin is enabled, the supplied `fallback` runs instead, so the host
-* always has defined behaviour even with an empty registry.
+* Plugins are kept sorted by priority (descending); ties keep registration
+* order (the sort is stable). For a given method, {@link invoke} either
+* delegates to the highest-priority enabled plugin (`'first'`) or folds every
+* enabled plugin into a single value (`'pipeline'`). When no plugin is enabled,
+* the supplied `fallback` runs instead, so the host always has defined
+* behaviour even with an empty registry.
+*
+* `name` is a unique key: registering a plugin whose name already exists
+* replaces the previous one, so register/enable/disable/unregister all address
+* the same single plugin.
+*
+* Plugins run arbitrary host code and are trusted: {@link invoke} does NOT wrap
+* them in try/catch. A throwing plugin propagates to the caller (and, in
+* `'pipeline'` mode, discards the accumulated result). Error handling, logging
+* and retries are the host's responsibility by design — the registry's only
+* defined-behaviour guarantee is `fallback` for an empty registry. Every plugin
+* is expected to implement the full contract `P` (the types enforce it).
 *
 * @typeParam P - The plugin contract this manager coordinates.
 */
@@ -15,8 +27,10 @@ var PluginManager = class {
 	constructor() {
 		this.plugins = [];
 	}
-	/** Registers one or more plugins and re-sorts by priority. */
+	/** Registers one or more plugins (replacing any with the same name) and re-sorts by priority. */
 	register(...plugins) {
+		const incoming = new Set(plugins.map((p) => p.name));
+		this.plugins = this.plugins.filter((p) => !incoming.has(p.name));
 		this.plugins.push(...plugins);
 		this.reorder();
 	}
@@ -48,18 +62,14 @@ var PluginManager = class {
 	*/
 	invoke(method, args, opts) {
 		const { mode = "first", fallback, reducer } = opts;
-		const enabled = this.list().filter((p) => method in p);
+		const enabled = this.list();
 		if (enabled.length === 0) return fallback(...args);
-		if (mode === "first") {
-			const fn = enabled[0][method];
-			return fn(...args);
-		}
+		if (mode === "first") return enabled[0][method](...args);
 		const defaultReducer = (_, curr) => curr;
 		const red = reducer ?? defaultReducer;
 		let acc = enabled[0][method](...args);
 		enabled.slice(1).forEach((plugin, idx) => {
-			const res = plugin[method](...args);
-			acc = red(acc, res, plugin, idx + 1);
+			acc = red(acc, plugin[method](...args), plugin, idx + 1);
 		});
 		return acc;
 	}

