@fabricorg/platform 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @fabricorg/platform
 
+## 0.4.0 — 2026-05-17
+
+### Minor
+
+- **Policy guidance contract.** Added first-class `PolicyGuidance` to `PolicyOutcome` so all policy evaluators can return structured user/audit remediation without hiding it in arbitrary metadata. New exported types:
+  - `PolicyFact` — named fact/value pairs the policy evaluated.
+  - `PolicyCorrectiveAction` — operator remediation with optional `actionId`, parameters, UI target, and confirmation requirement.
+  - `PolicyGuidance` — `summary`, `factsUsed`, and `correctiveActions`.
+- **Docs:** `governance/policy-model`, `governance/enforcement`, and BYO-engine examples now distinguish dispatch evidence (`how the decision was produced`) from guidance (`what the user can do next`).
+- **Tests:** policy evaluation coverage now asserts evaluator-supplied guidance survives dispatch normalization.
+
+## 0.3.2 — 2026-05-16
+
+### Patch
+
+- **BYO policy engine affordance.** Made it possible for code policy evaluators to delegate to external policy engines (OPA, Cedar, Cerbos, …) while keeping Fabric's `policyId.vN` and `policyVersion` canonical for audit. Three additive, vendor-neutral changes to the policy contract:
+  - `PolicyContext.services?: FabricRuntimeServices` — mirrors `ActionContext.services`. Lets the runtime host inject HTTP clients, external policy engine clients, feature flags, etc. into policy evaluation without module-level globals.
+  - `PolicyDispatchEvidence.engine?: { name; version?; metadata? }` — open-ended engine provenance slot. Adapters populate it (e.g. OPA: `decisionPath`, `bundleRevision`, `decisionId`, `inputHash`). Platform `policyId` / `policyVersion` remain load-bearing; `engine` answers "*which artifact* produced the decision?". `normalizeOutcome` merges evaluator-supplied `engine` provenance into the platform-controlled dispatch envelope so adapters can attach it without being overwritten.
+  - `PolicyDispatchEvidence.code.skipped` / `code.skipReason` — first-class evidence shape for preview skips.
+- **Preview-safe enforcement (bug fix).** `PolicyEvaluator.previewSafe` was previously documentation-only; `evaluateCodePolicy` ran every evaluator regardless of `ctx.mode`. Now: when `ctx.mode === "preview"` and an evaluator is not declared `previewSafe: true`, the platform skips evaluation and returns `result: "warn"` with structured skip evidence (`code.skipped`, `code.skipReason`, `metadata.previewSkipped`). `warn` is the honest preview outcome: not proven pass, not proven block. Data policies are deterministic and continue to evaluate in preview unchanged. Hybrid policies inherit the skip behavior on their fallback code evaluator automatically.
+- **Docs:** new `governance/byo-engine` page — worked OPA example covering the four-piece pattern (vertical policy manifest, fact builder owned by TS, Rego house style returning structured decision shape, evaluator factory), failure-mode policy table, preview semantics, and the platform/adapter/vertical layering. `governance/policy-model` updated to reflect `services` and the `engine` evidence block.
+- **Tests:** 81 → 87 (added 6 tests: preview skip warn outcome + evidence shape, `previewSafe: true` opts back in, execute-mode unaffected, hybrid fallback respects preview-safety, `services` bag visible to evaluator, engine provenance survives `normalizeOutcome`).
+- **No breaking changes.** All additions are optional and additive. Evaluators that did not previously set `previewSafe` and were called in `preview` mode now warn-skip instead of executing — this is a behavior change only for callers that were exercising preview against unsafe evaluators (which was incorrect under the documented contract).
+
 ## 0.3.1 — 2026-05-08
 
 ### Patch

package/README.md

@@ -84,7 +84,7 @@ The platform never auto-loads a module. The host app composes them explicitly
 
 Every `invokeAction(id, params)` call goes through:
 
-1. **`evaluatePolicies`** — every policy registered for the action runs (code/data/hybrid). A single `block` halts the invocation.
+1. **`evaluatePolicies`** — every policy registered for the action runs (code/data/hybrid). A single `block` halts the invocation. Policies may return `guidance` (`factsUsed` + `correctiveActions`) so hosts can show exactly why a block happened and what the operator can do next.
 2. **State-machine validation** — if the action's target entity is bound to a state machine, the requested transition is validated before the handler runs.
 3. **Handler** — `actionDef.handler(ctx, params)` runs inside a single `TDb` transaction. Handler parses its own input via its `schema` (single source of truth).
 4. **Adapters** — for each `actionDef.adapterSteps`, the registered implementation runs via `executeWithAdapterRetry` (idempotent retry, exponential backoff, circuit breaker).

package/dist/{chunk-PZT7TUG4.js → chunk-CSZXUX5V.js}

@@ -1,5 +1,5 @@
 import { registerObjectType } from './chunk-I35B576X.js';
-import { registerPolicyIfMissing } from './chunk-KOC4A7A4.js';
+import { registerPolicyIfMissing } from './chunk-I3BMSYDF.js';
 import { registerStateMachineIfMissing } from './chunk-T2JLSZN6.js';
 import { registerActionIfMissing } from './chunk-BJYRMUN2.js';
 import { registerDisplayRenderer } from './chunk-O5WVBQ7P.js';
@@ -183,5 +183,5 @@ function registerFabricModules(modules) {
 }
 
 export { createModuleRegistry, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, registerFabricModule, registerFabricModules, validateModuleNamespace };
-//# sourceMappingURL=chunk-PZT7TUG4.js.map
-//# sourceMappingURL=chunk-PZT7TUG4.js.map
+//# sourceMappingURL=chunk-CSZXUX5V.js.map
+//# sourceMappingURL=chunk-CSZXUX5V.js.map

