@fabricorg/platform 0.1.0

package/dist/policies/index.d.ts

@@ -0,0 +1,143 @@
+type PolicyEvaluationResult = "pass" | "warn" | "block";
+type PolicyKind = "code" | "data" | "hybrid";
+type PolicyId = `${string}.v${number}`;
+type PolicyEvaluationMode = "preview" | "execute";
+declare function assertPolicyId(policyId: string): asserts policyId is PolicyId;
+interface PolicyContext<TDb = unknown> {
+    tenantId: string;
+    spaceId: string;
+    actionInvocationId: string;
+    actionId: string;
+    parameters: unknown;
+    db: TDb;
+    now?: Date;
+    mode?: PolicyEvaluationMode;
+}
+interface PolicyOutcome {
+    policyId: PolicyId;
+    policyVersion: number;
+    policyKind?: PolicyKind;
+    result: PolicyEvaluationResult;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+    dispatchEvidence?: PolicyDispatchEvidence;
+}
+interface PolicyEvaluator<TDb = unknown> {
+    policyId: PolicyId;
+    version: number;
+    kind?: Extract<PolicyKind, "code">;
+    previewSafe?: boolean;
+    evaluate: (ctx: PolicyContext<TDb>) => Promise<PolicyOutcome>;
+}
+type DataPolicySource = "parameters" | "context";
+type DataPolicyLiteral = string | number | boolean | null;
+type DataPolicyComparisonOperator = "exists" | "equals" | "notEquals" | "gt" | "gte" | "lt" | "lte";
+interface DataPolicySourceReference {
+    source: DataPolicySource;
+    path: string;
+}
+type DataPolicyCondition = {
+    conditionId: string;
+    type: "always";
+    result: PolicyEvaluationResult;
+    reason?: string;
+} | {
+    conditionId: string;
+    type: "parameter";
+    path: string;
+    operator: DataPolicyComparisonOperator;
+    value?: DataPolicyLiteral;
+    onPass?: PolicyEvaluationResult;
+    onFail?: PolicyEvaluationResult;
+    reason?: string;
+} | {
+    conditionId: string;
+    type: "comparison";
+    left: DataPolicySourceReference;
+    operator: DataPolicyComparisonOperator;
+    value?: DataPolicyLiteral;
+    onPass?: PolicyEvaluationResult;
+    onFail?: PolicyEvaluationResult;
+    reason?: string;
+} | {
+    conditionId: string;
+    type: "all" | "any";
+    conditions: DataPolicyCondition[];
+    onPass?: PolicyEvaluationResult;
+    onFail?: PolicyEvaluationResult;
+    reason?: string;
+} | {
+    conditionId: string;
+    type: "not";
+    condition: DataPolicyCondition;
+    onPass?: PolicyEvaluationResult;
+    onFail?: PolicyEvaluationResult;
+    reason?: string;
+};
+interface DataPolicyDefinition {
+    conditions: DataPolicyCondition[];
+    defaultResult?: PolicyEvaluationResult;
+    reason?: string;
+}
+interface DataPolicyValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+interface PolicyFallbackDefinition {
+    codeEvaluatorPolicyId: PolicyId;
+    onResults?: PolicyEvaluationResult[];
+    triggers?: PolicyFallbackTrigger[];
+    reason?: string;
+}
+type PolicyFallbackTrigger = "data_result" | "missing_data_definition" | "invalid_data_definition";
+interface DataPolicyConditionResult {
+    conditionId: string;
+    passed: boolean;
+    result: PolicyEvaluationResult;
+    reason?: string;
+}
+interface RuntimePolicyDefinition {
+    policyId: PolicyId;
+    policyVersion: number;
+    kind: PolicyKind;
+    dataDefinition?: DataPolicyDefinition;
+    codeEvaluatorPolicyId?: PolicyId;
+    fallback?: PolicyFallbackDefinition;
+}
+interface PolicyDispatchEvidence {
+    policyKind: PolicyKind;
+    policyId?: PolicyId;
+    policyVersion?: number;
+    dispatchPath: Array<"data" | "code" | "fallback">;
+    data?: {
+        definitionVersion: number;
+        definitionStatus: "evaluated" | "missing" | "invalid";
+        conditionResults: DataPolicyConditionResult[];