package/dist/plugin.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.cjs","names":[],"sources":["../src/core/plugins/plugin.ts"],"sourcesContent":["import {\n    type BasePlugin,\n    type InvokeOptions,\n    type PipelineReducer,\n    type PluginContract,\n} from \"./types.js\";\n\n/**\n * Registry that holds a set of plugins implementing a shared {@link PluginContract}\n * and resolves which of them answer a given extension point.\n *\n * Plugins are kept sorted by priority (descending). For a given method,\n * {@link invoke} either delegates to the highest-priority enabled plugin\n * (`'first'`) or folds every enabled plugin into a single value (`'pipeline'`).\n * When no plugin is enabled, the supplied `fallback` runs instead, so the host\n * always has defined behaviour even with an empty registry.\n *\n * @typeParam P - The plugin contract this manager coordinates.\n */\nclass PluginManager<P extends PluginContract> {\n    /** Internal list, kept sorted by priority (desc). */\n    private plugins: (P & BasePlugin)[] = [];\n\n    /** Registers one or more plugins and re-sorts by priority. */\n    public register(...plugins: (P & BasePlugin)[]): void {\n        this.plugins.push(...plugins);\n        this.reorder();\n    }\n\n    /** Removes a previously registered plugin by name. */\n    public unregister(name: string): void {\n        this.plugins = this.plugins.filter((p) => p.name !== name);\n    }\n\n    /** Enables a registered plugin by name. */\n    public enable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = true;\n    }\n\n    /** Disables a registered plugin by name (without removing it). */\n    public disable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = false;\n    }\n\n    /** Lists enabled plugins only, already in priority order. */\n    public list(): readonly (P & BasePlugin)[] {\n        return this.plugins.filter((p) => p.enabled !== false);\n    }\n\n    /**\n     * Resolves `method` against the registered plugins.\n     *\n     * In `'first'` mode the highest-priority enabled plugin that implements\n     * `method` answers. In `'pipeline'` mode every enabled plugin runs and the\n     * results are folded with `reducer` (defaults to \"keep the last result\").\n     * When no enabled plugin implements `method`, `fallback` is called.\n     */\n    public invoke<K extends keyof P>(\n        method: K,\n        args: Parameters<P[K]>,\n        opts: InvokeOptions<P, K>,\n    ): ReturnType<P[K]> {\n        const { mode = \"first\", fallback, reducer } = opts;\n        const enabled = this.list().filter((p) => method in p) as Array<\n            P & BasePlugin\n        >;\n\n        if (enabled.length === 0) {\n            return (fallback as P[K])(...args);\n        }\n\n        if (mode === \"first\") {\n            const fn = enabled[0][method] as P[K];\n            return fn(...args);\n        }\n\n        const defaultReducer: PipelineReducer<ReturnType<P[K]>, P> = (\n            _,\n            curr,\n        ) => curr;\n        const red = reducer ?? defaultReducer;\n\n        let acc: ReturnType<P[K]> = enabled[0][method]!(...args);\n        enabled.slice(1).forEach((plugin, idx) => {\n            const res = plugin[method]!(...args);\n            acc = red(acc, res, plugin, idx + 1);\n        });\n        return acc;\n    }\n\n    /** Re-sorts the internal list by priority (desc; default priority = 0). */\n    private reorder(): void {\n        this.plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));\n    }\n}\n\nexport { PluginManager };\n"],"mappings":";;;;;;;;;;;;;AAmBA,IAAM,gBAAN,MAA8C;;iBAEJ,CAAC;;;CAGvC,SAAgB,GAAG,SAAmC;EAClD,KAAK,QAAQ,KAAK,GAAG,OAAO;EAC5B,KAAK,QAAQ;CACjB;;CAGA,WAAkB,MAAoB;EAClC,KAAK,UAAU,KAAK,QAAQ,QAAQ,MAAM,EAAE,SAAS,IAAI;CAC7D;;CAGA,OAAc,MAAoB;EAC9B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,QAAe,MAAoB;EAC/B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,OAA2C;EACvC,OAAO,KAAK,QAAQ,QAAQ,MAAM,EAAE,YAAY,KAAK;CACzD;;;;;;;;;CAUA,OACI,QACA,MACA,MACgB;EAChB,MAAM,EAAE,OAAO,SAAS,UAAU,YAAY;EAC9C,MAAM,UAAU,KAAK,KAAK,EAAE,QAAQ,MAAM,UAAU,CAAC;EAIrD,IAAI,QAAQ,WAAW,GACnB,OAAQ,SAAkB,GAAG,IAAI;EAGrC,IAAI,SAAS,SAAS;GAClB,MAAM,KAAK,QAAQ,GAAG;GACtB,OAAO,GAAG,GAAG,IAAI;EACrB;EAEA,MAAM,kBACF,GACA,SACC;EACL,MAAM,MAAM,WAAW;EAEvB,IAAI,MAAwB,QAAQ,GAAG,QAAS,GAAG,IAAI;EACvD,QAAQ,MAAM,CAAC,EAAE,SAAS,QAAQ,QAAQ;GACtC,MAAM,MAAM,OAAO,QAAS,GAAG,IAAI;GACnC,MAAM,IAAI,KAAK,KAAK,QAAQ,MAAM,CAAC;EACvC,CAAC;EACD,OAAO;CACX;;CAGA,UAAwB;EACpB,KAAK,QAAQ,MAAM,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE;CACrE;AACJ"}
+{"version":3,"file":"plugin.cjs","names":[],"sources":["../src/core/plugins/plugin.ts"],"sourcesContent":["import {\n    type BasePlugin,\n    type InvokeOptions,\n    type PipelineReducer,\n    type PluginContract,\n} from \"./types.js\";\n\n/**\n * Registry that holds a set of plugins implementing a shared {@link PluginContract}\n * and resolves which of them answer a given extension point.\n *\n * Plugins are kept sorted by priority (descending); ties keep registration\n * order (the sort is stable). For a given method, {@link invoke} either\n * delegates to the highest-priority enabled plugin (`'first'`) or folds every\n * enabled plugin into a single value (`'pipeline'`). When no plugin is enabled,\n * the supplied `fallback` runs instead, so the host always has defined\n * behaviour even with an empty registry.\n *\n * `name` is a unique key: registering a plugin whose name already exists\n * replaces the previous one, so register/enable/disable/unregister all address\n * the same single plugin.\n *\n * Plugins run arbitrary host code and are trusted: {@link invoke} does NOT wrap\n * them in try/catch. A throwing plugin propagates to the caller (and, in\n * `'pipeline'` mode, discards the accumulated result). Error handling, logging\n * and retries are the host's responsibility by design — the registry's only\n * defined-behaviour guarantee is `fallback` for an empty registry. Every plugin\n * is expected to implement the full contract `P` (the types enforce it).\n *\n * @typeParam P - The plugin contract this manager coordinates.\n */\nclass PluginManager<P extends PluginContract> {\n    /** Internal list, kept sorted by priority (desc). */\n    private plugins: (P & BasePlugin)[] = [];\n\n    /** Registers one or more plugins (replacing any with the same name) and re-sorts by priority. */\n    public register(...plugins: (P & BasePlugin)[]): void {\n        const incoming = new Set(plugins.map((p) => p.name));\n        this.plugins = this.plugins.filter((p) => !incoming.has(p.name));\n        this.plugins.push(...plugins);\n        this.reorder();\n    }\n\n    /** Removes a previously registered plugin by name. */\n    public unregister(name: string): void {\n        this.plugins = this.plugins.filter((p) => p.name !== name);\n    }\n\n    /** Enables a registered plugin by name. */\n    public enable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = true;\n    }\n\n    /** Disables a registered plugin by name (without removing it). */\n    public disable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = false;\n    }\n\n    /** Lists enabled plugins only, already in priority order. */\n    public list(): readonly (P & BasePlugin)[] {\n        return this.plugins.filter((p) => p.enabled !== false);\n    }\n\n    /**\n     * Resolves `method` against the registered plugins.\n     *\n     * In `'first'` mode the highest-priority enabled plugin that implements\n     * `method` answers. In `'pipeline'` mode every enabled plugin runs and the\n     * results are folded with `reducer` (defaults to \"keep the last result\").\n     * When no enabled plugin implements `method`, `fallback` is called.\n     */\n    public invoke<K extends keyof P>(\n        method: K,\n        args: Parameters<P[K]>,\n        opts: InvokeOptions<P, K>,\n    ): ReturnType<P[K]> {\n        const { mode = \"first\", fallback, reducer } = opts;\n        const enabled = this.list();\n\n        if (enabled.length === 0) {\n            return fallback(...args);\n        }\n\n        if (mode === \"first\") {\n            return enabled[0][method](...args);\n        }\n\n        const defaultReducer: PipelineReducer<ReturnType<P[K]>, P> = (\n            _,\n            curr,\n        ) => curr;\n        const red = reducer ?? defaultReducer;\n\n        let acc: ReturnType<P[K]> = enabled[0][method](...args);\n        enabled.slice(1).forEach((plugin, idx) => {\n            acc = red(acc, plugin[method](...args), plugin, idx + 1);\n        });\n        return acc;\n    }\n\n    /** Re-sorts the internal list by priority (desc; default priority = 0). */\n    private reorder(): void {\n        this.plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));\n    }\n}\n\nexport { PluginManager };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAM,gBAAN,MAA8C;;iBAEJ,CAAC;;;CAGvC,SAAgB,GAAG,SAAmC;EAClD,MAAM,WAAW,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,IAAI,CAAC;EACnD,KAAK,UAAU,KAAK,QAAQ,QAAQ,MAAM,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC;EAC/D,KAAK,QAAQ,KAAK,GAAG,OAAO;EAC5B,KAAK,QAAQ;CACjB;;CAGA,WAAkB,MAAoB;EAClC,KAAK,UAAU,KAAK,QAAQ,QAAQ,MAAM,EAAE,SAAS,IAAI;CAC7D;;CAGA,OAAc,MAAoB;EAC9B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,QAAe,MAAoB;EAC/B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,OAA2C;EACvC,OAAO,KAAK,QAAQ,QAAQ,MAAM,EAAE,YAAY,KAAK;CACzD;;;;;;;;;CAUA,OACI,QACA,MACA,MACgB;EAChB,MAAM,EAAE,OAAO,SAAS,UAAU,YAAY;EAC9C,MAAM,UAAU,KAAK,KAAK;EAE1B,IAAI,QAAQ,WAAW,GACnB,OAAO,SAAS,GAAG,IAAI;EAG3B,IAAI,SAAS,SACT,OAAO,QAAQ,GAAG,QAAQ,GAAG,IAAI;EAGrC,MAAM,kBACF,GACA,SACC;EACL,MAAM,MAAM,WAAW;EAEvB,IAAI,MAAwB,QAAQ,GAAG,QAAQ,GAAG,IAAI;EACtD,QAAQ,MAAM,CAAC,EAAE,SAAS,QAAQ,QAAQ;GACtC,MAAM,IAAI,KAAK,OAAO,QAAQ,GAAG,IAAI,GAAG,QAAQ,MAAM,CAAC;EAC3D,CAAC;EACD,OAAO;CACX;;CAGA,UAAwB;EACpB,KAAK,QAAQ,MAAM,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE;CACrE;AACJ"}