package/dist/{chunk-PZT7TUG4.js.map → chunk-CSZXUX5V.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../modules/index.ts"],"names":[],"mappings":";;;;;;;;AAsFA,IAAM,0BAAA,uBAAiC,GAAA,EAAY;AAE5C,SAAS,6BAA6B,UAAA,EAA2C;AACvF,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,UAAA,CAAW,SAAA;AACjE;AAEO,SAAS,kBAAkB,UAAA,EAAiD;AAClF,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,UAAA,CAAW,IAAA;AACjE;AAEO,SAAS,iBAAiB,SAAA,EAA+C;AAC/E,EAAA,OAAO,OAAO,SAAA,KAAc,QAAA,GAAW,SAAA,GAAY,SAAA,CAAU,SAAA;AAC9D;AAEO,SAAS,wBAAwB,SAAA,EAAyB;AAChE,EAAA,IAAI,CAAC,SAAA,EAAW;AACf,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,8BAA8B,SAAS,CAAA,wDAAA;AAAA,KACxC;AAAA,EACD;AACD;AAEO,SAAS,oBAAA,CACf,OAAA,GAA+B,EAAC,EACV;AACtB,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA+B;AACtD,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,uBAAA,CAAwB,OAAO,SAAS,CAAA;AACxC,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,MAAA,CAAO,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,IAC1E;AACA,IAAA,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,EAAE,SAAS,UAAA,EAAW;AAC9B;AAEA,SAAS,sBAAA,CACR,MAAA,EACA,KAAA,EACA,SAAA,EACO;AACP,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,IAAU,EAAC,EAAG;AACjC,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,SAAS,CAAA,eAAA,EAAkB,KAAK,CAAA,OAAA,CAAS,CAAA;AAAA,IACrE;AAAA,EACD;AACD;AAEA,SAAS,gBAAA,CAAiB,MAAA,EAA+B,OAAA,GAAmC,EAAC,EAAS;AACrG,EAAA,uBAAA,CAAwB,OAAO,SAAS,CAAA;AAExC,EAAA,MAAM,gBAAgB,MAAA,CAAO,YAAA,IAAgB,EAAC,EAAG,IAAI,4BAA4B,CAAA;AACjF,EAAA,MAAM,eAAe,MAAA,CAAO,WAAA,IAAe,EAAC,EAAG,IAAI,iBAAiB,CAAA;AACpE,EAAA,MAAM,cAAc,MAAA,CAAO,UAAA,IAAc,EAAC,EAAG,IAAI,gBAAgB,CAAA;AAEjE,EAAA,KAAA,MAAW,cAAc,YAAA,EAAc;AACtC,IAAA,uBAAA,CAAwB,UAAU,CAAA;AAClC,IAAA,IAAI,UAAA,KAAe,OAAO,SAAA,EAAW;AACpC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAA,CAAO,SAAS,CAAA,0BAAA,CAA4B,CAAA;AAAA,IACxE;AACA,IAAA,IAAI,QAAQ,mBAAA,IAAuB,CAAC,QAAQ,mBAAA,CAAoB,GAAA,CAAI,UAAU,CAAA,EAAG;AAChF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,OAAO,SAAS,CAAA,6BAAA,EAAgC,UAAU,CAAA,EAAA,CAAI,CAAA;AAAA,IAC1F;AAAA,EACD;AAEA,EAAA,sBAAA,CAAuB,WAAA,EAAa,aAAA,EAAe,MAAA,CAAO,SAAS,CAAA;AACnE,EAAA,sBAAA,CAAuB,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,MAAA,CAAO,SAAS,CAAA;AAC5E,EAAA,sBAAA,CAAuB,UAAA,EAAY,YAAA,EAAc,MAAA,CAAO,SAAS,CAAA;AAEjE,EAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACrC,IAAA,IAAI,CAAC,qBAAA,CAAsB,IAAA,CAAK,UAAU,CAAA,EAAG;AAC5C,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,yBAAyB,UAAU,CAAA,gDAAA;AAAA,OACpC;AAAA,IACD;AAAA,EACD;AAEA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AAC1C,IAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,EAAG;AAChE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,MAAA,CAAO,QAAQ,CAAA,CAAE,CAAA;AAAA,IACxD;AAEA,IAAA,IAAI,MAAA,CAAO,SAAA,KAAc,MAAA,CAAO,SAAA,EAAW;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,QAAA,EAAW,OAAO,QAAQ,CAAA,sBAAA,EAAyB,OAAO,SAAS,CAAA,+BAAA,EAClC,OAAO,SAAS,CAAA,EAAA;AAAA,OAClD;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,UAAA,CAAW,GAAG,MAAA,CAAO,SAAS,GAAG,CAAA,EAAG;AACxD,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,QAAA,EAAW,MAAA,CAAO,QAAQ,CAAA,oCAAA,EAAuC,OAAO,SAAS,CAAA,EAAA;AAAA,OAClF;AAAA,IACD;AAEA,IAAA,IAAI,MAAA,CAAO,aAAA,IAAiB,MAAA,CAAO,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,QAAA,EAAW,OAAO,QAAQ,CAAA,8FAAA;AAAA,OAE3B;AAAA,IACD;AAAA,EACD;AAEA,EAAA,KAAA,MAAW,UAAA,IAAc,MAAA,CAAO,gBAAA,IAAoB,EAAC,EAAG;AACvD,IAAA,MAAM,qBAAqB,OAAA,CAAQ,iBAAA,EAAmB,GAAA,CAAI,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA;AACnF,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,QAAA,CAAS,UAAA,CAAW,SAAS,CAAA;AAClE,IAAA,IAAI,CAAC,iBAAiB,UAAA,CAAW,SAAS,KAAK,CAAC,iBAAA,IAAqB,CAAC,kBAAA,EAAoB;AACzF,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,oDAAA,EAAuD,WAAW,SAAS,CAAA,4DAAA;AAAA,OAE5E;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,uBAAA,CACR,OAAA,EACA,oBAAA,GAAuB,0BAAA,EACG;AAC1B,EAAA,MAAM,kBAAA,uBAAyB,GAAA,EAAmC;AAElE,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,uBAAA,CAAwB,OAAO,SAAS,CAAA;AACxC,IAAA,IAAI,kBAAA,CAAmB,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,MAAA,CAAO,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,IAC3E;AACA,IAAA,kBAAA,CAAmB,GAAA,CAAI,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AAAA,EAChD;AAEA,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AACjC,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAEhC,EAAA,SAAS,KAAA,CAAM,QAA+B,IAAA,EAAsB;AACnE,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AAClC,MAAA;AAAA,IACD;AACA,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,0CAAA,EAA6C,CAAC,GAAG,IAAA,EAAM,OAAO,SAAS,CAAA,CAAE,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,OACtF;AAAA,IACD;AAEA,IAAA,QAAA,CAAS,GAAA,CAAI,OAAO,SAAS,CAAA;AAC7B,IAAA,KAAA,MAAW,eAAe,MAAA,CAAO,YAAA,IAAgB,EAAC,EAAG,GAAA,CAAI,4BAA4B,CAAA,EAAG;AACvF,MAAA,MAAM,gBAAA,GAAmB,kBAAA,CAAmB,GAAA,CAAI,UAAU,CAAA;AAC1D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACtB,QAAA,IAAI,oBAAA,CAAqB,GAAA,CAAI,UAAU,CAAA,EAAG;AACzC,UAAA;AAAA,QACD;AACA,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,OAAO,SAAS,CAAA,6BAAA,EAAgC,UAAU,CAAA,EAAA,CAAI,CAAA;AAAA,MAC1F;AACA,MAAA,KAAA,CAAM,kBAAkB,CAAC,GAAG,IAAA,EAAM,MAAA,CAAO,SAAS,CAAC,CAAA;AAAA,IACpD;AACA,IAAA,QAAA,CAAS,MAAA,CAAO,OAAO,SAAS,CAAA;AAChC,IAAA,OAAA,CAAQ,GAAA,CAAI,OAAO,SAAS,CAAA;AAC5B,IAAA,MAAA,CAAO,KAAK,MAAM,CAAA;AAAA,EACnB;AAEA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAE,CAAA;AAAA,EACjB;AAEA,EAAA,OAAO,MAAA;AACR;AAEO,SAAS,qBAAqB,MAAA,EAAqC;AACzE,EAAA,gBAAA,CAAiB,MAAA,EAAQ,EAAE,mBAAA,EAAqB,0BAAA,EAA4B,CAAA;AAE5E,EAAA,KAAA,MAAW,UAAA,IAAc,MAAA,CAAO,WAAA,IAAe,EAAC,EAAG;AAClD,IAAA,kBAAA,CAAmB,iBAAA,CAAkB,UAAU,CAAC,CAAA;AAAA,EACjD;AAEA,EAAA,KAAA,MAAW,WAAA,IAAe,MAAA,CAAO,YAAA,IAAgB,EAAC,EAAG;AACpD,IAAA,mBAAA,CAAoB,WAAW,CAAA;AAAA,EAChC;AAEA,EAAA,KAAA,MAAW,SAAA,IAAa,MAAA,CAAO,UAAA,IAAc,EAAC,EAAG;AAChD,IAAA,iBAAA,CAAkB,gBAAA,CAAiB,SAAS,CAAC,CAAA;AAAA,EAC9C;AAEA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,QAAA,IAAY,EAAC,EAAG;AAC3C,IAAA,uBAAA,CAAwB,MAAyB,CAAA;AAAA,EAClD;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,MAAA,CAAO,aAAA,IAAiB,EAAC,EAAG;AACjD,IAAA,6BAAA,CAA8B,OAAiC,CAAA;AAAA,EAChE;AAEA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AAC1C,IAAA,uBAAA,CAAwB,MAAM,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,UAAA,IAAc,MAAA,CAAO,gBAAA,IAAoB,EAAC,EAAG;AACvD,IAAA,uBAAA,CAAwB,UAAA,CAAW,SAAA,EAAW,UAAA,CAAW,QAA2B,CAAA;AAAA,EACrF;AAEA,EAAA,0BAAA,CAA2B,GAAA,CAAI,OAAO,SAAS,CAAA;AAChD;AAEO,SAAS,sBAAsB,OAAA,EAA2D;AAChG,EAAA,MAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,IACnC,GAAG,0BAAA;AAAA,IACH,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAA,KAAW,OAAO,SAAS;AAAA,GAC3C,CAAA;AACD,EAAA,MAAM,oBAAoB,IAAI,GAAA;AAAA,IAC7B,OAAA,CAAQ,OAAA,CAAQ,CAAC,MAAA,KAAA,CAAY,MAAA,CAAO,cAAc,EAAC,EAAG,GAAA,CAAI,gBAAgB,CAAC;AAAA,GAC5E;AAEA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,gBAAA,CAAiB,MAAA,EAAQ,EAAE,mBAAA,EAAqB,iBAAA,EAAmB,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,aAAA,GAAgB,wBAAwB,OAAO,CAAA;AACrD,EAAA,KAAA,MAAW,UAAU,aAAA,EAAe;AACnC,IAAA,oBAAA,CAAqB,MAAM,CAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,aAAA;AACR","file":"chunk-PZT7TUG4.js","sourcesContent":["import { registerActionIfMissing, type ActionDefinition } from \"../actions\";\nimport { registerDisplayRenderer, type DisplayRenderer } from \"../displays\";\nimport { isValidEventType, registerEventType, registerSubjectType } from \"../events\";\nimport { registerObjectType } from \"../objects\";\nimport { registerPolicyIfMissing, type PolicyEvaluator } from \"../policies\";\nimport { registerStateMachineIfMissing, type StateMachineDefinition } from \"../state-machines\";\n\nexport interface ModuleDependency {\n\tnamespace: string;\n\tversion?: string;\n\toptional?: boolean;\n}\n\nexport type ModuleDependencyInput = string | ModuleDependency;\n\nexport interface IdPrefixRegistration {\n\tprefix: string;\n\tname: string;\n\tmodule: string;\n}\n\nexport interface EventTypeRegistration {\n\teventType: string;\n\tschemaVersion: number;\n\tdescription?: string;\n}\n\nexport type EventTypeRegistrationInput = string | EventTypeRegistration;\n\nexport interface ObjectTypeRegistration {\n\ttype: string;\n\tdisplayName?: string;\n\tidPrefix?: string;\n\tisCoreModuleType?: boolean;\n}\n\nexport type ObjectTypeRegistrationInput = string | ObjectTypeRegistration;\n\nexport interface ModuleDisplayRendererRegistration {\n\teventType: string;\n\trenderer: DisplayRenderer;\n}\n\nexport interface PolicyRegistration {\n\tid: string;\n\tversion?: string;\n\tdescription?: string;\n}\n\nexport interface StateMachineRegistration {\n\tentityType: string;\n\tstates: string[];\n}\n\nexport interface FabricModule<TDb = unknown> {\n\tnamespace: string;\n\tversion?: string;\n\tdisplayName?: string;\n\tdescription?: string;\n\tdependencies?: ModuleDependencyInput[];\n\tobjectTypes?: ObjectTypeRegistrationInput[];\n\tsubjectTypes?: string[];\n\tidPrefixes?: IdPrefixRegistration[];\n\teventTypes?: EventTypeRegistrationInput[];\n\tactions?: ActionDefinition<TDb>[];\n\tpolicies?: unknown[];\n\tstateMachines?: unknown[];\n\tdisplayRenderers?: ModuleDisplayRendererRegistration[];\n\tadapterDefinitions?: unknown[];\n\tpermissions?: unknown[];\n\troles?: unknown[];\n\tredactionRules?: unknown[];\n\tdataClassifications?: unknown[];\n\tretentionRules?: unknown[];\n\tevidenceRenderers?: unknown[];\n}\n\nexport interface ModuleRegistry<TDb = unknown> {\n\tmodules: ReadonlyMap<string, FabricModule<TDb>>;\n}\n\ninterface ModuleValidationContext {\n\tavailableNamespaces?: Set<string>;\n\tplannedEventTypes?: Set<string>;\n}\n\nconst registeredModuleNamespaces = new Set<string>();\n\nexport function getModuleDependencyNamespace(dependency: ModuleDependencyInput): string {\n\treturn typeof dependency === \"string\" ? dependency : dependency.namespace;\n}\n\nexport function getObjectTypeName(objectType: ObjectTypeRegistrationInput): string {\n\treturn typeof objectType === \"string\" ? objectType : objectType.type;\n}\n\nexport function getEventTypeName(eventType: EventTypeRegistrationInput): string {\n\treturn typeof eventType === \"string\" ? eventType : eventType.eventType;\n}\n\nexport function validateModuleNamespace(namespace: string): void {\n\tif (!namespace) {\n\t\tthrow new Error(\"Module namespace cannot be empty\");\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(namespace)) {\n\t\tthrow new Error(\n\t\t\t`Invalid module namespace: \"${namespace}\". Must be lowercase letters, numbers, and hyphens only.`,\n\t\t);\n\t}\n}\n\nexport function createModuleRegistry<TDb = unknown>(\n\tmodules: FabricModule<TDb>[] = [],\n): ModuleRegistry<TDb> {\n\tconst registered = new Map<string, FabricModule<TDb>>();\n\tfor (const module of modules) {\n\t\tvalidateModuleNamespace(module.namespace);\n\t\tif (registered.has(module.namespace)) {\n\t\t\tthrow new Error(`Duplicate FabricModule namespace \"${module.namespace}\".`);\n\t\t}\n\t\tregistered.set(module.namespace, module);\n\t}\n\treturn { modules: registered };\n}\n\nfunction validateIdentifierList(\n\tvalues: string[] | undefined,\n\tlabel: string,\n\tnamespace: string,\n): void {\n\tfor (const value of values ?? []) {\n\t\tif (!value) {\n\t\t\tthrow new Error(`Module \"${namespace}\" has an empty ${label} entry.`);\n\t\t}\n\t}\n}\n\nfunction validateManifest(module: FabricModule<unknown>, context: ModuleValidationContext = {}): void {\n\tvalidateModuleNamespace(module.namespace);\n\n\tconst dependencies = (module.dependencies ?? []).map(getModuleDependencyNamespace);\n\tconst objectTypes = (module.objectTypes ?? []).map(getObjectTypeName);\n\tconst eventTypes = (module.eventTypes ?? []).map(getEventTypeName);\n\n\tfor (const dependency of dependencies) {\n\t\tvalidateModuleNamespace(dependency);\n\t\tif (dependency === module.namespace) {\n\t\t\tthrow new Error(`Module \"${module.namespace}\" cannot depend on itself.`);\n\t\t}\n\t\tif (context.availableNamespaces && !context.availableNamespaces.has(dependency)) {\n\t\t\tthrow new Error(`Module \"${module.namespace}\" depends on missing module \"${dependency}\".`);\n\t\t}\n\t}\n\n\tvalidateIdentifierList(objectTypes, \"objectTypes\", module.namespace);\n\tvalidateIdentifierList(module.subjectTypes, \"subjectTypes\", module.namespace);\n\tvalidateIdentifierList(eventTypes, \"eventTypes\", module.namespace);\n\n\tfor (const objectType of objectTypes) {\n\t\tif (!/^[A-Z][a-zA-Z0-9]*$/.test(objectType)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Invalid object type: \"${objectType}\". Object types must be PascalCase alphanumeric.`,\n\t\t\t);\n\t\t}\n\t}\n\n\tfor (const action of module.actions ?? []) {\n\t\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(action.actionId)) {\n\t\t\tthrow new Error(`Invalid action ID: ${action.actionId}`);\n\t\t}\n\n\t\tif (action.namespace !== module.namespace) {\n\t\t\tthrow new Error(\n\t\t\t\t`Action \"${action.actionId}\" declares namespace \"${action.namespace}\" ` +\n\t\t\t\t\t`but is registered by module \"${module.namespace}\".`,\n\t\t\t);\n\t\t}\n\n\t\tif (!action.actionId.startsWith(`${module.namespace}.`)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Action \"${action.actionId}\" must start with module namespace \"${module.namespace}.\"`,\n\t\t\t);\n\t\t}\n\n\t\tif (action.mutatesDomain && action.emitsEvents.length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Action \"${action.actionId}\" mutates domain but emits no events. ` +\n\t\t\t\t\t`Every mutating action must emit at least one AssetEvent.`,\n\t\t\t);\n\t\t}\n\t}\n\n\tfor (const descriptor of module.displayRenderers ?? []) {\n\t\tconst isPlannedEventType = context.plannedEventTypes?.has(descriptor.eventType) ?? false;\n\t\tconst isModuleEventType = eventTypes.includes(descriptor.eventType);\n\t\tif (!isValidEventType(descriptor.eventType) && !isModuleEventType && !isPlannedEventType) {\n\t\t\tthrow new Error(\n\t\t\t\t`Display renderer registered for unknown event type \"${descriptor.eventType}\". ` +\n\t\t\t\t\t`Register the event type before adding a display renderer.`,\n\t\t\t);\n\t\t}\n\t}\n}\n\nfunction sortModulesByDependency(\n\tmodules: FabricModule<unknown>[],\n\tregisteredNamespaces = registeredModuleNamespaces,\n): FabricModule<unknown>[] {\n\tconst modulesByNamespace = new Map<string, FabricModule<unknown>>();\n\n\tfor (const module of modules) {\n\t\tvalidateModuleNamespace(module.namespace);\n\t\tif (modulesByNamespace.has(module.namespace)) {\n\t\t\tthrow new Error(`Duplicate Fabric module namespace \"${module.namespace}\".`);\n\t\t}\n\t\tmodulesByNamespace.set(module.namespace, module);\n\t}\n\n\tconst sorted: FabricModule<unknown>[] = [];\n\tconst visiting = new Set<string>();\n\tconst visited = new Set<string>();\n\n\tfunction visit(module: FabricModule<unknown>, path: string[]): void {\n\t\tif (visited.has(module.namespace)) {\n\t\t\treturn;\n\t\t}\n\t\tif (visiting.has(module.namespace)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Cyclic Fabric module dependency detected: ${[...path, module.namespace].join(\" -> \")}`,\n\t\t\t);\n\t\t}\n\n\t\tvisiting.add(module.namespace);\n\t\tfor (const dependency of (module.dependencies ?? []).map(getModuleDependencyNamespace)) {\n\t\t\tconst dependencyModule = modulesByNamespace.get(dependency);\n\t\t\tif (!dependencyModule) {\n\t\t\t\tif (registeredNamespaces.has(dependency)) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tthrow new Error(`Module \"${module.namespace}\" depends on missing module \"${dependency}\".`);\n\t\t\t}\n\t\t\tvisit(dependencyModule, [...path, module.namespace]);\n\t\t}\n\t\tvisiting.delete(module.namespace);\n\t\tvisited.add(module.namespace);\n\t\tsorted.push(module);\n\t}\n\n\tfor (const module of modules) {\n\t\tvisit(module, []);\n\t}\n\n\treturn sorted;\n}\n\nexport function registerFabricModule(module: FabricModule<unknown>): void {\n\tvalidateManifest(module, { availableNamespaces: registeredModuleNamespaces });\n\n\tfor (const objectType of module.objectTypes ?? []) {\n\t\tregisterObjectType(getObjectTypeName(objectType));\n\t}\n\n\tfor (const subjectType of module.subjectTypes ?? []) {\n\t\tregisterSubjectType(subjectType);\n\t}\n\n\tfor (const eventType of module.eventTypes ?? []) {\n\t\tregisterEventType(getEventTypeName(eventType));\n\t}\n\n\tfor (const policy of module.policies ?? []) {\n\t\tregisterPolicyIfMissing(policy as PolicyEvaluator);\n\t}\n\n\tfor (const machine of module.stateMachines ?? []) {\n\t\tregisterStateMachineIfMissing(machine as StateMachineDefinition);\n\t}\n\n\tfor (const action of module.actions ?? []) {\n\t\tregisterActionIfMissing(action);\n\t}\n\n\tfor (const descriptor of module.displayRenderers ?? []) {\n\t\tregisterDisplayRenderer(descriptor.eventType, descriptor.renderer as DisplayRenderer);\n\t}\n\n\tregisteredModuleNamespaces.add(module.namespace);\n}\n\nexport function registerFabricModules(modules: FabricModule<unknown>[]): FabricModule<unknown>[] {\n\tconst availableNamespaces = new Set([\n\t\t...registeredModuleNamespaces,\n\t\t...modules.map((module) => module.namespace),\n\t]);\n\tconst plannedEventTypes = new Set(\n\t\tmodules.flatMap((module) => (module.eventTypes ?? []).map(getEventTypeName)),\n\t);\n\n\tfor (const module of modules) {\n\t\tvalidateManifest(module, { availableNamespaces, plannedEventTypes });\n\t}\n\n\tconst sortedModules = sortModulesByDependency(modules);\n\tfor (const module of sortedModules) {\n\t\tregisterFabricModule(module);\n\t}\n\n\treturn sortedModules;\n}\n"]}