+        validationErrors?: string[];
+    };
+    code?: {
+        requestedPolicyId?: PolicyId;
+        policyId: PolicyId;
+        version?: number;
+        registered: boolean;
+    };
+    fallback?: {
+        used: boolean;
+        trigger: PolicyFallbackTrigger | "not_triggered";
+        reason: string;
+        fromResult?: PolicyEvaluationResult;
+        definitionVersion: number;
+        codeEvaluatorPolicyId: PolicyId;
+    };
+}
+declare function registerPolicy(evaluator: PolicyEvaluator): void;
+declare function registerPolicyIfMissing(evaluator: PolicyEvaluator): void;
+declare function resolvePolicy(policyId: PolicyId): PolicyEvaluator | undefined;
+declare function getRegisteredPolicyIds(): PolicyId[];
+declare function evaluateRegisteredPolicies(policyIds: PolicyId[], ctx: PolicyContext): Promise<PolicyOutcome[]>;
+declare function evaluatePolicyDefinitions(policies: RuntimePolicyDefinition[], ctx: PolicyContext): Promise<PolicyOutcome[]>;
+declare function evaluatePolicyDefinition(policy: RuntimePolicyDefinition, ctx: PolicyContext): Promise<PolicyOutcome>;
+declare function validateDataPolicyDefinition(definition: DataPolicyDefinition): DataPolicyValidationResult;
+declare function aggregatePolicyOutcomes(outcomes: PolicyOutcome[]): PolicyOutcome | undefined;
+
+export { type DataPolicyComparisonOperator, type DataPolicyCondition, type DataPolicyConditionResult, type DataPolicyDefinition, type DataPolicyLiteral, type DataPolicySource, type DataPolicySourceReference, type DataPolicyValidationResult, type PolicyContext, type PolicyDispatchEvidence, type PolicyEvaluationMode, type PolicyEvaluationResult, type PolicyEvaluator, type PolicyFallbackDefinition, type PolicyFallbackTrigger, type PolicyId, type PolicyKind, type PolicyOutcome, type RuntimePolicyDefinition, aggregatePolicyOutcomes, assertPolicyId, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, getRegisteredPolicyIds, registerPolicy, registerPolicyIfMissing, resolvePolicy, validateDataPolicyDefinition };

package/dist/policies/index.js

@@ -0,0 +1,544 @@
+// policies/index.ts
+function assertPolicyId(policyId) {
+  if (!/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*\.v[0-9]+$/.test(policyId)) {
+    throw new Error(`Invalid policy ID: ${policyId}`);
+  }
+}
+var DATA_POLICY_MAX_DEPTH = 5;
+var DATA_POLICY_MAX_CONDITIONS_PER_NODE = 20;
+var DATA_POLICY_MAX_TOTAL_CONDITIONS = 100;
+var DATA_POLICY_MAX_PATH_SEGMENTS = 12;
+var DATA_POLICY_MAX_STRING_LENGTH = 500;
+var DATA_POLICY_CONTEXT_PATHS = /* @__PURE__ */ new Set([
+  "tenantId",
+  "spaceId",
+  "actionInvocationId",
+  "actionId",
+  "mode"
+]);
+var DATA_POLICY_COMPARISON_OPERATORS = /* @__PURE__ */ new Set([
+  "exists",
+  "equals",
+  "notEquals",
+  "gt",
+  "gte",
+  "lt",
+  "lte"
+]);
+var POLICY_RESULTS = /* @__PURE__ */ new Set(["pass", "warn", "block"]);
+var registry = /* @__PURE__ */ new Map();
+function registerPolicy(evaluator) {
+  assertPolicyId(evaluator.policyId);
+  const existing = registry.get(evaluator.policyId);
+  if (existing && existing !== evaluator) {
+    throw new Error(
+      `Conflicting policy registration for "${evaluator.policyId}". A different evaluator is already registered.`
+    );
+  }
+  registry.set(evaluator.policyId, evaluator);
+}
+function registerPolicyIfMissing(evaluator) {
+  if (!registry.has(evaluator.policyId)) {
+    registerPolicy(evaluator);
+    return;
+  }
+  const existing = registry.get(evaluator.policyId);
+  if (existing && existing !== evaluator) {
+    throw new Error(
+      `Conflicting policy registration for "${evaluator.policyId}". A different evaluator is already registered.`
+    );
+  }
+}
+function resolvePolicy(policyId) {