package/dist/plugin.d.cts

@@ -7,7 +7,7 @@
 interface BasePlugin {
   /** Unique identifier, used for logs / debugging and for enable/disable. */
   readonly name: string;
-  /** Weight; the highest priority wins (default = 0). */
+  /** Weight; the highest priority wins (default = 0). Ties keep registration order. */
   readonly priority?: number;
   /** Shortcut to disable a plugin without removing it. */
   enabled?: boolean;
@@ -32,7 +32,9 @@ type PipelineReducer<R, P extends PluginContract> = (accumulated: R, current: R,
 interface InvokeOptions<P extends PluginContract, K extends keyof P> {
   /**
    * `'first'`    → returns the first enabled plugin with the highest priority.
-   * `'pipeline'` → runs every enabled plugin, combining results via `reducer`.
+   * `'pipeline'` → fan-out + reduce: every enabled plugin runs against the
+   *   same original `args` (results are NOT chained into the next plugin's
+   *   input), and the results are folded together via `reducer`.
    * default = `'first'`.
    */
   mode?: "first" | "pipeline";
@@ -47,18 +49,30 @@ interface InvokeOptions<P extends PluginContract, K extends keyof P> {
  * Registry that holds a set of plugins implementing a shared {@link PluginContract}
  * and resolves which of them answer a given extension point.
  *
- * Plugins are kept sorted by priority (descending). For a given method,
- * {@link invoke} either delegates to the highest-priority enabled plugin
- * (`'first'`) or folds every enabled plugin into a single value (`'pipeline'`).
- * When no plugin is enabled, the supplied `fallback` runs instead, so the host
- * always has defined behaviour even with an empty registry.
+ * Plugins are kept sorted by priority (descending); ties keep registration
+ * order (the sort is stable). For a given method, {@link invoke} either
+ * delegates to the highest-priority enabled plugin (`'first'`) or folds every
+ * enabled plugin into a single value (`'pipeline'`). When no plugin is enabled,
+ * the supplied `fallback` runs instead, so the host always has defined
+ * behaviour even with an empty registry.
+ *
+ * `name` is a unique key: registering a plugin whose name already exists
+ * replaces the previous one, so register/enable/disable/unregister all address
+ * the same single plugin.
+ *
+ * Plugins run arbitrary host code and are trusted: {@link invoke} does NOT wrap
+ * them in try/catch. A throwing plugin propagates to the caller (and, in
+ * `'pipeline'` mode, discards the accumulated result). Error handling, logging
+ * and retries are the host's responsibility by design — the registry's only
+ * defined-behaviour guarantee is `fallback` for an empty registry. Every plugin
+ * is expected to implement the full contract `P` (the types enforce it).
  *
  * @typeParam P - The plugin contract this manager coordinates.
  */
 declare class PluginManager<P extends PluginContract> {
   /** Internal list, kept sorted by priority (desc). */
   private plugins;
-  /** Registers one or more plugins and re-sorts by priority. */
+  /** Registers one or more plugins (replacing any with the same name) and re-sorts by priority. */
   register(...plugins: (P & BasePlugin)[]): void;
   /** Removes a previously registered plugin by name. */
   unregister(name: string): void;

package/dist/plugin.d.ts

@@ -7,7 +7,7 @@
 interface BasePlugin {
   /** Unique identifier, used for logs / debugging and for enable/disable. */
   readonly name: string;
-  /** Weight; the highest priority wins (default = 0). */
+  /** Weight; the highest priority wins (default = 0). Ties keep registration order. */
   readonly priority?: number;
   /** Shortcut to disable a plugin without removing it. */
   enabled?: boolean;
@@ -32,7 +32,9 @@ type PipelineReducer<R, P extends PluginContract> = (accumulated: R, current: R,
 interface InvokeOptions<P extends PluginContract, K extends keyof P> {
   /**
    * `'first'`    → returns the first enabled plugin with the highest priority.
-   * `'pipeline'` → runs every enabled plugin, combining results via `reducer`.
+   * `'pipeline'` → fan-out + reduce: every enabled plugin runs against the
+   *   same original `args` (results are NOT chained into the next plugin's
+   *   input), and the results are folded together via `reducer`.
    * default = `'first'`.
    */
   mode?: "first" | "pipeline";
@@ -47,18 +49,30 @@ interface InvokeOptions<P extends PluginContract, K extends keyof P> {
  * Registry that holds a set of plugins implementing a shared {@link PluginContract}
  * and resolves which of them answer a given extension point.
  *
- * Plugins are kept sorted by priority (descending). For a given method,
- * {@link invoke} either delegates to the highest-priority enabled plugin
- * (`'first'`) or folds every enabled plugin into a single value (`'pipeline'`).
- * When no plugin is enabled, the supplied `fallback` runs instead, so the host
- * always has defined behaviour even with an empty registry.
+ * Plugins are kept sorted by priority (descending); ties keep registration
+ * order (the sort is stable). For a given method, {@link invoke} either
+ * delegates to the highest-priority enabled plugin (`'first'`) or folds every
+ * enabled plugin into a single value (`'pipeline'`). When no plugin is enabled,
+ * the supplied `fallback` runs instead, so the host always has defined
+ * behaviour even with an empty registry.
+ *
+ * `name` is a unique key: registering a plugin whose name already exists
+ * replaces the previous one, so register/enable/disable/unregister all address
+ * the same single plugin.
+ *
+ * Plugins run arbitrary host code and are trusted: {@link invoke} does NOT wrap
+ * them in try/catch. A throwing plugin propagates to the caller (and, in
+ * `'pipeline'` mode, discards the accumulated result). Error handling, logging
+ * and retries are the host's responsibility by design — the registry's only
+ * defined-behaviour guarantee is `fallback` for an empty registry. Every plugin
+ * is expected to implement the full contract `P` (the types enforce it).
  *
  * @typeParam P - The plugin contract this manager coordinates.
  */
 declare class PluginManager<P extends PluginContract> {
   /** Internal list, kept sorted by priority (desc). */
   private plugins;
-  /** Registers one or more plugins and re-sorts by priority. */
+  /** Registers one or more plugins (replacing any with the same name) and re-sorts by priority. */
   register(...plugins: (P & BasePlugin)[]): void;
   /** Removes a previously registered plugin by name. */
   unregister(name: string): void;