+{"version":3,"sources":["../modules/index.ts"],"names":[],"mappings":";;;;;;;;AAsFA,IAAM,0BAAA,uBAAiC,GAAA,EAAY;AAE5C,SAAS,6BAA6B,UAAA,EAA2C;AACvF,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,UAAA,CAAW,SAAA;AACjE;AAEO,SAAS,kBAAkB,UAAA,EAAiD;AAClF,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,UAAA,CAAW,IAAA;AACjE;AAEO,SAAS,iBAAiB,SAAA,EAA+C;AAC/E,EAAA,OAAO,OAAO,SAAA,KAAc,QAAA,GAAW,SAAA,GAAY,SAAA,CAAU,SAAA;AAC9D;AAEO,SAAS,wBAAwB,SAAA,EAAyB;AAChE,EAAA,IAAI,CAAC,SAAA,EAAW;AACf,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,8BAA8B,SAAS,CAAA,wDAAA;AAAA,KACxC;AAAA,EACD;AACD;AAEO,SAAS,oBAAA,CACf,OAAA,GAA+B,EAAC,EACV;AACtB,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA+B;AACtD,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,uBAAA,CAAwB,OAAO,SAAS,CAAA;AACxC,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,MAAA,CAAO,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,IAC1E;AACA,IAAA,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,EAAE,SAAS,UAAA,EAAW;AAC9B;AAEA,SAAS,sBAAA,CACR,MAAA,EACA,KAAA,EACA,SAAA,EACO;AACP,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,IAAU,EAAC,EAAG;AACjC,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,SAAS,CAAA,eAAA,EAAkB,KAAK,CAAA,OAAA,CAAS,CAAA;AAAA,IACrE;AAAA,EACD;AACD;AAEA,SAAS,gBAAA,CAAiB,MAAA,EAA+B,OAAA,GAAmC,EAAC,EAAS;AACrG,EAAA,uBAAA,CAAwB,OAAO,SAAS,CAAA;AAExC,EAAA,MAAM,gBAAgB,MAAA,CAAO,YAAA,IAAgB,EAAC,EAAG,IAAI,4BAA4B,CAAA;AACjF,EAAA,MAAM,eAAe,MAAA,CAAO,WAAA,IAAe,EAAC,EAAG,IAAI,iBAAiB,CAAA;AACpE,EAAA,MAAM,cAAc,MAAA,CAAO,UAAA,IAAc,EAAC,EAAG,IAAI,gBAAgB,CAAA;AAEjE,EAAA,KAAA,MAAW,cAAc,YAAA,EAAc;AACtC,IAAA,uBAAA,CAAwB,UAAU,CAAA;AAClC,IAAA,IAAI,UAAA,KAAe,OAAO,SAAA,EAAW;AACpC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAA,CAAO,SAAS,CAAA,0BAAA,CAA4B,CAAA;AAAA,IACxE;AACA,IAAA,IAAI,QAAQ,mBAAA,IAAuB,CAAC,QAAQ,mBAAA,CAAoB,GAAA,CAAI,UAAU,CAAA,EAAG;AAChF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,OAAO,SAAS,CAAA,6BAAA,EAAgC,UAAU,CAAA,EAAA,CAAI,CAAA;AAAA,IAC1F;AAAA,EACD;AAEA,EAAA,sBAAA,CAAuB,WAAA,EAAa,aAAA,EAAe,MAAA,CAAO,SAAS,CAAA;AACnE,EAAA,sBAAA,CAAuB,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,MAAA,CAAO,SAAS,CAAA;AAC5E,EAAA,sBAAA,CAAuB,UAAA,EAAY,YAAA,EAAc,MAAA,CAAO,SAAS,CAAA;AAEjE,EAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACrC,IAAA,IAAI,CAAC,qBAAA,CAAsB,IAAA,CAAK,UAAU,CAAA,EAAG;AAC5C,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,yBAAyB,UAAU,CAAA,gDAAA;AAAA,OACpC;AAAA,IACD;AAAA,EACD;AAEA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AAC1C,IAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,EAAG;AAChE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,MAAA,CAAO,QAAQ,CAAA,CAAE,CAAA;AAAA,IACxD;AAEA,IAAA,IAAI,MAAA,CAAO,SAAA,KAAc,MAAA,CAAO,SAAA,EAAW;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,QAAA,EAAW,OAAO,QAAQ,CAAA,sBAAA,EAAyB,OAAO,SAAS,CAAA,+BAAA,EAClC,OAAO,SAAS,CAAA,EAAA;AAAA,OAClD;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,UAAA,CAAW,GAAG,MAAA,CAAO,SAAS,GAAG,CAAA,EAAG;AACxD,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,QAAA,EAAW,MAAA,CAAO,QAAQ,CAAA,oCAAA,EAAuC,OAAO,SAAS,CAAA,EAAA;AAAA,OAClF;AAAA,IACD;AAEA,IAAA,IAAI,MAAA,CAAO,aAAA,IAAiB,MAAA,CAAO,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,QAAA,EAAW,OAAO,QAAQ,CAAA,8FAAA;AAAA,OAE3B;AAAA,IACD;AAAA,EACD;AAEA,EAAA,KAAA,MAAW,UAAA,IAAc,MAAA,CAAO,gBAAA,IAAoB,EAAC,EAAG;AACvD,IAAA,MAAM,qBAAqB,OAAA,CAAQ,iBAAA,EAAmB,GAAA,CAAI,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA;AACnF,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,QAAA,CAAS,UAAA,CAAW,SAAS,CAAA;AAClE,IAAA,IAAI,CAAC,iBAAiB,UAAA,CAAW,SAAS,KAAK,CAAC,iBAAA,IAAqB,CAAC,kBAAA,EAAoB;AACzF,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,oDAAA,EAAuD,WAAW,SAAS,CAAA,4DAAA;AAAA,OAE5E;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,uBAAA,CACR,OAAA,EACA,oBAAA,GAAuB,0BAAA,EACG;AAC1B,EAAA,MAAM,kBAAA,uBAAyB,GAAA,EAAmC;AAElE,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,uBAAA,CAAwB,OAAO,SAAS,CAAA;AACxC,IAAA,IAAI,kBAAA,CAAmB,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,MAAA,CAAO,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,IAC3E;AACA,IAAA,kBAAA,CAAmB,GAAA,CAAI,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AAAA,EAChD;AAEA,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AACjC,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAEhC,EAAA,SAAS,KAAA,CAAM,QAA+B,IAAA,EAAsB;AACnE,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AAClC,MAAA;AAAA,IACD;AACA,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,0CAAA,EAA6C,CAAC,GAAG,IAAA,EAAM,OAAO,SAAS,CAAA,CAAE,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,OACtF;AAAA,IACD;AAEA,IAAA,QAAA,CAAS,GAAA,CAAI,OAAO,SAAS,CAAA;AAC7B,IAAA,KAAA,MAAW,eAAe,MAAA,CAAO,YAAA,IAAgB,EAAC,EAAG,GAAA,CAAI,4BAA4B,CAAA,EAAG;AACvF,MAAA,MAAM,gBAAA,GAAmB,kBAAA,CAAmB,GAAA,CAAI,UAAU,CAAA;AAC1D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACtB,QAAA,IAAI,oBAAA,CAAqB,GAAA,CAAI,UAAU,CAAA,EAAG;AACzC,UAAA;AAAA,QACD;AACA,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,OAAO,SAAS,CAAA,6BAAA,EAAgC,UAAU,CAAA,EAAA,CAAI,CAAA;AAAA,MAC1F;AACA,MAAA,KAAA,CAAM,kBAAkB,CAAC,GAAG,IAAA,EAAM,MAAA,CAAO,SAAS,CAAC,CAAA;AAAA,IACpD;AACA,IAAA,QAAA,CAAS,MAAA,CAAO,OAAO,SAAS,CAAA;AAChC,IAAA,OAAA,CAAQ,GAAA,CAAI,OAAO,SAAS,CAAA;AAC5B,IAAA,MAAA,CAAO,KAAK,MAAM,CAAA;AAAA,EACnB;AAEA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAE,CAAA;AAAA,EACjB;AAEA,EAAA,OAAO,MAAA;AACR;AAEO,SAAS,qBAAqB,MAAA,EAAqC;AACzE,EAAA,gBAAA,CAAiB,MAAA,EAAQ,EAAE,mBAAA,EAAqB,0BAAA,EAA4B,CAAA;AAE5E,EAAA,KAAA,MAAW,UAAA,IAAc,MAAA,CAAO,WAAA,IAAe,EAAC,EAAG;AAClD,IAAA,kBAAA,CAAmB,iBAAA,CAAkB,UAAU,CAAC,CAAA;AAAA,EACjD;AAEA,EAAA,KAAA,MAAW,WAAA,IAAe,MAAA,CAAO,YAAA,IAAgB,EAAC,EAAG;AACpD,IAAA,mBAAA,CAAoB,WAAW,CAAA;AAAA,EAChC;AAEA,EAAA,KAAA,MAAW,SAAA,IAAa,MAAA,CAAO,UAAA,IAAc,EAAC,EAAG;AAChD,IAAA,iBAAA,CAAkB,gBAAA,CAAiB,SAAS,CAAC,CAAA;AAAA,EAC9C;AAEA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,QAAA,IAAY,EAAC,EAAG;AAC3C,IAAA,uBAAA,CAAwB,MAAyB,CAAA;AAAA,EAClD;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,MAAA,CAAO,aAAA,IAAiB,EAAC,EAAG;AACjD,IAAA,6BAAA,CAA8B,OAAiC,CAAA;AAAA,EAChE;AAEA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AAC1C,IAAA,uBAAA,CAAwB,MAAM,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,UAAA,IAAc,MAAA,CAAO,gBAAA,IAAoB,EAAC,EAAG;AACvD,IAAA,uBAAA,CAAwB,UAAA,CAAW,SAAA,EAAW,UAAA,CAAW,QAA2B,CAAA;AAAA,EACrF;AAEA,EAAA,0BAAA,CAA2B,GAAA,CAAI,OAAO,SAAS,CAAA;AAChD;AAEO,SAAS,sBAAsB,OAAA,EAA2D;AAChG,EAAA,MAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,IACnC,GAAG,0BAAA;AAAA,IACH,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAA,KAAW,OAAO,SAAS;AAAA,GAC3C,CAAA;AACD,EAAA,MAAM,oBAAoB,IAAI,GAAA;AAAA,IAC7B,OAAA,CAAQ,OAAA,CAAQ,CAAC,MAAA,KAAA,CAAY,MAAA,CAAO,cAAc,EAAC,EAAG,GAAA,CAAI,gBAAgB,CAAC;AAAA,GAC5E;AAEA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC7B,IAAA,gBAAA,CAAiB,MAAA,EAAQ,EAAE,mBAAA,EAAqB,iBAAA,EAAmB,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,aAAA,GAAgB,wBAAwB,OAAO,CAAA;AACrD,EAAA,KAAA,MAAW,UAAU,aAAA,EAAe;AACnC,IAAA,oBAAA,CAAqB,MAAM,CAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,aAAA;AACR","file":"chunk-CSZXUX5V.js","sourcesContent":["import { registerActionIfMissing, type ActionDefinition } from \"../actions\";\nimport { registerDisplayRenderer, type DisplayRenderer } from \"../displays\";\nimport { isValidEventType, registerEventType, registerSubjectType } from \"../events\";\nimport { registerObjectType } from \"../objects\";\nimport { registerPolicyIfMissing, type PolicyEvaluator } from \"../policies\";\nimport { registerStateMachineIfMissing, type StateMachineDefinition } from \"../state-machines\";\n\nexport interface ModuleDependency {\n\tnamespace: string;\n\tversion?: string;\n\toptional?: boolean;\n}\n\nexport type ModuleDependencyInput = string | ModuleDependency;\n\nexport interface IdPrefixRegistration {\n\tprefix: string;\n\tname: string;\n\tmodule: string;\n}\n\nexport interface EventTypeRegistration {\n\teventType: string;\n\tschemaVersion: number;\n\tdescription?: string;\n}\n\nexport type EventTypeRegistrationInput = string | EventTypeRegistration;\n\nexport interface ObjectTypeRegistration {\n\ttype: string;\n\tdisplayName?: string;\n\tidPrefix?: string;\n\tisCoreModuleType?: boolean;\n}\n\nexport type ObjectTypeRegistrationInput = string | ObjectTypeRegistration;\n\nexport interface ModuleDisplayRendererRegistration {\n\teventType: string;\n\trenderer: DisplayRenderer;\n}\n\nexport interface PolicyRegistration {\n\tid: string;\n\tversion?: string;\n\tdescription?: string;\n}\n\nexport interface StateMachineRegistration {\n\tentityType: string;\n\tstates: string[];\n}\n\nexport interface FabricModule<TDb = unknown> {\n\tnamespace: string;\n\tversion?: string;\n\tdisplayName?: string;\n\tdescription?: string;\n\tdependencies?: ModuleDependencyInput[];\n\tobjectTypes?: ObjectTypeRegistrationInput[];\n\tsubjectTypes?: string[];\n\tidPrefixes?: IdPrefixRegistration[];\n\teventTypes?: EventTypeRegistrationInput[];\n\tactions?: ActionDefinition<TDb>[];\n\tpolicies?: unknown[];\n\tstateMachines?: unknown[];\n\tdisplayRenderers?: ModuleDisplayRendererRegistration[];\n\tadapterDefinitions?: unknown[];\n\tpermissions?: unknown[];\n\troles?: unknown[];\n\tredactionRules?: unknown[];\n\tdataClassifications?: unknown[];\n\tretentionRules?: unknown[];\n\tevidenceRenderers?: unknown[];\n}\n\nexport interface ModuleRegistry<TDb = unknown> {\n\tmodules: ReadonlyMap<string, FabricModule<TDb>>;\n}\n\ninterface ModuleValidationContext {\n\tavailableNamespaces?: Set<string>;\n\tplannedEventTypes?: Set<string>;\n}\n\nconst registeredModuleNamespaces = new Set<string>();\n\nexport function getModuleDependencyNamespace(dependency: ModuleDependencyInput): string {\n\treturn typeof dependency === \"string\" ? dependency : dependency.namespace;\n}\n\nexport function getObjectTypeName(objectType: ObjectTypeRegistrationInput): string {\n\treturn typeof objectType === \"string\" ? objectType : objectType.type;\n}\n\nexport function getEventTypeName(eventType: EventTypeRegistrationInput): string {\n\treturn typeof eventType === \"string\" ? eventType : eventType.eventType;\n}\n\nexport function validateModuleNamespace(namespace: string): void {\n\tif (!namespace) {\n\t\tthrow new Error(\"Module namespace cannot be empty\");\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(namespace)) {\n\t\tthrow new Error(\n\t\t\t`Invalid module namespace: \"${namespace}\". Must be lowercase letters, numbers, and hyphens only.`,\n\t\t);\n\t}\n}\n\nexport function createModuleRegistry<TDb = unknown>(\n\tmodules: FabricModule<TDb>[] = [],\n): ModuleRegistry<TDb> {\n\tconst registered = new Map<string, FabricModule<TDb>>();\n\tfor (const module of modules) {\n\t\tvalidateModuleNamespace(module.namespace);\n\t\tif (registered.has(module.namespace)) {\n\t\t\tthrow new Error(`Duplicate FabricModule namespace \"${module.namespace}\".`);\n\t\t}\n\t\tregistered.set(module.namespace, module);\n\t}\n\treturn { modules: registered };\n}\n\nfunction validateIdentifierList(\n\tvalues: string[] | undefined,\n\tlabel: string,\n\tnamespace: string,\n): void {\n\tfor (const value of values ?? []) {\n\t\tif (!value) {\n\t\t\tthrow new Error(`Module \"${namespace}\" has an empty ${label} entry.`);\n\t\t}\n\t}\n}\n\nfunction validateManifest(module: FabricModule<unknown>, context: ModuleValidationContext = {}): void {\n\tvalidateModuleNamespace(module.namespace);\n\n\tconst dependencies = (module.dependencies ?? []).map(getModuleDependencyNamespace);\n\tconst objectTypes = (module.objectTypes ?? []).map(getObjectTypeName);\n\tconst eventTypes = (module.eventTypes ?? []).map(getEventTypeName);\n\n\tfor (const dependency of dependencies) {\n\t\tvalidateModuleNamespace(dependency);\n\t\tif (dependency === module.namespace) {\n\t\t\tthrow new Error(`Module \"${module.namespace}\" cannot depend on itself.`);\n\t\t}\n\t\tif (context.availableNamespaces && !context.availableNamespaces.has(dependency)) {\n\t\t\tthrow new Error(`Module \"${module.namespace}\" depends on missing module \"${dependency}\".`);\n\t\t}\n\t}\n\n\tvalidateIdentifierList(objectTypes, \"objectTypes\", module.namespace);\n\tvalidateIdentifierList(module.subjectTypes, \"subjectTypes\", module.namespace);\n\tvalidateIdentifierList(eventTypes, \"eventTypes\", module.namespace);\n\n\tfor (const objectType of objectTypes) {\n\t\tif (!/^[A-Z][a-zA-Z0-9]*$/.test(objectType)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Invalid object type: \"${objectType}\". Object types must be PascalCase alphanumeric.`,\n\t\t\t);\n\t\t}\n\t}\n\n\tfor (const action of module.actions ?? []) {\n\t\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(action.actionId)) {\n\t\t\tthrow new Error(`Invalid action ID: ${action.actionId}`);\n\t\t}\n\n\t\tif (action.namespace !== module.namespace) {\n\t\t\tthrow new Error(\n\t\t\t\t`Action \"${action.actionId}\" declares namespace \"${action.namespace}\" ` +\n\t\t\t\t\t`but is registered by module \"${module.namespace}\".`,\n\t\t\t);\n\t\t}\n\n\t\tif (!action.actionId.startsWith(`${module.namespace}.`)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Action \"${action.actionId}\" must start with module namespace \"${module.namespace}.\"`,\n\t\t\t);\n\t\t}\n\n\t\tif (action.mutatesDomain && action.emitsEvents.length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Action \"${action.actionId}\" mutates domain but emits no events. ` +\n\t\t\t\t\t`Every mutating action must emit at least one AssetEvent.`,\n\t\t\t);\n\t\t}\n\t}\n\n\tfor (const descriptor of module.displayRenderers ?? []) {\n\t\tconst isPlannedEventType = context.plannedEventTypes?.has(descriptor.eventType) ?? false;\n\t\tconst isModuleEventType = eventTypes.includes(descriptor.eventType);\n\t\tif (!isValidEventType(descriptor.eventType) && !isModuleEventType && !isPlannedEventType) {\n\t\t\tthrow new Error(\n\t\t\t\t`Display renderer registered for unknown event type \"${descriptor.eventType}\". ` +\n\t\t\t\t\t`Register the event type before adding a display renderer.`,\n\t\t\t);\n\t\t}\n\t}\n}\n\nfunction sortModulesByDependency(\n\tmodules: FabricModule<unknown>[],\n\tregisteredNamespaces = registeredModuleNamespaces,\n): FabricModule<unknown>[] {\n\tconst modulesByNamespace = new Map<string, FabricModule<unknown>>();\n\n\tfor (const module of modules) {\n\t\tvalidateModuleNamespace(module.namespace);\n\t\tif (modulesByNamespace.has(module.namespace)) {\n\t\t\tthrow new Error(`Duplicate Fabric module namespace \"${module.namespace}\".`);\n\t\t}\n\t\tmodulesByNamespace.set(module.namespace, module);\n\t}\n\n\tconst sorted: FabricModule<unknown>[] = [];\n\tconst visiting = new Set<string>();\n\tconst visited = new Set<string>();\n\n\tfunction visit(module: FabricModule<unknown>, path: string[]): void {\n\t\tif (visited.has(module.namespace)) {\n\t\t\treturn;\n\t\t}\n\t\tif (visiting.has(module.namespace)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Cyclic Fabric module dependency detected: ${[...path, module.namespace].join(\" -> \")}`,\n\t\t\t);\n\t\t}\n\n\t\tvisiting.add(module.namespace);\n\t\tfor (const dependency of (module.dependencies ?? []).map(getModuleDependencyNamespace)) {\n\t\t\tconst dependencyModule = modulesByNamespace.get(dependency);\n\t\t\tif (!dependencyModule) {\n\t\t\t\tif (registeredNamespaces.has(dependency)) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tthrow new Error(`Module \"${module.namespace}\" depends on missing module \"${dependency}\".`);\n\t\t\t}\n\t\t\tvisit(dependencyModule, [...path, module.namespace]);\n\t\t}\n\t\tvisiting.delete(module.namespace);\n\t\tvisited.add(module.namespace);\n\t\tsorted.push(module);\n\t}\n\n\tfor (const module of modules) {\n\t\tvisit(module, []);\n\t}\n\n\treturn sorted;\n}\n\nexport function registerFabricModule(module: FabricModule<unknown>): void {\n\tvalidateManifest(module, { availableNamespaces: registeredModuleNamespaces });\n\n\tfor (const objectType of module.objectTypes ?? []) {\n\t\tregisterObjectType(getObjectTypeName(objectType));\n\t}\n\n\tfor (const subjectType of module.subjectTypes ?? []) {\n\t\tregisterSubjectType(subjectType);\n\t}\n\n\tfor (const eventType of module.eventTypes ?? []) {\n\t\tregisterEventType(getEventTypeName(eventType));\n\t}\n\n\tfor (const policy of module.policies ?? []) {\n\t\tregisterPolicyIfMissing(policy as PolicyEvaluator);\n\t}\n\n\tfor (const machine of module.stateMachines ?? []) {\n\t\tregisterStateMachineIfMissing(machine as StateMachineDefinition);\n\t}\n\n\tfor (const action of module.actions ?? []) {\n\t\tregisterActionIfMissing(action);\n\t}\n\n\tfor (const descriptor of module.displayRenderers ?? []) {\n\t\tregisterDisplayRenderer(descriptor.eventType, descriptor.renderer as DisplayRenderer);\n\t}\n\n\tregisteredModuleNamespaces.add(module.namespace);\n}\n\nexport function registerFabricModules(modules: FabricModule<unknown>[]): FabricModule<unknown>[] {\n\tconst availableNamespaces = new Set([\n\t\t...registeredModuleNamespaces,\n\t\t...modules.map((module) => module.namespace),\n\t]);\n\tconst plannedEventTypes = new Set(\n\t\tmodules.flatMap((module) => (module.eventTypes ?? []).map(getEventTypeName)),\n\t);\n\n\tfor (const module of modules) {\n\t\tvalidateManifest(module, { availableNamespaces, plannedEventTypes });\n\t}\n\n\tconst sortedModules = sortModulesByDependency(modules);\n\tfor (const module of sortedModules) {\n\t\tregisterFabricModule(module);\n\t}\n\n\treturn sortedModules;\n}\n"]}