+  return registry.get(policyId);
+}
+function getRegisteredPolicyIds() {
+  return Array.from(registry.keys());
+}
+async function evaluateRegisteredPolicies(policyIds, ctx) {
+  return evaluatePolicyDefinitions(
+    policyIds.map((policyId) => ({
+      policyId,
+      policyVersion: parsePolicyVersion(policyId),
+      kind: "code",
+      codeEvaluatorPolicyId: policyId
+    })),
+    ctx
+  );
+}
+async function evaluatePolicyDefinitions(policies, ctx) {
+  const outcomes = [];
+  for (const policy of policies) {
+    assertPolicyId(policy.policyId);
+    outcomes.push(await evaluatePolicyDefinition(policy, ctx));
+  }
+  return outcomes;
+}
+async function evaluatePolicyDefinition(policy, ctx) {
+  if (policy.kind === "data") {
+    return evaluateDataPolicy(policy, ctx);
+  }
+  if (policy.kind === "code") {
+    return evaluateCodePolicy(policy, ctx);
+  }
+  return evaluateHybridPolicy(policy, ctx);
+}
+async function evaluateCodePolicy(policy, ctx) {
+  const codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId ?? policy.policyId;
+  const evaluator = registry.get(codeEvaluatorPolicyId);
+  if (!evaluator) {
+    return {
+      policyId: policy.policyId,
+      policyVersion: policy.policyVersion,
+      policyKind: policy.kind,
+      result: "block",
+      reason: `No evaluator registered for policy ${codeEvaluatorPolicyId}`,
+      metadata: {
+        missingCodeEvaluatorPolicyId: codeEvaluatorPolicyId
+      },
+      dispatchEvidence: {
+        policyKind: policy.kind,
+        policyId: policy.policyId,
+        policyVersion: policy.policyVersion,
+        dispatchPath: ["code"],
+        code: {
+          requestedPolicyId: codeEvaluatorPolicyId,
+          policyId: codeEvaluatorPolicyId,
+          registered: false
+        }
+      }
+    };
+  }
+  const outcome = await evaluator.evaluate(ctx);
+  return normalizeOutcome(policy, outcome, {
+    policyKind: policy.kind,
+    policyId: policy.policyId,
+    policyVersion: policy.policyVersion,
+    dispatchPath: ["code"],
+    code: {
+      requestedPolicyId: codeEvaluatorPolicyId,
+      policyId: evaluator.policyId,
+      version: evaluator.version,
+      registered: true
+    }
+  });
+}
+async function evaluateHybridPolicy(policy, ctx) {
+  const dataOutcome = evaluateDataPolicy(policy, ctx);
+  const fallback = policy.fallback;
+  const fallbackDecision = fallback ? resolveFallbackDecision(policy, dataOutcome, fallback) : { shouldFallback: false, trigger: "not_triggered" };
+  if (!fallback || !fallbackDecision.shouldFallback) {
+    if (fallback && dataOutcome.dispatchEvidence) {
+      return {
+        ...dataOutcome,
+        dispatchEvidence: {
+          ...dataOutcome.dispatchEvidence,
+          fallback: {
+            used: false,
+            trigger: "not_triggered",
+            reason: "Data policy result did not trigger fallback",
+            fromResult: dataOutcome.result,
+            definitionVersion: policy.policyVersion,
+            codeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId
+          }
+        }
+      };
+    }
+    return dataOutcome;
+  }
+  const codePolicy = {
+    policyId: policy.policyId,
+    policyVersion: policy.policyVersion,
+    kind: "hybrid",
+    codeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId
+  };
+  const codeOutcome = await evaluateCodePolicy(codePolicy, ctx);
+  return normalizeOutcome(policy, codeOutcome, {
+    ...codeOutcome.dispatchEvidence ?? {
+      policyKind: "hybrid",
+      policyId: policy.policyId,
+      policyVersion: policy.policyVersion,
+      dispatchPath: ["code"]
+    },
+    policyKind: "hybrid",