package/dist/plugin.js

@@ -3,11 +3,23 @@
 * Registry that holds a set of plugins implementing a shared {@link PluginContract}
 * and resolves which of them answer a given extension point.
 *
-* Plugins are kept sorted by priority (descending). For a given method,
-* {@link invoke} either delegates to the highest-priority enabled plugin
-* (`'first'`) or folds every enabled plugin into a single value (`'pipeline'`).
-* When no plugin is enabled, the supplied `fallback` runs instead, so the host
-* always has defined behaviour even with an empty registry.
+* Plugins are kept sorted by priority (descending); ties keep registration
+* order (the sort is stable). For a given method, {@link invoke} either
+* delegates to the highest-priority enabled plugin (`'first'`) or folds every
+* enabled plugin into a single value (`'pipeline'`). When no plugin is enabled,
+* the supplied `fallback` runs instead, so the host always has defined
+* behaviour even with an empty registry.
+*
+* `name` is a unique key: registering a plugin whose name already exists
+* replaces the previous one, so register/enable/disable/unregister all address
+* the same single plugin.
+*
+* Plugins run arbitrary host code and are trusted: {@link invoke} does NOT wrap
+* them in try/catch. A throwing plugin propagates to the caller (and, in
+* `'pipeline'` mode, discards the accumulated result). Error handling, logging
+* and retries are the host's responsibility by design — the registry's only
+* defined-behaviour guarantee is `fallback` for an empty registry. Every plugin
+* is expected to implement the full contract `P` (the types enforce it).
 *
 * @typeParam P - The plugin contract this manager coordinates.
 */
@@ -15,8 +27,10 @@ var PluginManager = class {
 	constructor() {
 		this.plugins = [];
 	}
-	/** Registers one or more plugins and re-sorts by priority. */
+	/** Registers one or more plugins (replacing any with the same name) and re-sorts by priority. */
 	register(...plugins) {
+		const incoming = new Set(plugins.map((p) => p.name));
+		this.plugins = this.plugins.filter((p) => !incoming.has(p.name));
 		this.plugins.push(...plugins);
 		this.reorder();
 	}
@@ -48,18 +62,14 @@ var PluginManager = class {
 	*/
 	invoke(method, args, opts) {
 		const { mode = "first", fallback, reducer } = opts;
-		const enabled = this.list().filter((p) => method in p);
+		const enabled = this.list();
 		if (enabled.length === 0) return fallback(...args);
-		if (mode === "first") {
-			const fn = enabled[0][method];
-			return fn(...args);
-		}
+		if (mode === "first") return enabled[0][method](...args);
 		const defaultReducer = (_, curr) => curr;
 		const red = reducer ?? defaultReducer;
 		let acc = enabled[0][method](...args);
 		enabled.slice(1).forEach((plugin, idx) => {
-			const res = plugin[method](...args);
-			acc = red(acc, res, plugin, idx + 1);
+			acc = red(acc, plugin[method](...args), plugin, idx + 1);
 		});
 		return acc;
 	}