package/dist/{chunk-SDXDHVTV.cjs → chunk-DBZRPM72.cjs}

@@ -111,6 +111,35 @@ async function evaluateCodePolicy(policy, ctx) {
       }
     };
   }
+  if (ctx.mode === "preview" && evaluator.previewSafe !== true) {
+    const skipReason = `Policy ${evaluator.policyId} skipped in preview mode (evaluator is not declared previewSafe)`;
+    return {
+      policyId: policy.policyId,
+      policyVersion: policy.policyVersion,
+      policyKind: policy.kind,
+      result: "warn",
+      reason: skipReason,
+      metadata: {
+        codePolicyId: evaluator.policyId,
+        codePolicyVersion: evaluator.version,
+        previewSkipped: true
+      },
+      dispatchEvidence: {
+        policyKind: policy.kind,
+        policyId: policy.policyId,
+        policyVersion: policy.policyVersion,
+        dispatchPath: ["code"],
+        code: {
+          requestedPolicyId: codeEvaluatorPolicyId,
+          policyId: evaluator.policyId,
+          version: evaluator.version,
+          registered: true,
+          skipped: true,
+          skipReason
+        }
+      }
+    };
+  }
   const outcome = await evaluator.evaluate(ctx);
   return normalizeOutcome(policy, outcome, {
     policyKind: policy.kind,
@@ -520,6 +549,7 @@ function readPath(source, path) {
   }, source);
 }
 function normalizeOutcome(policy, outcome, dispatchEvidence) {
+  const engine = outcome.dispatchEvidence?.engine;
   return {
     ...outcome,
     policyId: policy.policyId,
@@ -530,7 +560,7 @@ function normalizeOutcome(policy, outcome, dispatchEvidence) {
       codePolicyId: dispatchEvidence.code?.policyId ?? outcome.policyId,
       codePolicyVersion: dispatchEvidence.code?.version ?? outcome.policyVersion
     },
-    dispatchEvidence
+    dispatchEvidence: engine ? { ...dispatchEvidence, engine } : dispatchEvidence
   };
 }
 function parsePolicyVersion(policyId) {
@@ -551,5 +581,5 @@ exports.registerPolicy = registerPolicy;
 exports.registerPolicyIfMissing = registerPolicyIfMissing;
 exports.resolvePolicy = resolvePolicy;
 exports.validateDataPolicyDefinition = validateDataPolicyDefinition;
-//# sourceMappingURL=chunk-SDXDHVTV.cjs.map
-//# sourceMappingURL=chunk-SDXDHVTV.cjs.map
+//# sourceMappingURL=chunk-DBZRPM72.cjs.map
+//# sourceMappingURL=chunk-DBZRPM72.cjs.map