+    policyId: policy.policyId,
+    policyVersion: policy.policyVersion,
+    dispatchPath: ["data", "fallback", "code"],
+    data: dataOutcome.dispatchEvidence?.data,
+    fallback: {
+      used: true,
+      trigger: fallbackDecision.trigger,
+      reason: fallback.reason ?? "Data policy result triggered code fallback",
+      fromResult: dataOutcome.result,
+      definitionVersion: policy.policyVersion,
+      codeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId
+    }
+  });
+}
+function resolveFallbackDecision(policy, dataOutcome, fallback) {
+  const allowedTriggers = fallback.triggers ?? [
+    "data_result",
+    "missing_data_definition",
+    "invalid_data_definition"
+  ];
+  const definitionStatus = dataOutcome.dispatchEvidence?.data?.definitionStatus;
+  if (definitionStatus === "missing") {
+    return {
+      shouldFallback: allowedTriggers.includes("missing_data_definition"),
+      trigger: "missing_data_definition"
+    };
+  }
+  if (definitionStatus === "invalid") {
+    return {
+      shouldFallback: allowedTriggers.includes("invalid_data_definition"),
+      trigger: "invalid_data_definition"
+    };
+  }
+  const fallbackResults = fallback.onResults ?? ["warn", "block"];
+  return {
+    shouldFallback: policy.kind === "hybrid" && allowedTriggers.includes("data_result") && fallbackResults.includes(dataOutcome.result),
+    trigger: "data_result"
+  };
+}
+function evaluateDataPolicy(policy, ctx) {
+  const definition = policy.dataDefinition;
+  if (!definition) {
+    return {
+      policyId: policy.policyId,
+      policyVersion: policy.policyVersion,
+      policyKind: policy.kind,
+      result: "block",
+      reason: "Data policy definition is missing",
+      dispatchEvidence: {
+        policyKind: policy.kind,
+        policyId: policy.policyId,
+        policyVersion: policy.policyVersion,
+        dispatchPath: ["data"],
+        data: {
+          definitionVersion: policy.policyVersion,
+          definitionStatus: "missing",
+          conditionResults: []
+        }
+      }
+    };
+  }
+  const validation = validateDataPolicyDefinition(definition);
+  if (!validation.valid) {
+    return {
+      policyId: policy.policyId,
+      policyVersion: policy.policyVersion,
+      policyKind: policy.kind,
+      result: "block",
+      reason: `Invalid data policy definition: ${validation.errors.join("; ")}`,
+      metadata: {
+        validationErrors: validation.errors
+      },
+      dispatchEvidence: {
+        policyKind: policy.kind,
+        policyId: policy.policyId,
+        policyVersion: policy.policyVersion,
+        dispatchPath: ["data"],
+        data: {
+          definitionVersion: policy.policyVersion,
+          definitionStatus: "invalid",
+          conditionResults: [],
+          validationErrors: validation.errors
+        }
+      }
+    };
+  }
+  const evaluations = definition.conditions.map((condition) => evaluateDataPolicyCondition(condition, ctx));
+  const conditionResults = evaluations.flatMap((evaluation) => evaluation.evidence);
+  const topLevelResults = evaluations.map((evaluation) => evaluation.result);
+  const aggregate = topLevelResults.find((result2) => result2.result === "block") ?? topLevelResults.find((result2) => result2.result === "warn");
+  const result = aggregate?.result ?? definition.defaultResult ?? "pass";
+  return {
+    policyId: policy.policyId,
+    policyVersion: policy.policyVersion,
+    policyKind: policy.kind,
+    result,
+    reason: aggregate?.reason ?? definition.reason,
+    metadata: {
+      conditionCount: definition.conditions.length,
+      failedConditionId: aggregate?.conditionId
+    },
+    dispatchEvidence: {