package/dist/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","names":[],"sources":["../src/core/plugins/plugin.ts"],"sourcesContent":["import {\n    type BasePlugin,\n    type InvokeOptions,\n    type PipelineReducer,\n    type PluginContract,\n} from \"./types.js\";\n\n/**\n * Registry that holds a set of plugins implementing a shared {@link PluginContract}\n * and resolves which of them answer a given extension point.\n *\n * Plugins are kept sorted by priority (descending). For a given method,\n * {@link invoke} either delegates to the highest-priority enabled plugin\n * (`'first'`) or folds every enabled plugin into a single value (`'pipeline'`).\n * When no plugin is enabled, the supplied `fallback` runs instead, so the host\n * always has defined behaviour even with an empty registry.\n *\n * @typeParam P - The plugin contract this manager coordinates.\n */\nclass PluginManager<P extends PluginContract> {\n    /** Internal list, kept sorted by priority (desc). */\n    private plugins: (P & BasePlugin)[] = [];\n\n    /** Registers one or more plugins and re-sorts by priority. */\n    public register(...plugins: (P & BasePlugin)[]): void {\n        this.plugins.push(...plugins);\n        this.reorder();\n    }\n\n    /** Removes a previously registered plugin by name. */\n    public unregister(name: string): void {\n        this.plugins = this.plugins.filter((p) => p.name !== name);\n    }\n\n    /** Enables a registered plugin by name. */\n    public enable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = true;\n    }\n\n    /** Disables a registered plugin by name (without removing it). */\n    public disable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = false;\n    }\n\n    /** Lists enabled plugins only, already in priority order. */\n    public list(): readonly (P & BasePlugin)[] {\n        return this.plugins.filter((p) => p.enabled !== false);\n    }\n\n    /**\n     * Resolves `method` against the registered plugins.\n     *\n     * In `'first'` mode the highest-priority enabled plugin that implements\n     * `method` answers. In `'pipeline'` mode every enabled plugin runs and the\n     * results are folded with `reducer` (defaults to \"keep the last result\").\n     * When no enabled plugin implements `method`, `fallback` is called.\n     */\n    public invoke<K extends keyof P>(\n        method: K,\n        args: Parameters<P[K]>,\n        opts: InvokeOptions<P, K>,\n    ): ReturnType<P[K]> {\n        const { mode = \"first\", fallback, reducer } = opts;\n        const enabled = this.list().filter((p) => method in p) as Array<\n            P & BasePlugin\n        >;\n\n        if (enabled.length === 0) {\n            return (fallback as P[K])(...args);\n        }\n\n        if (mode === \"first\") {\n            const fn = enabled[0][method] as P[K];\n            return fn(...args);\n        }\n\n        const defaultReducer: PipelineReducer<ReturnType<P[K]>, P> = (\n            _,\n            curr,\n        ) => curr;\n        const red = reducer ?? defaultReducer;\n\n        let acc: ReturnType<P[K]> = enabled[0][method]!(...args);\n        enabled.slice(1).forEach((plugin, idx) => {\n            const res = plugin[method]!(...args);\n            acc = red(acc, res, plugin, idx + 1);\n        });\n        return acc;\n    }\n\n    /** Re-sorts the internal list by priority (desc; default priority = 0). */\n    private reorder(): void {\n        this.plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));\n    }\n}\n\nexport { PluginManager };\n"],"mappings":";;;;;;;;;;;;;AAmBA,IAAM,gBAAN,MAA8C;;iBAEJ,CAAC;;;CAGvC,SAAgB,GAAG,SAAmC;EAClD,KAAK,QAAQ,KAAK,GAAG,OAAO;EAC5B,KAAK,QAAQ;CACjB;;CAGA,WAAkB,MAAoB;EAClC,KAAK,UAAU,KAAK,QAAQ,QAAQ,MAAM,EAAE,SAAS,IAAI;CAC7D;;CAGA,OAAc,MAAoB;EAC9B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,QAAe,MAAoB;EAC/B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,OAA2C;EACvC,OAAO,KAAK,QAAQ,QAAQ,MAAM,EAAE,YAAY,KAAK;CACzD;;;;;;;;;CAUA,OACI,QACA,MACA,MACgB;EAChB,MAAM,EAAE,OAAO,SAAS,UAAU,YAAY;EAC9C,MAAM,UAAU,KAAK,KAAK,EAAE,QAAQ,MAAM,UAAU,CAAC;EAIrD,IAAI,QAAQ,WAAW,GACnB,OAAQ,SAAkB,GAAG,IAAI;EAGrC,IAAI,SAAS,SAAS;GAClB,MAAM,KAAK,QAAQ,GAAG;GACtB,OAAO,GAAG,GAAG,IAAI;EACrB;EAEA,MAAM,kBACF,GACA,SACC;EACL,MAAM,MAAM,WAAW;EAEvB,IAAI,MAAwB,QAAQ,GAAG,QAAS,GAAG,IAAI;EACvD,QAAQ,MAAM,CAAC,EAAE,SAAS,QAAQ,QAAQ;GACtC,MAAM,MAAM,OAAO,QAAS,GAAG,IAAI;GACnC,MAAM,IAAI,KAAK,KAAK,QAAQ,MAAM,CAAC;EACvC,CAAC;EACD,OAAO;CACX;;CAGA,UAAwB;EACpB,KAAK,QAAQ,MAAM,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE;CACrE;AACJ"}
+{"version":3,"file":"plugin.js","names":[],"sources":["../src/core/plugins/plugin.ts"],"sourcesContent":["import {\n    type BasePlugin,\n    type InvokeOptions,\n    type PipelineReducer,\n    type PluginContract,\n} from \"./types.js\";\n\n/**\n * Registry that holds a set of plugins implementing a shared {@link PluginContract}\n * and resolves which of them answer a given extension point.\n *\n * Plugins are kept sorted by priority (descending); ties keep registration\n * order (the sort is stable). For a given method, {@link invoke} either\n * delegates to the highest-priority enabled plugin (`'first'`) or folds every\n * enabled plugin into a single value (`'pipeline'`). When no plugin is enabled,\n * the supplied `fallback` runs instead, so the host always has defined\n * behaviour even with an empty registry.\n *\n * `name` is a unique key: registering a plugin whose name already exists\n * replaces the previous one, so register/enable/disable/unregister all address\n * the same single plugin.\n *\n * Plugins run arbitrary host code and are trusted: {@link invoke} does NOT wrap\n * them in try/catch. A throwing plugin propagates to the caller (and, in\n * `'pipeline'` mode, discards the accumulated result). Error handling, logging\n * and retries are the host's responsibility by design — the registry's only\n * defined-behaviour guarantee is `fallback` for an empty registry. Every plugin\n * is expected to implement the full contract `P` (the types enforce it).\n *\n * @typeParam P - The plugin contract this manager coordinates.\n */\nclass PluginManager<P extends PluginContract> {\n    /** Internal list, kept sorted by priority (desc). */\n    private plugins: (P & BasePlugin)[] = [];\n\n    /** Registers one or more plugins (replacing any with the same name) and re-sorts by priority. */\n    public register(...plugins: (P & BasePlugin)[]): void {\n        const incoming = new Set(plugins.map((p) => p.name));\n        this.plugins = this.plugins.filter((p) => !incoming.has(p.name));\n        this.plugins.push(...plugins);\n        this.reorder();\n    }\n\n    /** Removes a previously registered plugin by name. */\n    public unregister(name: string): void {\n        this.plugins = this.plugins.filter((p) => p.name !== name);\n    }\n\n    /** Enables a registered plugin by name. */\n    public enable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = true;\n    }\n\n    /** Disables a registered plugin by name (without removing it). */\n    public disable(name: string): void {\n        const plugin = this.plugins.find((p) => p.name === name);\n        if (plugin) plugin.enabled = false;\n    }\n\n    /** Lists enabled plugins only, already in priority order. */\n    public list(): readonly (P & BasePlugin)[] {\n        return this.plugins.filter((p) => p.enabled !== false);\n    }\n\n    /**\n     * Resolves `method` against the registered plugins.\n     *\n     * In `'first'` mode the highest-priority enabled plugin that implements\n     * `method` answers. In `'pipeline'` mode every enabled plugin runs and the\n     * results are folded with `reducer` (defaults to \"keep the last result\").\n     * When no enabled plugin implements `method`, `fallback` is called.\n     */\n    public invoke<K extends keyof P>(\n        method: K,\n        args: Parameters<P[K]>,\n        opts: InvokeOptions<P, K>,\n    ): ReturnType<P[K]> {\n        const { mode = \"first\", fallback, reducer } = opts;\n        const enabled = this.list();\n\n        if (enabled.length === 0) {\n            return fallback(...args);\n        }\n\n        if (mode === \"first\") {\n            return enabled[0][method](...args);\n        }\n\n        const defaultReducer: PipelineReducer<ReturnType<P[K]>, P> = (\n            _,\n            curr,\n        ) => curr;\n        const red = reducer ?? defaultReducer;\n\n        let acc: ReturnType<P[K]> = enabled[0][method](...args);\n        enabled.slice(1).forEach((plugin, idx) => {\n            acc = red(acc, plugin[method](...args), plugin, idx + 1);\n        });\n        return acc;\n    }\n\n    /** Re-sorts the internal list by priority (desc; default priority = 0). */\n    private reorder(): void {\n        this.plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));\n    }\n}\n\nexport { PluginManager };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAM,gBAAN,MAA8C;;iBAEJ,CAAC;;;CAGvC,SAAgB,GAAG,SAAmC;EAClD,MAAM,WAAW,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,IAAI,CAAC;EACnD,KAAK,UAAU,KAAK,QAAQ,QAAQ,MAAM,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC;EAC/D,KAAK,QAAQ,KAAK,GAAG,OAAO;EAC5B,KAAK,QAAQ;CACjB;;CAGA,WAAkB,MAAoB;EAClC,KAAK,UAAU,KAAK,QAAQ,QAAQ,MAAM,EAAE,SAAS,IAAI;CAC7D;;CAGA,OAAc,MAAoB;EAC9B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,QAAe,MAAoB;EAC/B,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI;EACvD,IAAI,QAAQ,OAAO,UAAU;CACjC;;CAGA,OAA2C;EACvC,OAAO,KAAK,QAAQ,QAAQ,MAAM,EAAE,YAAY,KAAK;CACzD;;;;;;;;;CAUA,OACI,QACA,MACA,MACgB;EAChB,MAAM,EAAE,OAAO,SAAS,UAAU,YAAY;EAC9C,MAAM,UAAU,KAAK,KAAK;EAE1B,IAAI,QAAQ,WAAW,GACnB,OAAO,SAAS,GAAG,IAAI;EAG3B,IAAI,SAAS,SACT,OAAO,QAAQ,GAAG,QAAQ,GAAG,IAAI;EAGrC,MAAM,kBACF,GACA,SACC;EACL,MAAM,MAAM,WAAW;EAEvB,IAAI,MAAwB,QAAQ,GAAG,QAAQ,GAAG,IAAI;EACtD,QAAQ,MAAM,CAAC,EAAE,SAAS,QAAQ,QAAQ;GACtC,MAAM,IAAI,KAAK,OAAO,QAAQ,GAAG,IAAI,GAAG,QAAQ,MAAM,CAAC;EAC3D,CAAC;EACD,OAAO;CACX;;CAGA,UAAwB;EACpB,KAAK,QAAQ,MAAM,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE;CACrE;AACJ"}