package/dist/chunk-DBZRPM72.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../policies/index.ts"],"names":["result","passed"],"mappings":";;;AAUO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,kDAAA,CAAmD,IAAA,CAAK,QAAQ,CAAA,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AA0IA,IAAM,qBAAA,GAAwB,CAAA;AAC9B,IAAM,mCAAA,GAAsC,EAAA;AAC5C,IAAM,gCAAA,GAAmC,GAAA;AACzC,IAAM,6BAAA,GAAgC,EAAA;AACtC,IAAM,6BAAA,GAAgC,GAAA;AAEtC,IAAM,yBAAA,uBAAgC,GAAA,CAAI;AAAA,EACzC,UAAA;AAAA,EACA,SAAA;AAAA,EACA,oBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,gCAAA,uBAAuC,GAAA,CAAkC;AAAA,EAC9E,QAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,IAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,iCAAiB,IAAI,GAAA,CAA4B,CAAC,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC,CAAA;AAyEhF,IAAM,QAAA,uBAAe,GAAA,EAA+B;AAE7C,SAAS,eAAe,SAAA,EAAkC;AAChE,EAAA,cAAA,CAAe,UAAU,QAAQ,CAAA;AAEjC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA;AAChD,EAAA,IAAI,QAAA,IAAY,aAAa,SAAA,EAAW;AACvC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,qCAAA,EAAwC,UAAU,QAAQ,CAAA,+CAAA;AAAA,KAE3D;AAAA,EACD;AAEA,EAAA,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAA,EAAU,SAAS,CAAA;AAC3C;AAEO,SAAS,wBAAwB,SAAA,EAAkC;AACzE,EAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA,EAAG;AACtC,IAAA,cAAA,CAAe,SAAS,CAAA;AACxB,IAAA;AAAA,EACD;AAEA,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA;AAChD,EAAA,IAAI,QAAA,IAAY,aAAa,SAAA,EAAW;AACvC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,qCAAA,EAAwC,UAAU,QAAQ,CAAA,+CAAA;AAAA,KAE3D;AAAA,EACD;AACD;AAEO,SAAS,cAAc,QAAA,EAAiD;AAC9E,EAAA,OAAO,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC7B;AAEO,SAAS,sBAAA,GAAqC;AACpD,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,CAAA;AAClC;AAEA,eAAsB,0BAAA,CACrB,WACA,GAAA,EAC2B;AAC3B,EAAA,OAAO,yBAAA;AAAA,IACN,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc;AAAA,MAC5B,QAAA;AAAA,MACA,aAAA,EAAe,mBAAmB,QAAQ,CAAA;AAAA,MAC1C,IAAA,EAAM,MAAA;AAAA,MACN,qBAAA,EAAuB;AAAA,KACxB,CAAE,CAAA;AAAA,IACF;AAAA,GACD;AACD;AAEA,eAAsB,yBAAA,CACrB,UACA,GAAA,EAC2B;AAC3B,EAAA,MAAM,WAA4B,EAAC;AAEnC,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC9B,IAAA,cAAA,CAAe,OAAO,QAAQ,CAAA;AAC9B,IAAA,QAAA,CAAS,IAAA,CAAK,MAAM,wBAAA,CAAyB,MAAA,EAAQ,GAAG,CAAC,CAAA;AAAA,EAC1D;AAEA,EAAA,OAAO,QAAA;AACR;AAEA,eAAsB,wBAAA,CACrB,QACA,GAAA,EACyB;AACzB,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,kBAAA,CAAmB,QAAQ,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,kBAAA,CAAmB,QAAQ,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,oBAAA,CAAqB,QAAQ,GAAG,CAAA;AACxC;AAEA,eAAe,kBAAA,CACd,QACA,GAAA,EACyB;AACzB,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,IAAyB,MAAA,CAAO,QAAA;AACrE,EAAA,MAAM,SAAA,GAAY,QAAA,CAAS,GAAA,CAAI,qBAAqB,CAAA;AAEpD,EAAA,IAAI,CAAC,SAAA,EAAW;AACf,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,sCAAsC,qBAAqB,CAAA,CAAA;AAAA,MACnE,QAAA,EAAU;AAAA,QACT,4BAAA,EAA8B;AAAA,OAC/B;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,iBAAA,EAAmB,qBAAA;AAAA,UACnB,QAAA,EAAU,qBAAA;AAAA,UACV,UAAA,EAAY;AAAA;AACb;AACD,KACD;AAAA,EACD;AAEA,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,SAAA,IAAa,SAAA,CAAU,gBAAgB,IAAA,EAAM;AAC7D,IAAA,MAAM,UAAA,GACL,CAAA,OAAA,EAAU,SAAA,CAAU,QAAQ,CAAA,gEAAA,CAAA;AAE7B,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,MAAA;AAAA,MACR,MAAA,EAAQ,UAAA;AAAA,MACR,QAAA,EAAU;AAAA,QACT,cAAc,SAAA,CAAU,QAAA;AAAA,QACxB,mBAAmB,SAAA,CAAU,OAAA;AAAA,QAC7B,cAAA,EAAgB;AAAA,OACjB;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,iBAAA,EAAmB,qBAAA;AAAA,UACnB,UAAU,SAAA,CAAU,QAAA;AAAA,UACpB,SAAS,SAAA,CAAU,OAAA;AAAA,UACnB,UAAA,EAAY,IAAA;AAAA,UACZ,OAAA,EAAS,IAAA;AAAA,UACT;AAAA;AACD;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AAC5C,EAAA,OAAO,gBAAA,CAAiB,QAAQ,OAAA,EAAS;AAAA,IACxC,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,IACrB,IAAA,EAAM;AAAA,MACL,iBAAA,EAAmB,qBAAA;AAAA,MACnB,UAAU,SAAA,CAAU,QAAA;AAAA,MACpB,SAAS,SAAA,CAAU,OAAA;AAAA,MACnB,UAAA,EAAY;AAAA;AACb,GACA,CAAA;AACF;AAEA,eAAe,oBAAA,CACd,QACA,GAAA,EACyB;AACzB,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,MAAA,EAAQ,GAAG,CAAA;AAClD,EAAA,MAAM,WAAW,MAAA,CAAO,QAAA;AACxB,EAAA,MAAM,gBAAA,GAAmB,QAAA,GACtB,uBAAA,CAAwB,MAAA,EAAQ,WAAA,EAAa,QAAQ,CAAA,GACrD,EAAE,cAAA,EAAgB,KAAA,EAAO,OAAA,EAAS,eAAA,EAAyB;AAE9D,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,gBAAA,CAAiB,cAAA,EAAgB;AAClD,IAAA,IAAI,QAAA,IAAY,YAAY,gBAAA,EAAkB;AAC7C,MAAA,OAAO;AAAA,QACN,GAAG,WAAA;AAAA,QACH,gBAAA,EAAkB;AAAA,UACjB,GAAG,WAAA,CAAY,gBAAA;AAAA,UACf,QAAA,EAAU;AAAA,YACT,IAAA,EAAM,KAAA;AAAA,YACN,OAAA,EAAS,eAAA;AAAA,YACT,MAAA,EAAQ,6CAAA;AAAA,YACR,YAAY,WAAA,CAAY,MAAA;AAAA,YACxB,mBAAmB,MAAA,CAAO,aAAA;AAAA,YAC1B,uBAAuB,QAAA,CAAS;AAAA;AACjC;AACD,OACD;AAAA,IACD;AAEA,IAAA,OAAO,WAAA;AAAA,EACR;AAEA,EAAA,MAAM,UAAA,GAAsC;AAAA,IAC3C,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,IAAA,EAAM,QAAA;AAAA,IACN,uBAAuB,QAAA,CAAS;AAAA,GACjC;AACA,EAAA,MAAM,WAAA,GAAc,MAAM,kBAAA,CAAmB,UAAA,EAAY,GAAG,CAAA;AAE5D,EAAA,OAAO,gBAAA,CAAiB,QAAQ,WAAA,EAAa;AAAA,IAC5C,GAAI,YAAY,gBAAA,IAAoB;AAAA,MACnC,UAAA,EAAY,QAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAA,EAAc,CAAC,MAAM;AAAA,KACtB;AAAA,IACA,UAAA,EAAY,QAAA;AAAA,IACZ,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAA,EAAc,CAAC,MAAA,EAAQ,UAAA,EAAY,MAAM,CAAA;AAAA,IACzC,IAAA,EAAM,YAAY,gBAAA,EAAkB,IAAA;AAAA,IACpC,QAAA,EAAU;AAAA,MACT,IAAA,EAAM,IAAA;AAAA,MACN,SAAS,gBAAA,CAAiB,OAAA;AAAA,MAC1B,MAAA,EAAQ,SAAS,MAAA,IAAU,4CAAA;AAAA,MAC3B,YAAY,WAAA,CAAY,MAAA;AAAA,MACxB,mBAAmB,MAAA,CAAO,aAAA;AAAA,MAC1B,uBAAuB,QAAA,CAAS;AAAA;AACjC,GACA,CAAA;AACF;AAEA,SAAS,uBAAA,CACR,MAAA,EACA,WAAA,EACA,QAAA,EACgF;AAChF,EAAA,MAAM,eAAA,GAAkB,SAAS,QAAA,IAAY;AAAA,IAC5C,aAAA;AAAA,IACA,yBAAA;AAAA,IACA;AAAA,GACD;AACA,EAAA,MAAM,gBAAA,GAAmB,WAAA,CAAY,gBAAA,EAAkB,IAAA,EAAM,gBAAA;AAE7D,EAAA,IAAI,qBAAqB,SAAA,EAAW;AACnC,IAAA,OAAO;AAAA,MACN,cAAA,EAAgB,eAAA,CAAgB,QAAA,CAAS,yBAAyB,CAAA;AAAA,MAClE,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,IAAI,qBAAqB,SAAA,EAAW;AACnC,IAAA,OAAO;AAAA,MACN,cAAA,EAAgB,eAAA,CAAgB,QAAA,CAAS,yBAAyB,CAAA;AAAA,MAClE,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,SAAA,IAAa,CAAC,QAAQ,OAAO,CAAA;AAC9D,EAAA,OAAO;AAAA,IACN,cAAA,EACC,MAAA,CAAO,IAAA,KAAS,QAAA,IAChB,eAAA,CAAgB,QAAA,CAAS,aAAa,CAAA,IACtC,eAAA,CAAgB,QAAA,CAAS,WAAA,CAAY,MAAM,CAAA;AAAA,IAC5C,OAAA,EAAS;AAAA,GACV;AACD;AAEA,SAAS,kBAAA,CAAmB,QAAiC,GAAA,EAAmC;AAC/F,EAAA,MAAM,aAAa,MAAA,CAAO,cAAA;AAE1B,EAAA,IAAI,CAAC,UAAA,EAAY;AAChB,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,mCAAA;AAAA,MACR,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,UAC1B,gBAAA,EAAkB,SAAA;AAAA,UAClB,kBAAkB;AAAC;AACpB;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,6BAA6B,UAAU,CAAA;AAC1D,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACtB,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,QAAQ,CAAA,gCAAA,EAAmC,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,MACvE,QAAA,EAAU;AAAA,QACT,kBAAkB,UAAA,CAAW;AAAA,OAC9B;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,UAC1B,gBAAA,EAAkB,SAAA;AAAA,UAClB,kBAAkB,EAAC;AAAA,UACnB,kBAAkB,UAAA,CAAW;AAAA;AAC9B;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,WAAA,GAAc,WAAW,UAAA,CAAW,GAAA,CAAI,CAAC,SAAA,KAAc,2BAAA,CAA4B,SAAA,EAAW,GAAG,CAAC,CAAA;AACxG,EAAA,MAAM,mBAAmB,WAAA,CAAY,OAAA,CAAQ,CAAC,UAAA,KAAe,WAAW,QAAQ,CAAA;AAChF,EAAA,MAAM,kBAAkB,WAAA,CAAY,GAAA,CAAI,CAAC,UAAA,KAAe,WAAW,MAAM,CAAA;AACzE,EAAA,MAAM,SAAA,GACL,eAAA,CAAgB,IAAA,CAAK,CAACA,YAAWA,OAAAA,CAAO,MAAA,KAAW,OAAO,CAAA,IAC1D,gBAAgB,IAAA,CAAK,CAACA,OAAAA,KAAWA,OAAAA,CAAO,WAAW,MAAM,CAAA;AAC1D,EAAA,MAAM,MAAA,GAAS,SAAA,EAAW,MAAA,IAAU,UAAA,CAAW,aAAA,IAAiB,MAAA;AAEhE,EAAA,OAAO;AAAA,IACN,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,MAAA;AAAA,IACA,MAAA,EAAQ,SAAA,EAAW,MAAA,IAAU,UAAA,CAAW,MAAA;AAAA,IACxC,QAAA,EAAU;AAAA,MACT,cAAA,EAAgB,WAAW,UAAA,CAAW,MAAA;AAAA,MACtC,mBAAmB,SAAA,EAAW;AAAA,KAC/B;AAAA,IACA,gBAAA,EAAkB;AAAA,MACjB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,MACrB,IAAA,EAAM;AAAA,QACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,QAC1B,gBAAA,EAAkB,WAAA;AAAA,QAClB;AAAA;AACD;AACD,GACD;AACD;AAEO,SAAS,6BACf,UAAA,EAC6B;AAC7B,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,IAAK,UAAA,CAAW,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAChF,IAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAAA,EAC7D,CAAA,MAAA,IAAW,UAAA,CAAW,UAAA,CAAW,MAAA,GAAS,mCAAA,EAAqC;AAC9E,IAAA,MAAA,CAAO,IAAA;AAAA,MACN,mCAAmC,mCAAmC,CAAA,qBAAA;AAAA,KACvE;AAAA,EACD;AAEA,EAAA,IAAI,WAAW,aAAA,IAAiB,CAAC,eAAe,GAAA,CAAI,UAAA,CAAW,aAAa,CAAA,EAAG;AAC9E,IAAA,MAAA,CAAO,KAAK,4CAA4C,CAAA;AAAA,EACzD;AAEA,EAAA,IAAI,eAAA,GAAkB,CAAA;AACtB,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA,CAAW,UAAA,IAAc,EAAC,EAAG;AACpD,IAAA,2BAAA,CAA4B,SAAA,EAAW,MAAA,EAAQ,CAAA,EAAG,MAAM;AACvD,MAAA,eAAA,IAAmB,CAAA;AAAA,IACpB,CAAC,CAAA;AAAA,EACF;AAEA,EAAA,IAAI,kBAAkB,gCAAA,EAAkC;AACvD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,4BAAA,EAA+B,gCAAgC,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC/F;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,MAAA,KAAW,GAAG,MAAA,EAAO;AAC7C;AAEA,SAAS,2BAAA,CACR,SAAA,EACA,MAAA,EACA,KAAA,EACA,KAAA,EACO;AACP,EAAA,KAAA,EAAM;AAEN,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAChD,IAAA,MAAA,CAAO,KAAK,6BAA6B,CAAA;AACzC,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,QAAQ,qBAAA,EAAuB;AAClC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,gCAAA,EAAmC,qBAAqB,CAAA,CAAE,CAAA;AACtE,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,uBAAA,CAAwB,SAAA,CAAU,WAAW,CAAA,EAAG;AACpD,IAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAAA,EAC7D;AAEA,EAAA,4BAAA,CAA6B,YAAY,SAAA,GAAY,SAAA,CAAU,MAAA,GAAS,MAAA,EAAW,UAAU,MAAM,CAAA;AACnG,EAAA,4BAAA,CAA6B,YAAY,SAAA,GAAY,SAAA,CAAU,MAAA,GAAS,MAAA,EAAW,UAAU,MAAM,CAAA;AAEnG,EAAA,IAAI,UAAU,MAAA,KAAW,MAAA,IAAa,CAAC,uBAAA,CAAwB,SAAA,CAAU,MAAM,CAAA,EAAG;AACjF,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACjF;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,QAAA,EAAU;AAChC,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,SAAA,CAAU,MAAM,CAAA,EAAG;AAC1C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,oCAAA,CAAsC,CAAA;AAAA,IACrF;AACA,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,WAAA,EAAa;AACnC,IAAA,YAAA,CAAa,UAAU,IAAA,EAAM,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,SAAS,MAAM,CAAA;AAC9E,IAAA,kBAAA,CAAmB,UAAU,QAAA,EAAU,SAAA,CAAU,KAAA,EAAO,SAAA,CAAU,aAAa,MAAM,CAAA;AACrF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,YAAA,EAAc;AACpC,IAAA,uBAAA,CAAwB,SAAA,CAAU,IAAA,EAAM,SAAA,CAAU,WAAA,EAAa,MAAM,CAAA;AACrE,IAAA,kBAAA,CAAmB,UAAU,QAAA,EAAU,SAAA,CAAU,KAAA,EAAO,SAAA,CAAU,aAAa,MAAM,CAAA;AACrF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,KAAA,IAAS,SAAA,CAAU,SAAS,KAAA,EAAO;AACzD,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,SAAA,CAAU,UAAU,CAAA,IAAK,SAAA,CAAU,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAC9E,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,8BAAA,CAAgC,CAAA;AAC9E,MAAA;AAAA,IACD;AAEA,IAAA,IAAI,SAAA,CAAU,UAAA,CAAW,MAAA,GAAS,mCAAA,EAAqC;AACtE,MAAA,MAAA,CAAO,IAAA;AAAA,QACN,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,sBAAA,EAAyB,mCAAmC,CAAA,iBAAA;AAAA,OAC/F;AAAA,IACD;AAEA,IAAA,KAAA,MAAW,KAAA,IAAS,UAAU,UAAA,EAAY;AACzC,MAAA,2BAAA,CAA4B,KAAA,EAAO,MAAA,EAAQ,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,IAC5D;AACA,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC7B,IAAA,2BAAA,CAA4B,SAAA,CAAU,SAAA,EAAW,MAAA,EAAQ,KAAA,GAAQ,GAAG,KAAK,CAAA;AACzE,IAAA;AAAA,EACD;AAEA,EAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,qBAAA,CAAuB,CAAA;AACtE;AAEA,SAAS,4BAAA,CACR,MAAA,EACA,SAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,WAAW,MAAA,IAAa,CAAC,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AACxD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,6BAAA,CAA+B,CAAA;AAAA,EACxD;AACD;AAEA,SAAS,uBAAA,CACR,SAAA,EACA,WAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAChD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,gCAAA,CAAkC,CAAA;AACtE,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,MAAA,KAAW,YAAA,IAAgB,SAAA,CAAU,WAAW,SAAA,EAAW;AACxE,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,qCAAA,CAAuC,CAAA;AAAA,EAC5E;AAEA,EAAA,YAAA,CAAa,SAAA,CAAU,IAAA,EAAM,CAAA,UAAA,EAAa,WAAW,cAAc,MAAM,CAAA;AAEzE,EAAA,IAAI,SAAA,CAAU,WAAW,SAAA,IAAa,CAAC,0BAA0B,GAAA,CAAI,SAAA,CAAU,IAAI,CAAA,EAAG;AACrF,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,iCAAA,CAAmC,CAAA;AAAA,EACxE;AACD;AAEA,SAAS,kBAAA,CACR,QAAA,EACA,KAAA,EACA,WAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,CAAC,gCAAA,CAAiC,GAAA,CAAI,QAAQ,CAAA,EAAG;AACpD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,yBAAA,CAA2B,CAAA;AAC/D,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,aAAa,QAAA,EAAU;AAC1B,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAChC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,2CAAA,CAA6C,CAAA;AACjF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,IAAK,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/E,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,2CAAA,CAA6C,CAAA;AAAA,EAClF;AACD;AAEA,SAAS,YAAA,CAAa,IAAA,EAAc,SAAA,EAAmB,MAAA,EAAwB;AAC9E,EAAA,IAAI,CAAC,uBAAA,CAAwB,IAAI,CAAA,EAAG;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,mCAAA,CAAqC,CAAA;AAC7D,IAAA;AAAA,EACD;AAEA,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,IAAI,QAAA,CAAS,SAAS,6BAAA,EAA+B;AACpD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,sBAAA,EAAyB,6BAA6B,CAAA,SAAA,CAAW,CAAA;AACzF,IAAA;AAAA,EACD;AAEA,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC/B,IAAA,IAAI,CAAC,0BAAA,CAA2B,IAAA,CAAK,OAAO,CAAA,EAAG;AAC9C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,iCAAA,CAAmC,CAAA;AAC3D,MAAA;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,WAAA,EAAa,aAAA,EAAe,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG;AAChE,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,kCAAA,CAAoC,CAAA;AAC5D,MAAA;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,oBAAoB,KAAA,EAA4C;AACxE,EAAA,IAAI,UAAU,IAAA,IAAQ,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,EAAW;AAC9E,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,IAAU,6BAAA;AACrD;AAEA,SAAS,wBAAwB,KAAA,EAAiC;AACjE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,MAAM,MAAA,GAAS,CAAA,IAAK,MAAM,MAAA,IAAU,6BAAA;AACzE;AAEA,SAAS,2BAAA,CACR,WACA,GAAA,EAC+E;AAC/E,EAAA,IAAI,SAAA,CAAU,SAAS,QAAA,EAAU;AAChC,IAAA,MAAMA,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAQ,UAAU,MAAA,KAAW,MAAA;AAAA,MAC7B,QAAQ,SAAA,CAAU,MAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACnB;AACA,IAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAM,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,KAAA,IAAS,SAAA,CAAU,SAAS,KAAA,EAAO;AACzD,IAAA,MAAM,gBAAA,GAAmB,UAAU,UAAA,CAAW,GAAA,CAAI,CAAC,KAAA,KAAU,2BAAA,CAA4B,KAAA,EAAO,GAAG,CAAC,CAAA;AACpG,IAAA,MAAMC,UACL,SAAA,CAAU,IAAA,KAAS,QAChB,gBAAA,CAAiB,KAAA,CAAM,CAAC,UAAA,KAAe,UAAA,CAAW,MAAA,CAAO,MAAM,IAC/D,gBAAA,CAAiB,IAAA,CAAK,CAAC,UAAA,KAAe,UAAA,CAAW,OAAO,MAAM,CAAA;AAClE,IAAA,MAAMD,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAAC,OAAAA;AAAA,MACA,QAAQA,OAAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,MACrE,MAAA,EAAQA,OAAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,KACxC;AAEA,IAAA,OAAO;AAAA,MACN,MAAA,EAAAD,OAAAA;AAAA,MACA,QAAA,EAAU,CAACA,OAAAA,EAAQ,GAAG,gBAAA,CAAiB,QAAQ,CAAC,UAAA,KAAe,UAAA,CAAW,QAAQ,CAAC;AAAA,KACpF;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC7B,IAAA,MAAM,eAAA,GAAkB,2BAAA,CAA4B,SAAA,CAAU,SAAA,EAAW,GAAG,CAAA;AAC5E,IAAA,MAAMC,OAAAA,GAAS,CAAC,eAAA,CAAgB,MAAA,CAAO,MAAA;AACvC,IAAA,MAAMD,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAAC,OAAAA;AAAA,MACA