+      policyKind: policy.kind,
+      policyId: policy.policyId,
+      policyVersion: policy.policyVersion,
+      dispatchPath: ["data"],
+      data: {
+        definitionVersion: policy.policyVersion,
+        definitionStatus: "evaluated",
+        conditionResults
+      }
+    }
+  };
+}
+function validateDataPolicyDefinition(definition) {
+  const errors = [];
+  if (!Array.isArray(definition.conditions) || definition.conditions.length === 0) {
+    errors.push("conditions must contain at least one condition");
+  } else if (definition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {
+    errors.push(
+      `conditions must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} top-level conditions`
+    );
+  }
+  if (definition.defaultResult && !POLICY_RESULTS.has(definition.defaultResult)) {
+    errors.push("defaultResult must be pass, warn, or block");
+  }
+  let totalConditions = 0;
+  for (const condition of definition.conditions ?? []) {
+    validateDataPolicyCondition(condition, errors, 1, () => {
+      totalConditions += 1;
+    });
+  }
+  if (totalConditions > DATA_POLICY_MAX_TOTAL_CONDITIONS) {
+    errors.push(`policy must contain at most ${DATA_POLICY_MAX_TOTAL_CONDITIONS} total conditions`);
+  }
+  return { valid: errors.length === 0, errors };
+}
+function validateDataPolicyCondition(condition, errors, depth, count) {
+  count();
+  if (!condition || typeof condition !== "object") {
+    errors.push("condition must be an object");
+    return;
+  }
+  if (depth > DATA_POLICY_MAX_DEPTH) {
+    errors.push(`condition depth must not exceed ${DATA_POLICY_MAX_DEPTH}`);
+    return;
+  }
+  if (!isNonEmptyBoundedString(condition.conditionId)) {
+    errors.push("conditionId must be a non-empty bounded string");
+  }
+  validateOptionalPolicyResult("onPass" in condition ? condition.onPass : void 0, "onPass", errors);
+  validateOptionalPolicyResult("onFail" in condition ? condition.onFail : void 0, "onFail", errors);
+  if (condition.reason !== void 0 && !isNonEmptyBoundedString(condition.reason)) {
+    errors.push(`condition ${condition.conditionId} reason must be a bounded string`);
+  }
+  if (condition.type === "always") {
+    if (!POLICY_RESULTS.has(condition.result)) {
+      errors.push(`condition ${condition.conditionId} result must be pass, warn, or block`);
+    }
+    return;
+  }
+  if (condition.type === "parameter") {
+    validatePath(condition.path, `condition ${condition.conditionId} path`, errors);
+    validateComparison(condition.operator, condition.value, condition.conditionId, errors);
+    return;
+  }
+  if (condition.type === "comparison") {
+    validateSourceReference(condition.left, condition.conditionId, errors);
+    validateComparison(condition.operator, condition.value, condition.conditionId, errors);
+    return;
+  }
+  if (condition.type === "all" || condition.type === "any") {
+    if (!Array.isArray(condition.conditions) || condition.conditions.length === 0) {
+      errors.push(`condition ${condition.conditionId} must contain child conditions`);
+      return;
+    }
+    if (condition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {
+      errors.push(
+        `condition ${condition.conditionId} must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} child conditions`
+      );
+    }
+    for (const child of condition.conditions) {
+      validateDataPolicyCondition(child, errors, depth + 1, count);
+    }
+    return;
+  }
+  if (condition.type === "not") {
+    validateDataPolicyCondition(condition.condition, errors, depth + 1, count);
+    return;
+  }
+  errors.push(`condition ${condition.conditionId} has unsupported type`);
+}