package/dist/policies/engines/index.d.cts

@@ -1,4 +1,4 @@
-import { C as GateTraceNodeSnapshot, D as VersionedGateEngine, E as PolicyViolation, O as GatePayload, S as GateTraceLeafSnapshot, T as PolicyContext, _ as ConditionEvaluationReportTag, b as GateOutcomeData, g as ConditionEvaluationReportLevel, h as ConditionEvaluationReport, k as GatePayloadV1, m as ConditionEvaluationOptions, p as ConditionEvaluationCause, v as ConditionEvaluatorReporter, w as GateViolationTrace, x as GateStatus, y as GateOutcome } from "../../core-config.cjs";
+import { C as GateViolationTrace, D as GatePayload, E as VersionedGateEngine, O as GatePayloadV1, S as GateTraceNodeSnapshot, T as PolicyViolation, _ as ConditionEvaluatorReporter, b as GateStatus, f as ConditionEvaluationCause, g as ConditionEvaluationReportTag, h as ConditionEvaluationReportLevel, m as ConditionEvaluationReport, p as ConditionEvaluationOptions, v as GateOutcome, w as PolicyContext, x as GateTraceLeafSnapshot, y as GateOutcomeData } from "../../core-config.cjs";
 import { a as ComputeOutcome, c as VersionedComputeEngine, d as ComputeDecisionTableRule, f as ComputeParamsPayload, i as ComputeEvaluatorRegistration, l as ComputePayload, n as ComputeRegistry, o as ComputeOutcomeData, p as ComputePayloadV1, r as ComputeEvaluator, s as ComputeStatus, t as GateEngineRegistry, u as ComputeDecisionTablePayload } from "../../gate-engine-registry.cjs";
 import { a as ComputePayloadParserRegistry, c as ComputeEvaluatorRegistry, i as ComputePayloadParser, n as GatePayloadParserRegistry, o as ComputePayloadParsers, r as GatePayloadParsers, s as ComputeEngineRegistry, t as GatePayloadParser } from "../../parse-gate-payload.cjs";
 export { ComputeDecisionTablePayload, ComputeDecisionTableRule, ComputeEngineRegistry, ComputeEvaluator, ComputeEvaluatorRegistration, ComputeEvaluatorRegistry, ComputeOutcome, ComputeOutcomeData, ComputeParamsPayload, ComputePayload, ComputePayloadParser, ComputePayloadParserRegistry, ComputePayloadParsers, ComputePayloadV1, ComputeRegistry, ComputeStatus, ConditionEvaluationCause, ConditionEvaluationOptions, ConditionEvaluationReport, ConditionEvaluationReportLevel, ConditionEvaluationReportTag, ConditionEvaluatorReporter, GateEngineRegistry, GateOutcome, GateOutcomeData, GatePayload, GatePayloadParser, GatePayloadParserRegistry, GatePayloadParsers, GatePayloadV1, GateStatus, GateTraceLeafSnapshot, GateTraceNodeSnapshot, GateViolationTrace, PolicyContext, PolicyViolation, VersionedComputeEngine, VersionedGateEngine };

package/dist/policies/engines/index.d.ts

@@ -1,4 +1,4 @@
-import { C as GateTraceNodeSnapshot, D as VersionedGateEngine, E as PolicyViolation, O as GatePayload, S as GateTraceLeafSnapshot, T as PolicyContext, _ as ConditionEvaluationReportTag, b as GateOutcomeData, g as ConditionEvaluationReportLevel, h as ConditionEvaluationReport, k as GatePayloadV1, m as ConditionEvaluationOptions, p as ConditionEvaluationCause, v as ConditionEvaluatorReporter, w as GateViolationTrace, x as GateStatus, y as GateOutcome } from "../../core-config.js";
+import { C as GateViolationTrace, D as GatePayload, E as VersionedGateEngine, O as GatePayloadV1, S as GateTraceNodeSnapshot, T as PolicyViolation, _ as ConditionEvaluatorReporter, b as GateStatus, f as ConditionEvaluationCause, g as ConditionEvaluationReportTag, h as ConditionEvaluationReportLevel, m as ConditionEvaluationReport, p as ConditionEvaluationOptions, v as GateOutcome, w as PolicyContext, x as GateTraceLeafSnapshot, y as GateOutcomeData } from "../../core-config.js";
 import { a as ComputeOutcome, c as VersionedComputeEngine, d as ComputeDecisionTableRule, f as ComputeParamsPayload, i as ComputeEvaluatorRegistration, l as ComputePayload, n as ComputeRegistry, o as ComputeOutcomeData, p as ComputePayloadV1, r as ComputeEvaluator, s as ComputeStatus, t as GateEngineRegistry, u as ComputeDecisionTablePayload } from "../../gate-engine-registry.js";
 import { a as ComputePayloadParserRegistry, c as ComputeEvaluatorRegistry, i as ComputePayloadParser, n as GatePayloadParserRegistry, o as ComputePayloadParsers, r as GatePayloadParsers, s as ComputeEngineRegistry, t as GatePayloadParser } from "../../parse-gate-payload.js";
 export { ComputeDecisionTablePayload, ComputeDecisionTableRule, ComputeEngineRegistry, ComputeEvaluator, ComputeEvaluatorRegistration, ComputeEvaluatorRegistry, ComputeOutcome, ComputeOutcomeData, ComputeParamsPayload, ComputePayload, ComputePayloadParser, ComputePayloadParserRegistry, ComputePayloadParsers, ComputePayloadV1, ComputeRegistry, ComputeStatus, ConditionEvaluationCause, ConditionEvaluationOptions, ConditionEvaluationReport, ConditionEvaluationReportLevel, ConditionEvaluationReportTag, ConditionEvaluatorReporter, GateEngineRegistry, GateOutcome, GateOutcomeData, GatePayload, GatePayloadParser, GatePayloadParserRegistry, GatePayloadParsers, GatePayloadV1, GateStatus, GateTraceLeafSnapshot, GateTraceNodeSnapshot, GateViolationTrace, PolicyContext, PolicyViolation, VersionedComputeEngine, VersionedGateEngine };

package/dist/policies/engines/v1/gate/index.d.cts

@@ -1,5 +1,5 @@
 import { r as Result } from "../../../../result.cjs";
-import { A as ConditionLeafNode, D as VersionedGateEngine, O as GatePayload, T as PolicyContext, j as ConditionNode, k as GatePayloadV1, m as ConditionEvaluationOptions, t as CoreConfig, y as GateOutcome } from "../../../../core-config.cjs";
+import { A as ConditionNode, D as GatePayload, E as VersionedGateEngine, O as GatePayloadV1, k as ConditionLeafNode, p as ConditionEvaluationOptions, t as CoreConfig, v as GateOutcome, w as PolicyContext } from "../../../../core-config.cjs";
 import { z } from "zod";
 