,QAAQA,OAAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,MACrE,MAAA,EAAQA,OAAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,KACxC;AAEA,IAAA,OAAO,EAAE,QAAAD,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAAA,EAAQ,GAAG,eAAA,CAAgB,QAAQ,CAAA,EAAE;AAAA,EAClE;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,WAAA,IAAe,SAAA,CAAU,SAAS,YAAA,EAAc;AACtE,IAAA,MAAMA,OAAAA,GAAoC;AAAA,MACzC,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT;AACA,IAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAM,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,MAAM,KAAA,GACL,SAAA,CAAU,IAAA,KAAS,WAAA,GAChB,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,SAAA,CAAU,IAAI,CAAA,GACvC,oBAAA,CAAqB,GAAA,EAAK,UAAU,IAAI,CAAA;AAC5C,EAAA,MAAM,WAAW,SAAA,CAAU,QAAA;AAC3B,EAAA,MAAM,WAAW,SAAA,CAAU,KAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAU,QAAQ,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS;AAAA,IACd,aAAa,SAAA,CAAU,WAAA;AAAA,IACvB,MAAA;AAAA,IACA,QAAQ,MAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,IACrE,MAAA,EAAQ,MAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,GACxC;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAC,MAAM,CAAA,EAAE;AACrC;AAEA,SAAS,gBAAA,CACR,MAAA,EACA,QAAA,EACA,QAAA,EACU;AACV,EAAA,QAAQ,QAAA;AAAU,IACjB,KAAK,QAAA;AACJ,MAAA,OAAO,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,MAAA,KAAW,EAAA;AAAA,IAC9D,KAAK,QAAA;AACJ,MAAA,OAAO,MAAA,KAAW,QAAA;AAAA,IACnB,KAAK,WAAA;AACJ,MAAA,OAAO,MAAA,KAAW,QAAA;AAAA,IACnB,KAAK,IAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,GAAS,QAAA;AAAA,IAC/E,KAAK,KAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,IAAU,QAAA;AAAA,IAChF,KAAK,IAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,GAAS,QAAA;AAAA,IAC/E,KAAK,KAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,IAAU,QAAA;AAAA;AAElF;AAEA,SAAS,oBAAA,CAAqB,KAAoB,SAAA,EAA+C;AAChG,EAAA,IAAI,SAAA,CAAU,WAAW,YAAA,EAAc;AACtC,IAAA,OAAO,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,SAAA,CAAU,IAAI,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAO,QAAA;AAAA,IACN;AAAA,MACC,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,oBAAoB,GAAA,CAAI,kBAAA;AAAA,MACxB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,MAAM,GAAA,CAAI;AAAA,KACX;AAAA,IACA,SAAA,CAAU;AAAA,GACX;AACD;AAEA,SAAS,QAAA,CAAS,QAAiB,IAAA,EAAuB;AACzD,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,IAAA,OAAO,MAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,KAAA,CAAM,GAAG,EAAE,MAAA,CAAgB,CAAC,SAAS,OAAA,KAAY;AAC5D,IAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC5C,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAQ,QAAoC,OAAO,CAAA;AAAA,EACpD,GAAG,MAAM,CAAA;AACV;AAEA,SAAS,gBAAA,CACR,MAAA,EACA,OAAA,EACA,gBAAA,EACgB;AAKhB,EAAA,MAAM,MAAA,GAAS,QAAQ,gBAAA,EAAkB,MAAA;AACzC,EAAA,OAAO;AAAA,IACN,GAAG,OAAA;AAAA,IACH,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,QAAA,EAAU;AAAA,MACT,GAAI,OAAA,CAAQ,QAAA,IAAY,EAAC;AAAA,MACzB,YAAA,EAAc,gBAAA,CAAiB,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,QAAA;AAAA,MACzD,iBAAA,EAAmB,gBAAA,CAAiB,IAAA,EAAM,OAAA,IAAW,OAAA,CAAQ;AAAA,KAC9D;AAAA,IACA,kBAAkB,MAAA,GAAS,EAAE,GAAG,gBAAA,EAAkB,QAAO,GAAI;AAAA,GAC9D;AACD;AAEA,SAAS,mBAAmB,QAAA,EAA4B;AACvD,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA;AACpC,EAAA,OAAO,OAAO,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,KAAK,CAAC,CAAA;AACjD;AAEO,SAAS,wBAAwB,QAAA,EAAsD;AAC7F,EAAA,OACC,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,QAAQ,MAAA,KAAW,OAAO,CAAA,IACrD,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAEtD","file":"chunk-DBZRPM72.cjs","sourcesContent":["import type { FabricRuntimeServices } from \"../actions\";\n\nexport type PolicyEvaluationResult = \"pass\" | \"warn\" | \"block\";\n\nexport type PolicyKind = \"code\" | \"data\" | \"hybrid\";\n\nexport type PolicyId = `${string}.v${number}`;\n\nexport type PolicyEvaluationMode = \"preview\" | \"execute\";\n\nexport function assertPolicyId(policyId: string): asserts policyId is PolicyId {\n\tif (!/^[a-z][a-z0-9_-]*(\\.[a-z][a-z0-9_-]*)*\\.v[0-9]+$/.test(policyId)) {\n\t\tthrow new Error(`Invalid policy ID: ${policyId}`);\n\t}\n}\n\nexport interface PolicyContext<TDb = unknown> {\n\ttenantId: string;\n\tspaceId: string;\n\tactionInvocationId: string;\n\tactionId: string;\n\tparameters: unknown;\n\tdb: TDb;\n\tnow?: Date;\n\tmode?: PolicyEvaluationMode;\n\t/**\n\t * Optional runtime services bag, mirroring {@link FabricRuntimeServices} on\n\t * `ActionContext`. Lets the host inject dependencies (HTTP clients, secret\n\t * managers, external policy engines such as OPA, feature flags, etc.) that\n\t * a code policy evaluator may need without resorting to module-level\n\t * globals. The shape is opaque to the platform — adapters narrow it.\n\t */\n\tservices?: FabricRuntimeServices;\n}\n\nexport interface PolicyFact {\n\tname: string;\n\tvalue: unknown;\n\tlabel?: string;\n}\n\nexport interface PolicyCorrectiveAction {\n\tlabel: string;\n\tdescription?: string;\n\tactionId?: string;\n\tparameters?: Record<string, unknown>;\n\ttarget?: {\n\t\tsurface?: string;\n\t\ttab?: string;\n\t\tfield?: string;\n\t};\n\trequiresConfirmation?: boolean;\n}\n\nexport interface PolicyGuidance {\n\tsummary?: string;\n\tfactsUsed: PolicyFact[];\n\tcorrectiveActions: PolicyCorrectiveAction[];\n}\n\nexport interface PolicyOutcome {\n\tpolicyId: PolicyId;\n\tpolicyVersion: number;\n\tpolicyKind?: PolicyKind;\n\tresult: PolicyEvaluationResult;\n\treason?: string;\n\tguidance?: PolicyGuidance;\n\tmetadata?: Record<string, unknown>;\n\tdispatchEvidence?: PolicyDispatchEvidence;\n}\n\nexport interface PolicyEvaluator<TDb = unknown> {\n\tpolicyId: PolicyId;\n\tversion: number;\n\tkind?: Extract<PolicyKind, \"code\">;\n\tpreviewSafe?: boolean;\n\tevaluate: (ctx: PolicyContext<TDb>) => Promise<PolicyOutcome>;\n}\n\nexport type DataPolicySource = \"parameters\" | \"context\";\n\nexport type DataPolicyLiteral = string | number | boolean | null;\n\nexport type DataPolicyComparisonOperator =\n\t| \"exists\"\n\t| \"equals\"\n\t| \"notEquals\"\n\t| \"gt\"\n\t| \"gte\"\n\t| \"lt\"\n\t| \"lte\";\n\nexport interface DataPolicySourceReference {\n\tsource: DataPolicySource;\n\tpath: string;\n}\n\nexport type DataPolicyCondition =\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"always\";\n\t\t\tresult: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"parameter\";\n\t\t\tpath: string;\n\t\t\toperator: DataPolicyComparisonOperator;\n\t\t\tvalue?: DataPolicyLiteral;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"comparison\";\n\t\t\tleft: DataPolicySourceReference;\n\t\t\toperator: DataPolicyComparisonOperator;\n\t\t\tvalue?: DataPolicyLiteral;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"all\" | \"any\";\n\t\t\tconditions: DataPolicyCondition[];\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"not\";\n\t\t\tcondition: DataPolicyCondition;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t};\n\nexport interface DataPolicyDefinition {\n\tconditions: DataPolicyCondition[];\n\tdefaultResult?: PolicyEvaluationResult;\n\treason?: string;\n}\n\nexport interface DataPolicyValidationResult {\n\tvalid: boolean;\n\terrors: string[];\n}\n\nconst DATA_POLICY_MAX_DEPTH = 5;\nconst DATA_POLICY_MAX_CONDITIONS_PER_NODE = 20;\nconst DATA_POLICY_MAX_TOTAL_CONDITIONS = 100;\nconst DATA_POLICY_MAX_PATH_SEGMENTS = 12;\nconst DATA_POLICY_MAX_STRING_LENGTH = 500;\n\nconst DATA_POLICY_CONTEXT_PATHS = new Set([\n\t\"tenantId\",\n\t\"spaceId\",\n\t\"actionInvocationId\",\n\t\"actionId\",\n\t\"mode\",\n]);\n\nconst DATA_POLICY_COMPARISON_OPERATORS = new Set<DataPolicyComparisonOperator>([\n\t\"exists\",\n\t\"equals\",\n\t\"notEquals\",\n\t\"gt\",\n\t\"gte\",\n\t\"lt\",\n\t\"lte\",\n]);\n\nconst POLICY_RESULTS = new Set<PolicyEvaluationResult>([\"pass\", \"warn\", \"block\"]);\n\nexport interface PolicyFallbackDefinition {\n\tcodeEvaluatorPolicyId: PolicyId;\n\tonResults?: PolicyEvaluationResult[];\n\ttriggers?: PolicyFallbackTrigger[];\n\treason?: string;\n}\n\nexport type PolicyFallbackTrigger =\n\t| \"data_result\"\n\t| \"missing_data_definition\"\n\t| \"invalid_data_definition\";\n\nexport interface DataPolicyConditionResult {\n\tconditionId: string;\n\tpassed: boolean;\n\tresult: PolicyEvaluationResult;\n\treason?: string;\n}\n\nexport interface RuntimePolicyDefinition {\n\tpolicyId: PolicyId;\n\tpolicyVersion: number;\n\tkind: PolicyKind;\n\tdataDefinition?: DataPolicyDefinition;\n\tcodeEvaluatorPolicyId?: PolicyId;\n\tfallback?: PolicyFallbackDefinition;\n}\n\nexport interface PolicyDispatchEvidence {\n\tpolicyKind: PolicyKind;\n\tpolicyId?: PolicyId;\n\tpolicyVersion?: number;\n\tdispatchPath: Array<\"data\" | \"code\" | \"fallback\">;\n\tdata?: {\n\t\tdefinitionVersion: number;\n\t\tdefinitionStatus: \"evaluated\" | \"missing\" | \"invalid\";\n\t\tconditionResults: DataPolicyConditionResult[];\n\t\tvalidationErrors?: string[];\n\t};\n\tcode?: {\n\t\trequestedPolicyId?: PolicyId;\n\t\tpolicyId: PolicyId;\n\t\tversion?: number;\n\t\tregistered: boolean;\n\t\tskipped?: boolean;\n\t\tskipReason?: string;\n\t};\n\tfallback?: {\n\t\tused: boolean;\n\t\ttrigger: PolicyFallbackTrigger | \"not_triggered\";\n\t\treason: string;\n\t\tfromResult?: PolicyEvaluationResult;\n\t\tdefinitionVersion: number;\n\t\tcodeEvaluatorPolicyId: PolicyId;\n\t};\n\t/**\n\t * Provenance for the engine that produced this decision when a code\n\t * evaluator delegates to an external policy engine (OPA, Cedar, Cerbos,\n\t * Topaz, etc.). Fabric's `policyId` / `policyVersion` remain canonical for\n\t * audit; this block carries deployment provenance (decision path, bundle\n\t * revision, decision ID, input hash). Adapters populate it; the platform\n\t * keeps `metadata` open-ended so engine-specific typing can live in the\n\t * adapter package.\n\t */\n\tengine?: {\n\t\tname: string;\n\t\tversion?: string;\n\t\tmetadata?: Record<string, unknown>;\n\t};\n}\n\nconst registry = new Map<PolicyId, PolicyEvaluator>();\n\nexport function registerPolicy(evaluator: PolicyEvaluator): void {\n\tassertPolicyId(evaluator.policyId);\n\n\tconst existing = registry.get(evaluator.policyId);\n\tif (existing && existing !== evaluator) {\n\t\tthrow new Error(\n\t\t\t`Conflicting policy registration for \"${evaluator.policyId}\". ` +\n\t\t\t\t`A different evaluator is already registered.`,\n\t\t);\n\t}\n\n\tregistry.set(evaluator.policyId, evaluator);\n}\n\nexport function registerPolicyIfMissing(evaluator: PolicyEvaluator): void {\n\tif (!registry.has(evaluator.policyId)) {\n\t\tregisterPolicy(evaluator);\n\t\treturn;\n\t}\n\n\tconst existing = registry.get(evaluator.policyId);\n\tif (existing && existing !== evaluator) {\n\t\tthrow new Error(\n\t\t\t`Conflicting policy registration for \"${evaluator.policyId}\". ` +\n\t\t\t\t`A different evaluator is already registered.`,\n\t\t);\n\t}\n}\n\nexport function resolvePolicy(policyId: PolicyId): PolicyEvaluator | undefined {\n\treturn registry.get(policyId);\n}\n\nexport function getRegisteredPolicyIds(): PolicyId[] {\n\treturn Array.from(registry.keys());\n}\n\nexport async function evaluateRegisteredPolicies(\n\tpolicyIds: PolicyId[],\n\tctx: PolicyContext,\n): Promise<PolicyOutcome[]> {\n\treturn evaluatePolicyDefinitions(\n\t\tpolicyIds.map((policyId) => ({\n\t\t\tpolicyId,\n\t\t\tpolicyVersion: parsePolicyVersion(policyId),\n\t\t\tkind: \"code\",\n\t\t\tcodeEvaluatorPolicyId: policyId,\n\t\t})),\n\t\tctx,\n\t);\n}\n\nexport async function evaluatePolicyDefinitions(\n\tpolicies: RuntimePolicyDefinition[],\n\tctx: PolicyContext,\n): Promise<PolicyOutcome[]> {\n\tconst outcomes: PolicyOutcome[] = [];\n\n\tfor (const policy of policies) {\n\t\tassertPolicyId(policy.policyId);\n\t\toutcomes.push(await evaluatePolicyDefinition(policy, ctx));\n\t}\n\n\treturn outcomes;\n}\n\nexport async function evaluatePolicyDefinition(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tif (policy.kind === \"data\") {\n\t\treturn evaluateDataPolicy(policy, ctx);\n\t}\n\n\tif (policy.kind === \"code\") {\n\t\treturn evaluateCodePolicy(policy, ctx);\n\t}\n\n\treturn evaluateHybridPolicy(policy, ctx);\n}\n\nasync function evaluateCodePolicy(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tconst codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId ?? policy.policyId;\n\tconst evaluator = registry.get(codeEvaluatorPolicyId);\n\n\tif (!evaluator) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: `No evaluator registered for policy ${codeEvaluatorPolicyId}`,\n\t\t\tmetadata: {\n\t\t\t\tmissingCodeEvaluatorPolicyId: codeEvaluatorPolicyId,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"code\"],\n\t\t\t\tcode: {\n\t\t\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tpolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tregistered: false,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tif (ctx.mode === \"preview\" && evaluator.previewSafe !== true) {\n\t\tconst skipReason =\n\t\t\t`Policy ${evaluator.policyId} skipped in preview mode ` +\n\t\t\t`(evaluator is not declared previewSafe)`;\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"warn\",\n\t\t\treason: skipReason,\n\t\t\tmetadata: {\n\t\t\t\tcodePolicyId: evaluator.policyId,\n\t\t\t\tcodePolicyVersion: evaluator.version,\n\t\t\t\tpreviewSkipped: true,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"code\"],\n\t\t\t\tcode: {\n\t\t\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tpolicyId: evaluator.policyId,\n\t\t\t\t\tversion: evaluator.version,\n\t\t\t\t\tregistered: true,\n\t\t\t\t\tskipped: true,\n\t\t\t\t\tskipReason,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst outcome = await evaluator.evaluate(ctx);\n\treturn normalizeOutcome(policy, outcome, {\n\t\tpolicyKind: policy.kind,\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tdispatchPath: [\"code\"],\n\t\tcode: {\n\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\tpolicyId: evaluator.policyId,\n\t\t\tversion: evaluator.version,\n\t\t\tregistered: true,\n\t\t},\n\t});\n}\n\nasync function evaluateHybridPolicy(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tconst dataOutcome = evaluateDataPolicy(policy, ctx);\n\tconst fallback = policy.fallback;\n\tconst fallbackDecision = fallback\n\t\t? resolveFallbackDecision(policy, dataOutcome, fallback)\n\t\t: { shouldFallback: false, trigger: \"not_triggered\" as const };\n\n\tif (!fallback || !fallbackDecision.shouldFallback) {\n\t\tif (fallback && dataOutcome.dispatchEvidence) {\n\t\t\treturn {\n\t\t\t\t...dataOutcome,\n\t\t\t\tdispatchEvidence: {\n\t\t\t\t\t...dataOutcome.dispatchEvidence,\n\t\t\t\t\tfallback: {\n\t\t\t\t\t\tused: false,\n\t\t\t\t\t\ttrigger: \"not_triggered\",\n\t\t\t\t\t\treason: \"Data policy result did not trigger fallback\",\n\t\t\t\t\t\tfromResult: dataOutcome.result,\n\t\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn dataOutcome;\n\t}\n\n\tconst codePolicy: RuntimePolicyDefinition = {\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tkind: \"hybrid\",\n\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t};\n\tconst codeOutcome = await evaluateCodePolicy(codePolicy, ctx);\n\n\treturn normalizeOutcome(policy, codeOutcome, {\n\t\t...