+function validateOptionalPolicyResult(result, fieldName, errors) {
+  if (result !== void 0 && !POLICY_RESULTS.has(result)) {
+    errors.push(`${fieldName} must be pass, warn, or block`);
+  }
+}
+function validateSourceReference(reference, conditionId, errors) {
+  if (!reference || typeof reference !== "object") {
+    errors.push(`condition ${conditionId} left must be a source reference`);
+    return;
+  }
+  if (reference.source !== "parameters" && reference.source !== "context") {
+    errors.push(`condition ${conditionId} source must be parameters or context`);
+  }
+  validatePath(reference.path, `condition ${conditionId} left.path`, errors);
+  if (reference.source === "context" && !DATA_POLICY_CONTEXT_PATHS.has(reference.path)) {
+    errors.push(`condition ${conditionId} uses an unsupported context path`);
+  }
+}
+function validateComparison(operator, value, conditionId, errors) {
+  if (!DATA_POLICY_COMPARISON_OPERATORS.has(operator)) {
+    errors.push(`condition ${conditionId} has unsupported operator`);
+    return;
+  }
+  if (operator === "exists") {
+    return;
+  }
+  if (!isDataPolicyLiteral(value)) {
+    errors.push(`condition ${conditionId} comparison value must be a bounded literal`);
+    return;
+  }
+  if (["gt", "gte", "lt", "lte"].includes(operator) && typeof value !== "number") {
+    errors.push(`condition ${conditionId} numeric comparison requires a number value`);
+  }
+}
+function validatePath(path, fieldName, errors) {
+  if (!isNonEmptyBoundedString(path)) {
+    errors.push(`${fieldName} must be a non-empty bounded string`);
+    return;
+  }
+  const segments = path.split(".");
+  if (segments.length > DATA_POLICY_MAX_PATH_SEGMENTS) {
+    errors.push(`${fieldName} must contain at most ${DATA_POLICY_MAX_PATH_SEGMENTS} segments`);
+    return;
+  }
+  for (const segment of segments) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(segment)) {
+      errors.push(`${fieldName} contains an invalid path segment`);
+      return;
+    }
+    if (["__proto__", "constructor", "prototype"].includes(segment)) {
+      errors.push(`${fieldName} contains a forbidden path segment`);
+      return;
+    }
+  }
+}
+function isDataPolicyLiteral(value) {
+  if (value === null || typeof value === "number" || typeof value === "boolean") {
+    return true;
+  }
+  return typeof value === "string" && value.length <= DATA_POLICY_MAX_STRING_LENGTH;
+}
+function isNonEmptyBoundedString(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= DATA_POLICY_MAX_STRING_LENGTH;
+}
+function evaluateDataPolicyCondition(condition, ctx) {
+  if (condition.type === "always") {
+    const result2 = {
+      conditionId: condition.conditionId,
+      passed: condition.result === "pass",
+      result: condition.result,
+      reason: condition.reason
+    };
+    return { result: result2, evidence: [result2] };
+  }
+  if (condition.type === "all" || condition.type === "any") {
+    const childEvaluations = condition.conditions.map((child) => evaluateDataPolicyCondition(child, ctx));
+    const passed2 = condition.type === "all" ? childEvaluations.every((evaluation) => evaluation.result.passed) : childEvaluations.some((evaluation) => evaluation.result.passed);
+    const result2 = {
+      conditionId: condition.conditionId,
+      passed: passed2,
+      result: passed2 ? condition.onPass ?? "pass" : condition.onFail ?? "block",
+      reason: passed2 ? void 0 : condition.reason
+    };
+    return {
+      result: result2,
+      evidence: [result2, ...childEvaluations.flatMap((evaluation) => evaluation.evidence)]
+    };
+  }
+  if (condition.type === "not") {
+    const childEvaluation = evaluateDataPolicyCondition(condition.condition, ctx);