 //#region src/core/policies/engines/v1/condition-evaluator.d.ts
@@ -24,20 +24,10 @@ declare class ConditionEvaluatorV1 {
   private static isNotNode;
   private static isRelationalOperator;
   private static describeError;
-  private static buildNullishNumericOperandMessage;
-  private static buildNullishDateOperandMessage;
-  private static buildInvalidDateOperandMessage;
-  private static buildInvalidNumericOperandMessage;
-  private static buildInvalidSetOperandMessage;
-  private static buildEmptyOrConditionMessage;
-  private static buildEmptyAndConditionMessage;
-  private static parseComparableDate;
-  private static evaluateRelationalNumbers;
+  private static invalidDateOperandMessage;
   private buildReport;
+  private reportLeafError;
   private conditionEvalErr;
-  private reportDateOperandError;
-  private reportInvalidNumericOperand;
-  private reportInvalidSetOperand;
   private evaluateDateRelationalNode;
   private evaluateOperator;
   private evaluateNumericRelationalNode;

package/dist/policies/engines/v1/gate/index.d.ts

@@ -1,5 +1,5 @@
 import { r as Result } from "../../../../result.js";
-import { A as ConditionLeafNode, D as VersionedGateEngine, O as GatePayload, T as PolicyContext, j as ConditionNode, k as GatePayloadV1, m as ConditionEvaluationOptions, t as CoreConfig, y as GateOutcome } from "../../../../core-config.js";
+import { A as ConditionNode, D as GatePayload, E as VersionedGateEngine, O as GatePayloadV1, k as ConditionLeafNode, p as ConditionEvaluationOptions, t as CoreConfig, v as GateOutcome, w as PolicyContext } from "../../../../core-config.js";
 import { z } from "zod";
 
 //#region src/core/policies/engines/v1/condition-evaluator.d.ts
@@ -24,20 +24,10 @@ declare class ConditionEvaluatorV1 {
   private static isNotNode;
   private static isRelationalOperator;
   private static describeError;
-  private static buildNullishNumericOperandMessage;
-  private static buildNullishDateOperandMessage;
-  private static buildInvalidDateOperandMessage;
-  private static buildInvalidNumericOperandMessage;
-  private static buildInvalidSetOperandMessage;
-  private static buildEmptyOrConditionMessage;
-  private static buildEmptyAndConditionMessage;
-  private static parseComparableDate;
-  private static evaluateRelationalNumbers;
+  private static invalidDateOperandMessage;
   private buildReport;
+  private reportLeafError;
   private conditionEvalErr;
-  private reportDateOperandError;
-  private reportInvalidNumericOperand;
-  private reportInvalidSetOperand;
   private evaluateDateRelationalNode;
   private evaluateOperator;
   private evaluateNumericRelationalNode;

package/dist/policies/index.d.cts

@@ -1,6 +1,6 @@
 import { n as Ok, r as Result, t as Err } from "../result.cjs";
 import { n as Outcome, t as CommonOutcomeStatus } from "../outcome.cjs";
-import { C as GateTraceNodeSnapshot, D as VersionedGateEngine, E as PolicyViolation, O as GatePayload, S as GateTraceLeafSnapshot, T as PolicyContext, _ as ConditionEvaluationReportTag, a as PolicyDecisionId, b as GateOutcomeData, c as TenantId, d as asSchoolId, f as asTenantId, g as ConditionEvaluationReportLevel, h as ConditionEvaluationReport, l as asPolicyDecisionId, m as ConditionEvaluationOptions, n as CoreConfigOptions, o as PolicyDefinitionId, p as ConditionEvaluationCause, r as CoreObservabilityConfig, s as SchoolId, t as CoreConfig, u as asPolicyDefinitionId, v as ConditionEvaluatorReporter, w as GateViolationTrace, x as GateStatus, y as GateOutcome } from "../core-config.cjs";
+import { C as GateViolationTrace, D as GatePayload, E as VersionedGateEngine, S as GateTraceNodeSnapshot, T as PolicyViolation, _ as ConditionEvaluatorReporter, a as PolicyDefinitionId, b as GateStatus, c as asPolicyDecisionId, d as asTenantId, f as ConditionEvaluationCause, g as ConditionEvaluationReportTag, h as ConditionEvaluationReportLevel, i as PolicyDecisionId, l as asPolicyDefinitionId, m as ConditionEvaluationReport, n as CoreConfigOptions, o as SchoolId, p as ConditionEvaluationOptions, r as CoreObservabilityConfig, s as TenantId, t as CoreConfig, u as asSchoolId, v as GateOutcome, w as PolicyContext, x as GateTraceLeafSnapshot, y as GateOutcomeData } from "../core-config.cjs";
 import { a as PolicyPackage, c as coreConfig, i as PolicyCatalogFactory, n as contextResolverRegistry, o as InMemoryPolicyDefinitionRepository, r as registerNamespacedContextResolvers, s as PolicyHashing, t as PolicyContextPath } from "../path.cjs";
 import { A as PolicyScope, C as BasePolicyDefinitionProps, D as PolicyDefinition, E as GatePolicyDefinitionProps, F as PolicyKey, I as AsOfSource, L as PolicyKind, M as ScopeChain, N as PolicyCatalog, O as PolicyDefinitionProps, P as PolicyCatalogEntryProps, R as PolicyOwner, T as FindCandidatesParams, _ as ContextResolverResilienceOptions, a as PolicyServiceOptions, b as ContextSeed, c as PolicyEvaluationErrors, d as PolicyAsOfResolver, f as PolicyContextBuilder, g as ContextResolverCircuitBreakerOptions, h as registerNamespacedContextResolversIn, i as PolicyService, j as PolicyScopeMatcher, k as PolicyDefinitionStatus, l as PolicyResolver, m as ContextResolverRegistry, n as PolicyDecision, o as PolicyServiceParams, p as PolicyContextBuilderOptions, r as PolicyEvaluationResult, s as PolicyEvaluationError, t as EvaluateInput, u as DeriveAsOfOptions, v as ContextResolverRetryOptions, w as ComputePolicyDefinitionProps, x as ContextSeedValidator, y as ContextValueResolver, z as PolicyScopeLevel } from "../policy-service.cjs";
 import { a as ComputeOutcome, c as VersionedComputeEngine, i as ComputeEvaluatorRegistration, n as ComputeRegistry, o as ComputeOutcomeData, r as ComputeEvaluator, s as ComputeStatus, t as GateEngineRegistry } from "../gate-engine-registry.cjs";