(codeOutcome.dispatchEvidence ?? {\n\t\t\tpolicyKind: \"hybrid\",\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tdispatchPath: [\"code\"],\n\t\t}),\n\t\tpolicyKind: \"hybrid\",\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tdispatchPath: [\"data\", \"fallback\", \"code\"],\n\t\tdata: dataOutcome.dispatchEvidence?.data,\n\t\tfallback: {\n\t\t\tused: true,\n\t\t\ttrigger: fallbackDecision.trigger,\n\t\t\treason: fallback.reason ?? \"Data policy result triggered code fallback\",\n\t\t\tfromResult: dataOutcome.result,\n\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t\t},\n\t});\n}\n\nfunction resolveFallbackDecision(\n\tpolicy: RuntimePolicyDefinition,\n\tdataOutcome: PolicyOutcome,\n\tfallback: PolicyFallbackDefinition,\n): { shouldFallback: boolean; trigger: PolicyFallbackTrigger | \"not_triggered\" } {\n\tconst allowedTriggers = fallback.triggers ?? [\n\t\t\"data_result\",\n\t\t\"missing_data_definition\",\n\t\t\"invalid_data_definition\",\n\t];\n\tconst definitionStatus = dataOutcome.dispatchEvidence?.data?.definitionStatus;\n\n\tif (definitionStatus === \"missing\") {\n\t\treturn {\n\t\t\tshouldFallback: allowedTriggers.includes(\"missing_data_definition\"),\n\t\t\ttrigger: \"missing_data_definition\",\n\t\t};\n\t}\n\n\tif (definitionStatus === \"invalid\") {\n\t\treturn {\n\t\t\tshouldFallback: allowedTriggers.includes(\"invalid_data_definition\"),\n\t\t\ttrigger: \"invalid_data_definition\",\n\t\t};\n\t}\n\n\tconst fallbackResults = fallback.onResults ?? [\"warn\", \"block\"];\n\treturn {\n\t\tshouldFallback:\n\t\t\tpolicy.kind === \"hybrid\" &&\n\t\t\tallowedTriggers.includes(\"data_result\") &&\n\t\t\tfallbackResults.includes(dataOutcome.result),\n\t\ttrigger: \"data_result\",\n\t};\n}\n\nfunction evaluateDataPolicy(policy: RuntimePolicyDefinition, ctx: PolicyContext): PolicyOutcome {\n\tconst definition = policy.dataDefinition;\n\n\tif (!definition) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: \"Data policy definition is missing\",\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"data\"],\n\t\t\t\tdata: {\n\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\tdefinitionStatus: \"missing\",\n\t\t\t\t\tconditionResults: [],\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst validation = validateDataPolicyDefinition(definition);\n\tif (!validation.valid) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: `Invalid data policy definition: ${validation.errors.join(\"; \")}`,\n\t\t\tmetadata: {\n\t\t\t\tvalidationErrors: validation.errors,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"data\"],\n\t\t\t\tdata: {\n\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\tdefinitionStatus: \"invalid\",\n\t\t\t\t\tconditionResults: [],\n\t\t\t\t\tvalidationErrors: validation.errors,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst evaluations = definition.conditions.map((condition) => evaluateDataPolicyCondition(condition, ctx));\n\tconst conditionResults = evaluations.flatMap((evaluation) => evaluation.evidence);\n\tconst topLevelResults = evaluations.map((evaluation) => evaluation.result);\n\tconst aggregate =\n\t\ttopLevelResults.find((result) => result.result === \"block\") ??\n\t\ttopLevelResults.find((result) => result.result === \"warn\");\n\tconst result = aggregate?.result ?? definition.defaultResult ?? \"pass\";\n\n\treturn {\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tpolicyKind: policy.kind,\n\t\tresult,\n\t\treason: aggregate?.reason ?? definition.reason,\n\t\tmetadata: {\n\t\t\tconditionCount: definition.conditions.length,\n\t\t\tfailedConditionId: aggregate?.conditionId,\n\t\t},\n\t\tdispatchEvidence: {\n\t\t\tpolicyKind: policy.kind,\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tdispatchPath: [\"data\"],\n\t\t\tdata: {\n\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\tdefinitionStatus: \"evaluated\",\n\t\t\t\tconditionResults,\n\t\t\t},\n\t\t},\n\t};\n}\n\nexport function validateDataPolicyDefinition(\n\tdefinition: DataPolicyDefinition,\n): DataPolicyValidationResult {\n\tconst errors: string[] = [];\n\n\tif (!Array.isArray(definition.conditions) || definition.conditions.length === 0) {\n\t\terrors.push(\"conditions must contain at least one condition\");\n\t} else if (definition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {\n\t\terrors.push(\n\t\t\t`conditions must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} top-level conditions`,\n\t\t);\n\t}\n\n\tif (definition.defaultResult && !POLICY_RESULTS.has(definition.defaultResult)) {\n\t\terrors.push(\"defaultResult must be pass, warn, or block\");\n\t}\n\n\tlet totalConditions = 0;\n\tfor (const condition of definition.conditions ?? []) {\n\t\tvalidateDataPolicyCondition(condition, errors, 1, () => {\n\t\t\ttotalConditions += 1;\n\t\t});\n\t}\n\n\tif (totalConditions > DATA_POLICY_MAX_TOTAL_CONDITIONS) {\n\t\terrors.push(`policy must contain at most ${DATA_POLICY_MAX_TOTAL_CONDITIONS} total conditions`);\n\t}\n\n\treturn { valid: errors.length === 0, errors };\n}\n\nfunction validateDataPolicyCondition(\n\tcondition: DataPolicyCondition,\n\terrors: string[],\n\tdepth: number,\n\tcount: () => void,\n): void {\n\tcount();\n\n\tif (!condition || typeof condition !== \"object\") {\n\t\terrors.push(\"condition must be an object\");\n\t\treturn;\n\t}\n\n\tif (depth > DATA_POLICY_MAX_DEPTH) {\n\t\terrors.push(`condition depth must not exceed ${DATA_POLICY_MAX_DEPTH}`);\n\t\treturn;\n\t}\n\n\tif (!isNonEmptyBoundedString(condition.conditionId)) {\n\t\terrors.push(\"conditionId must be a non-empty bounded string\");\n\t}\n\n\tvalidateOptionalPolicyResult(\"onPass\" in condition ? condition.onPass : undefined, \"onPass\", errors);\n\tvalidateOptionalPolicyResult(\"onFail\" in condition ? condition.onFail : undefined, \"onFail\", errors);\n\n\tif (condition.reason !== undefined && !isNonEmptyBoundedString(condition.reason)) {\n\t\terrors.push(`condition ${condition.conditionId} reason must be a bounded string`);\n\t}\n\n\tif (condition.type === \"always\") {\n\t\tif (!POLICY_RESULTS.has(condition.result)) {\n\t\t\terrors.push(`condition ${condition.conditionId} result must be pass, warn, or block`);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (condition.type === \"parameter\") {\n\t\tvalidatePath(condition.path, `condition ${condition.conditionId} path`, errors);\n\t\tvalidateComparison(condition.operator, condition.value, condition.conditionId, errors);\n\t\treturn;\n\t}\n\n\tif (condition.type === \"comparison\") {\n\t\tvalidateSourceReference(condition.left, condition.conditionId, errors);\n\t\tvalidateComparison(condition.operator, condition.value, condition.conditionId, errors);\n\t\treturn;\n\t}\n\n\tif (condition.type === \"all\" || condition.type === \"any\") {\n\t\tif (!Array.isArray(condition.conditions) || condition.conditions.length === 0) {\n\t\t\terrors.push(`condition ${condition.conditionId} must contain child conditions`);\n\t\t\treturn;\n\t\t}\n\n\t\tif (condition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {\n\t\t\terrors.push(\n\t\t\t\t`condition ${condition.conditionId} must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} child conditions`,\n\t\t\t);\n\t\t}\n\n\t\tfor (const child of condition.conditions) {\n\t\t\tvalidateDataPolicyCondition(child, errors, depth + 1, count);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (condition.type === \"not\") {\n\t\tvalidateDataPolicyCondition(condition.condition, errors, depth + 1, count);\n\t\treturn;\n\t}\n\n\terrors.push(`condition ${condition.conditionId} has unsupported type`);\n}\n\nfunction validateOptionalPolicyResult(\n\tresult: PolicyEvaluationResult | undefined,\n\tfieldName: string,\n\terrors: string[],\n): void {\n\tif (result !== undefined && !POLICY_RESULTS.has(result)) {\n\t\terrors.push(`${fieldName} must be pass, warn, or block`);\n\t}\n}\n\nfunction validateSourceReference(\n\treference: DataPolicySourceReference,\n\tconditionId: string,\n\terrors: string[],\n): void {\n\tif (!reference || typeof reference !== \"object\") {\n\t\terrors.push(`condition ${conditionId} left must be a source reference`);\n\t\treturn;\n\t}\n\n\tif (reference.source !== \"parameters\" && reference.source !== \"context\") {\n\t\terrors.push(`condition ${conditionId} source must be parameters or context`);\n\t}\n\n\tvalidatePath(reference.path, `condition ${conditionId} left.path`, errors);\n\n\tif (reference.source === \"context\" && !DATA_POLICY_CONTEXT_PATHS.has(reference.path)) {\n\t\terrors.push(`condition ${conditionId} uses an unsupported context path`);\n\t}\n}\n\nfunction validateComparison(\n\toperator: DataPolicyComparisonOperator,\n\tvalue: DataPolicyLiteral | undefined,\n\tconditionId: string,\n\terrors: string[],\n): void {\n\tif (!DATA_POLICY_COMPARISON_OPERATORS.has(operator)) {\n\t\terrors.push(`condition ${conditionId} has unsupported operator`);\n\t\treturn;\n\t}\n\n\tif (operator === \"exists\") {\n\t\treturn;\n\t}\n\n\tif (!isDataPolicyLiteral(value)) {\n\t\terrors.push(`condition ${conditionId} comparison value must be a bounded literal`);\n\t\treturn;\n\t}\n\n\tif ([\"gt\", \"gte\", \"lt\", \"lte\"].includes(operator) && typeof value !== \"number\") {\n\t\terrors.push(`condition ${conditionId} numeric comparison requires a number value`);\n\t}\n}\n\nfunction validatePath(path: string, fieldName: string, errors: string[]): void {\n\tif (!isNonEmptyBoundedString(path)) {\n\t\terrors.push(`${fieldName} must be a non-empty bounded string`);\n\t\treturn;\n\t}\n\n\tconst segments = path.split(\".\");\n\tif (segments.length > DATA_POLICY_MAX_PATH_SEGMENTS) {\n\t\terrors.push(`${fieldName} must contain at most ${DATA_POLICY_MAX_PATH_SEGMENTS} segments`);\n\t\treturn;\n\t}\n\n\tfor (const segment of segments) {\n\t\tif (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(segment)) {\n\t\t\terrors.push(`${fieldName} contains an invalid path segment`);\n\t\t\treturn;\n\t\t}\n\n\t\tif ([\"__proto__\", \"constructor\", \"prototype\"].includes(segment)) {\n\t\t\terrors.push(`${fieldName} contains a forbidden path segment`);\n\t\t\treturn;\n\t\t}\n\t}\n}\n\nfunction isDataPolicyLiteral(value: unknown): value is DataPolicyLiteral {\n\tif (value === null || typeof value === \"number\" || typeof value === \"boolean\") {\n\t\treturn true;\n\t}\n\n\treturn typeof value === \"string\" && value.length <= DATA_POLICY_MAX_STRING_LENGTH;\n}\n\nfunction isNonEmptyBoundedString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.length > 0 && value.length <= DATA_POLICY_MAX_STRING_LENGTH;\n}\n\nfunction evaluateDataPolicyCondition(\n\tcondition: DataPolicyCondition,\n\tctx: PolicyContext,\n): { result: DataPolicyConditionResult; evidence: DataPolicyConditionResult[] } {\n\tif (condition.type === \"always\") {\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed: condition.result === \"pass\",\n\t\t\tresult: condition.result,\n\t\t\treason: condition.reason,\n\t\t};\n\t\treturn { result, evidence: [result] };\n\t}\n\n\tif (condition.type === \"all\" || condition.type === \"any\") {\n\t\tconst childEvaluations = condition.conditions.map((child) => evaluateDataPolicyCondition(child, ctx));\n\t\tconst passed =\n\t\t\tcondition.type === \"all\"\n\t\t\t\t? childEvaluations.every((evaluation) => evaluation.result.passed)\n\t\t\t\t: childEvaluations.some((evaluation) => evaluation.result.passed);\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed,\n\t\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\t\treason: passed ? undefined : condition.reason,\n\t\t};\n\n\t\treturn {\n\t\t\tresult,\n\t\t\tevidence: [result, ...childEvaluations.flatMap((evaluation) => evaluation.evidence)],\n\t\t};\n\t}\n\n\tif (condition.type === \"not\") {\n\t\tconst childEvaluation = evaluateDataPolicyCondition(condition.condition, ctx);\n\t\tconst passed = !childEvaluation.result.passed;\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed,\n\t\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\t\treason: passed ? undefined : condition.reason,\n\t\t};\n\n\t\treturn { result, evidence: [result, ...childEvaluation.evidence] };\n\t}\n\n\tif (condition.type !== \"parameter\" && condition.type !== \"comparison\") {\n\t\tconst result: DataPolicyConditionResult = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed: false,\n\t\t\tresult: \"block\",\n\t\t\treason: \"Unsupported data policy condition type\",\n\t\t};\n\t\treturn { result, evidence: [result] };\n\t}\n\n\tconst value =\n\t\tcondition.type === \"parameter\"\n\t\t\t? readPath(ctx.parameters, condition.path)\n\t\t\t: readDataPolicySource(ctx, condition.left);\n\tconst operator = condition.operator;\n\tconst expected = condition.value;\n\tconst passed = evaluateOperator(value, operator, expected);\n\tconst result = {\n\t\tconditionId: condition.conditionId,\n\t\tpassed,\n\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\treason: passed ? undefined : condition.reason,\n\t};\n\treturn { result, evidence: [result] };\n}\n\nfunction evaluateOperator(\n\tactual: unknown,\n\toperator: DataPolicyComparisonOperator,\n\texpected: unknown,\n): boolean {\n\tswitch (operator) {\n\t\tcase \"exists\":\n\t\t\treturn actual !== undefined && actual !== null && actual !== \"\";\n\t\tcase \"equals\":\n\t\t\treturn actual === expected;\n\t\tcase \"notEquals\":\n\t\t\treturn actual !== expected;\n\t\tcase \"gt\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual > expected;\n\t\tcase \"gte\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual >= expected;\n\t\tcase \"lt\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual < expected;\n\t\tcase \"lte\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual <= expected;\n\t}\n}\n\nfunction readDataPolicySource(ctx: PolicyContext, reference: DataPolicySourceReference): unknown {\n\tif (reference.source === \"parameters\") {\n\t\treturn readPath(ctx.parameters, reference.path);\n\t}\n\n\treturn readPath(\n\t\t{\n\t\t\ttenantId: ctx.tenantId,\n\t\t\tspaceId: ctx.spaceId,\n\t\t\tactionInvocationId: ctx.actionInvocationId,\n\t\t\tactionId: ctx.actionId,\n\t\t\tmode: ctx.mode,\n\t\t},\n\t\treference.path,\n\t);\n}\n\nfunction readPath(source: unknown, path: string): unknown {\n\tif (!source || typeof source !== \"object\") {\n\t\treturn undefined;\n\t}\n\n\treturn path.split(\".\").reduce<unknown>((current, segment) => {\n\t\tif (!current || typeof current !== \"object\") {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn (current as Record<string, unknown>)[segment];\n\t}, source);\n}\n\nfunction normalizeOutcome(\n\tpolicy: RuntimePolicyDefinition,\n\toutcome: PolicyOutcome,\n\tdispatchEvidence: PolicyDispatchEvidence,\n): PolicyOutcome {\n\t// The platform owns the dispatch envelope (kind, id, version, path,\n\t// data/code/fallback blocks). Engine provenance is evaluator-controlled —\n\t// preserve it so BYO-engine adapters (OPA, Cedar, ...) can attach decision\n\t// path, bundle revision, decision ID, input hash, etc.\n\tconst engine = outcome.dispatchEvidence?.engine;\n\treturn {\n\t\t...outcome,\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tpolicyKind: policy.kind,\n\t\tmetadata: {\n\t\t\t...(outcome.metadata ?? {}),\n\t\t\tcodePolicyId: dispatchEvidence.code?.policyId ?? outcome.policyId,\n\t\t\tcodePolicyVersion: dispatchEvidence.code?.version ?? outcome.policyVersion,\n\t\t},\n\t\tdispatchEvidence: engine ? { ...dispatchEvidence, engine } : dispatchEvidence,\n\t};\n}\n\nfunction parsePolicyVersion(policyId: PolicyId): number {\n\tconst segments = policyId.split(\".v\");\n\treturn Number(segments[segments.length - 1] ?? 1);\n}\n\nexport function aggregatePolicyOutcomes(outcomes: PolicyOutcome[]): PolicyOutcome | undefined {\n\treturn (\n\t\toutcomes.find((outcome) => outcome.result === \"block\") ??\n\t\toutcomes.find((outcome) => outcome.result === \"warn\")\n\t);\n}\n"]}