+    const passed2 = !childEvaluation.result.passed;
+    const result2 = {
+      conditionId: condition.conditionId,
+      passed: passed2,
+      result: passed2 ? condition.onPass ?? "pass" : condition.onFail ?? "block",
+      reason: passed2 ? void 0 : condition.reason
+    };
+    return { result: result2, evidence: [result2, ...childEvaluation.evidence] };
+  }
+  if (condition.type !== "parameter" && condition.type !== "comparison") {
+    const result2 = {
+      conditionId: condition.conditionId,
+      passed: false,
+      result: "block",
+      reason: "Unsupported data policy condition type"
+    };
+    return { result: result2, evidence: [result2] };
+  }
+  const value = condition.type === "parameter" ? readPath(ctx.parameters, condition.path) : readDataPolicySource(ctx, condition.left);
+  const operator = condition.operator;
+  const expected = condition.value;
+  const passed = evaluateOperator(value, operator, expected);
+  const result = {
+    conditionId: condition.conditionId,
+    passed,
+    result: passed ? condition.onPass ?? "pass" : condition.onFail ?? "block",
+    reason: passed ? void 0 : condition.reason
+  };
+  return { result, evidence: [result] };
+}
+function evaluateOperator(actual, operator, expected) {
+  switch (operator) {
+    case "exists":
+      return actual !== void 0 && actual !== null && actual !== "";
+    case "equals":
+      return actual === expected;
+    case "notEquals":
+      return actual !== expected;
+    case "gt":
+      return typeof actual === "number" && typeof expected === "number" && actual > expected;
+    case "gte":
+      return typeof actual === "number" && typeof expected === "number" && actual >= expected;
+    case "lt":
+      return typeof actual === "number" && typeof expected === "number" && actual < expected;
+    case "lte":
+      return typeof actual === "number" && typeof expected === "number" && actual <= expected;
+  }
+}
+function readDataPolicySource(ctx, reference) {
+  if (reference.source === "parameters") {
+    return readPath(ctx.parameters, reference.path);
+  }
+  return readPath(
+    {
+      tenantId: ctx.tenantId,
+      spaceId: ctx.spaceId,
+      actionInvocationId: ctx.actionInvocationId,
+      actionId: ctx.actionId,
+      mode: ctx.mode
+    },
+    reference.path
+  );
+}
+function readPath(source, path) {
+  if (!source || typeof source !== "object") {
+    return void 0;
+  }
+  return path.split(".").reduce((current, segment) => {
+    if (!current || typeof current !== "object") {
+      return void 0;
+    }
+    return current[segment];
+  }, source);
+}
+function normalizeOutcome(policy, outcome, dispatchEvidence) {
+  return {
+    ...outcome,
+    policyId: policy.policyId,
+    policyVersion: policy.policyVersion,
+    policyKind: policy.kind,
+    metadata: {
+      ...outcome.metadata ?? {},
+      codePolicyId: dispatchEvidence.code?.policyId ?? outcome.policyId,
+      codePolicyVersion: dispatchEvidence.code?.version ?? outcome.policyVersion
+    },
+    dispatchEvidence
+  };
+}
+function parsePolicyVersion(policyId) {
+  const segments = policyId.split(".v");
+  return Number(segments[segments.length - 1] ?? 1);
+}
+function aggregatePolicyOutcomes(outcomes) {
+  return outcomes.find((outcome) => outcome.result === "block") ?? outcomes.find((outcome) => outcome.result === "warn");
+}
+
+export { aggregatePolicyOutcomes, assertPolicyId, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, getRegisteredPolicyIds, registerPolicy, registerPolicyIfMissing, resolvePolicy, validateDataPolicyDefinition };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map