package/dist/policies/index.d.ts

@@ -1,6 +1,6 @@
 import { n as Ok, r as Result, t as Err } from "../result.js";
 import { n as Outcome, t as CommonOutcomeStatus } from "../outcome.js";
-import { C as GateTraceNodeSnapshot, D as VersionedGateEngine, E as PolicyViolation, O as GatePayload, S as GateTraceLeafSnapshot, T as PolicyContext, _ as ConditionEvaluationReportTag, a as PolicyDecisionId, b as GateOutcomeData, c as TenantId, d as asSchoolId, f as asTenantId, g as ConditionEvaluationReportLevel, h as ConditionEvaluationReport, l as asPolicyDecisionId, m as ConditionEvaluationOptions, n as CoreConfigOptions, o as PolicyDefinitionId, p as ConditionEvaluationCause, r as CoreObservabilityConfig, s as SchoolId, t as CoreConfig, u as asPolicyDefinitionId, v as ConditionEvaluatorReporter, w as GateViolationTrace, x as GateStatus, y as GateOutcome } from "../core-config.js";
+import { C as GateViolationTrace, D as GatePayload, E as VersionedGateEngine, S as GateTraceNodeSnapshot, T as PolicyViolation, _ as ConditionEvaluatorReporter, a as PolicyDefinitionId, b as GateStatus, c as asPolicyDecisionId, d as asTenantId, f as ConditionEvaluationCause, g as ConditionEvaluationReportTag, h as ConditionEvaluationReportLevel, i as PolicyDecisionId, l as asPolicyDefinitionId, m as ConditionEvaluationReport, n as CoreConfigOptions, o as SchoolId, p as ConditionEvaluationOptions, r as CoreObservabilityConfig, s as TenantId, t as CoreConfig, u as asSchoolId, v as GateOutcome, w as PolicyContext, x as GateTraceLeafSnapshot, y as GateOutcomeData } from "../core-config.js";
 import { a as PolicyPackage, c as coreConfig, i as PolicyCatalogFactory, n as contextResolverRegistry, o as InMemoryPolicyDefinitionRepository, r as registerNamespacedContextResolvers, s as PolicyHashing, t as PolicyContextPath } from "../path.js";
 import { A as PolicyScope, C as BasePolicyDefinitionProps, D as PolicyDefinition, E as GatePolicyDefinitionProps, F as PolicyKey, I as AsOfSource, L as PolicyKind, M as ScopeChain, N as PolicyCatalog, O as PolicyDefinitionProps, P as PolicyCatalogEntryProps, R as PolicyOwner, T as FindCandidatesParams, _ as ContextResolverResilienceOptions, a as PolicyServiceOptions, b as ContextSeed, c as PolicyEvaluationErrors, d as PolicyAsOfResolver, f as PolicyContextBuilder, g as ContextResolverCircuitBreakerOptions, h as registerNamespacedContextResolversIn, i as PolicyService, j as PolicyScopeMatcher, k as PolicyDefinitionStatus, l as PolicyResolver, m as ContextResolverRegistry, n as PolicyDecision, o as PolicyServiceParams, p as PolicyContextBuilderOptions, r as PolicyEvaluationResult, s as PolicyEvaluationError, t as EvaluateInput, u as DeriveAsOfOptions, v as ContextResolverRetryOptions, w as ComputePolicyDefinitionProps, x as ContextSeedValidator, y as ContextValueResolver, z as PolicyScopeLevel } from "../policy-service.js";
 import { a as ComputeOutcome, c as VersionedComputeEngine, i as ComputeEvaluatorRegistration, n as ComputeRegistry, o as ComputeOutcomeData, r as ComputeEvaluator, s as ComputeStatus, t as GateEngineRegistry } from "../gate-engine-registry.js";

package/dist/policy-bridge.cjs

@@ -31,6 +31,13 @@ var RbacAuthorizer = class {
 	* 3. grants the permission but not in scope → `out_of_scope`;
 	* 4. otherwise → ALLOW (`Result.ok`).
 	*
+	* ALLOW is intentionally silent: `Result.ok(undefined)` carries no trace of
+	* *which* grant or role decided it. Denials are rich (see the metadata
+	* below) because they need to explain themselves; an allow does not. When an
+	* ERP needs a "who allowed this, and why" trail, that is the adapter's job —
+	* reconstruct it from the grants it loaded, or gate on `PermissionSet` before
+	* calling. Keeping the decisor's allow-path pure is the deliberate trade.
+	*
 	* @throws {@link InvalidValueException} when `request.required` is a wildcard
 	*   permission (only *granted* permissions may wildcard, never the *required*
 	*   one).
@@ -44,7 +51,7 @@ var RbacAuthorizer = class {
 		const metadata = {
 			action: request.action,
 			resource: request.resource,
-			actor: { userId: request.actor.raw },
+			actor: { actorId: request.actor.raw },
 			required
 		};
 		const actorGrants = grants.filter((grant) => grant.appliesTo(request.actor));
@@ -180,6 +187,22 @@ var Role = class Role extends require_value_object.ValueObject {
 	get permissions() {
 		return this._permissions;
 	}
+	/**
+	* Two roles are equal when they share a name and the same *set* of
+	* permissions. Order-insensitive on purpose: a role is a bundle, not a
+	* sequence, so `Role.of("cashier", [read, cancel])` equals
+	* `Role.of("cashier", [cancel, read])`. Overrides the base
+	* {@link ValueObject.equals}, whose stable-stringify keeps array order and
+	* would call those two roles different. The stored order (and thus
+	* {@link permissions}/{@link toPrimitive}) is still first-seen; only the
+	* comparison sorts.
+	*/
+	equals(other) {
+		if (this.value.name !== other.value.name) return false;
+		const mine = [...this.value.permissions].sort();
+		const theirs = [...other.value.permissions].sort();
+		return mine.length === theirs.length && mine.every((permission, index) => permission === theirs[index]);
+	}
 	/** Whether any permission in this role {@link Permission.implies | implies} `required`. */
 	grants(required) {
 		return this._permissions.some((permission) => permission.implies(required));
@@ -210,7 +233,12 @@ var Scope = class Scope extends require_value_object.ValueObject {
 		super(props);
 		this.finalize();
 	}
-	/** Validates `"type:id"` or the global `"*"`, throwing on anything else. */
+	/**
+	* Validates `"type:id"` or the global `"*"`, throwing on anything else.
+	* `Scope.of("*")` is accepted and is equivalent to {@link Scope.global} —
+	* prefer `global()` at call-sites for intent, `of("*")` when rehydrating a
+	* stored string.
+	*/
 	static of(raw) {
 		if (typeof raw !== "string" || raw.trim().length === 0) throw new require_validation_exception.InvalidValueException(SCOPE_FIELD, require_validation_code.ValidationCode.BLANK, `scope must be a non-empty "type:id" string or "*", got "${raw}"`);
 		if (raw !== "*" && !SCOPE_PATTERN.test(raw)) throw new require_validation_exception.InvalidValueException(SCOPE_FIELD, require_validation_code.ValidationCode.INVALID_FORMAT, `scope must be "type:id" (e.g. "school:42") or the global "*", got "${raw}"`);