package/dist/{chunk-KOC4A7A4.js → chunk-I3BMSYDF.js}

@@ -109,6 +109,35 @@ async function evaluateCodePolicy(policy, ctx) {
       }
     };
   }
+  if (ctx.mode === "preview" && evaluator.previewSafe !== true) {
+    const skipReason = `Policy ${evaluator.policyId} skipped in preview mode (evaluator is not declared previewSafe)`;
+    return {
+      policyId: policy.policyId,
+      policyVersion: policy.policyVersion,
+      policyKind: policy.kind,
+      result: "warn",
+      reason: skipReason,
+      metadata: {
+        codePolicyId: evaluator.policyId,
+        codePolicyVersion: evaluator.version,
+        previewSkipped: true
+      },
+      dispatchEvidence: {
+        policyKind: policy.kind,
+        policyId: policy.policyId,
+        policyVersion: policy.policyVersion,
+        dispatchPath: ["code"],
+        code: {
+          requestedPolicyId: codeEvaluatorPolicyId,
+          policyId: evaluator.policyId,
+          version: evaluator.version,
+          registered: true,
+          skipped: true,
+          skipReason
+        }
+      }
+    };
+  }
   const outcome = await evaluator.evaluate(ctx);
   return normalizeOutcome(policy, outcome, {
     policyKind: policy.kind,
@@ -518,6 +547,7 @@ function readPath(source, path) {
   }, source);
 }
 function normalizeOutcome(policy, outcome, dispatchEvidence) {
+  const engine = outcome.dispatchEvidence?.engine;
   return {
     ...outcome,
     policyId: policy.policyId,
@@ -528,7 +558,7 @@ function normalizeOutcome(policy, outcome, dispatchEvidence) {
       codePolicyId: dispatchEvidence.code?.policyId ?? outcome.policyId,
       codePolicyVersion: dispatchEvidence.code?.version ?? outcome.policyVersion
     },
-    dispatchEvidence
+    dispatchEvidence: engine ? { ...dispatchEvidence, engine } : dispatchEvidence
   };
 }
 function parsePolicyVersion(policyId) {
@@ -540,5 +570,5 @@ function aggregatePolicyOutcomes(outcomes) {
 }
 
 export { aggregatePolicyOutcomes, assertPolicyId, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, getRegisteredPolicyIds, registerPolicy, registerPolicyIfMissing, resolvePolicy, validateDataPolicyDefinition };
-//# sourceMappingURL=chunk-KOC4A7A4.js.map
-//# sourceMappingURL=chunk-KOC4A7A4.js.map
+//# sourceMappingURL=chunk-I3BMSYDF.js.map
+//# sourceMappingURL=chunk-I3BMSYDF.js.map

package/dist/chunk-I3BMSYDF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../policies/index.ts"],"names":["result","passed"],"mappings":";AAUO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,kDAAA,CAAmD,IAAA,CAAK,QAAQ,CAAA,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AA0IA,IAAM,qBAAA,GAAwB,CAAA;AAC9B,IAAM,mCAAA,GAAsC,EAAA;AAC5C,IAAM,gCAAA,GAAmC,GAAA;AACzC,IAAM,6BAAA,GAAgC,EAAA;AACtC,IAAM,6BAAA,GAAgC,GAAA;AAEtC,IAAM,yBAAA,uBAAgC,GAAA,CAAI;AAAA,EACzC,UAAA;AAAA,EACA,SAAA;AAAA,EACA,oBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,gCAAA,uBAAuC,GAAA,CAAkC;AAAA,EAC9E,QAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,IAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,iCAAiB,IAAI,GAAA,CAA4B,CAAC,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC,CAAA;AAyEhF,IAAM,QAAA,uBAAe,GAAA,EAA+B;AAE7C,SAAS,eAAe,SAAA,EAAkC;AAChE,EAAA,cAAA,CAAe,UAAU,QAAQ,CAAA;AAEjC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA;AAChD,EAAA,IAAI,QAAA,IAAY,aAAa,SAAA,EAAW;AACvC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,qCAAA,EAAwC,UAAU,QAAQ,CAAA,+CAAA;AAAA,KAE3D;AAAA,EACD;AAEA,EAAA,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAA,EAAU,SAAS,CAAA;AAC3C;AAEO,SAAS,wBAAwB,SAAA,EAAkC;AACzE,EAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA,EAAG;AACtC,IAAA,cAAA,CAAe,SAAS,CAAA;AACxB,IAAA;AAAA,EACD;AAEA,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA;AAChD,EAAA,IAAI,QAAA,IAAY,aAAa,SAAA,EAAW;AACvC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,qCAAA,EAAwC,UAAU,QAAQ,CAAA,+CAAA;AAAA,KAE3D;AAAA,EACD;AACD;AAEO,SAAS,cAAc,QAAA,EAAiD;AAC9E,EAAA,OAAO,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC7B;AAEO,SAAS,sBAAA,GAAqC;AACpD,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,CAAA;AAClC;AAEA,eAAsB,0BAAA,CACrB,WACA,GAAA,EAC2B;AAC3B,EAAA,OAAO,yBAAA;AAAA,IACN,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc;AAAA,MAC5B,QAAA;AAAA,MACA,aAAA,EAAe,mBAAmB,QAAQ,CAAA;AAAA,MAC1C,IAAA,EAAM,MAAA;AAAA,MACN,qBAAA,EAAuB;AAAA,KACxB,CAAE,CAAA;AAAA,IACF;AAAA,GACD;AACD;AAEA,eAAsB,yBAAA,CACrB,UACA,GAAA,EAC2B;AAC3B,EAAA,MAAM,WAA4B,EAAC;AAEnC,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC9B,IAAA,cAAA,CAAe,OAAO,QAAQ,CAAA;AAC9B,IAAA,QAAA,CAAS,IAAA,CAAK,MAAM,wBAAA,CAAyB,MAAA,EAAQ,GAAG,CAAC,CAAA;AAAA,EAC1D;AAEA,EAAA,OAAO,QAAA;AACR;AAEA,eAAsB,wBAAA,CACrB,QACA,GAAA,EACyB;AACzB,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,kBAAA,CAAmB,QAAQ,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,kBAAA,CAAmB,QAAQ,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,oBAAA,CAAqB,QAAQ,GAAG,CAAA;AACxC;AAEA,eAAe,kBAAA,CACd,QACA,GAAA,EACyB;AACzB,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,IAAyB,MAAA,CAAO,QAAA;AACrE,EAAA,MAAM,SAAA,GAAY,QAAA,CAAS,GAAA,CAAI,qBAAqB,CAAA;AAEpD,EAAA,IAAI,CAAC,SAAA,EAAW;AACf,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,sCAAsC,qBAAqB,CAAA,CAAA;AAAA,MACnE,QAAA,EAAU;AAAA,QACT,4BAAA,EAA8B;AAAA,OAC/B;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,iBAAA,EAAmB,qBAAA;AAAA,UACnB,QAAA,EAAU,qBAAA;AAAA,UACV,UAAA,EAAY;AAAA;AACb;AACD,KACD;AAAA,EACD;AAEA,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,SAAA,IAAa,SAAA,CAAU,gBAAgB,IAAA,EAAM;AAC7D,IAAA,MAAM,UAAA,GACL,CAAA,OAAA,EAAU,SAAA,CAAU,QAAQ,CAAA,gEAAA,CAAA;AAE7B,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,MAAA;AAAA,MACR,MAAA,EAAQ,UAAA;AAAA,MACR,QAAA,EAAU;AAAA,QACT,cAAc,SAAA,CAAU,QAAA;AAAA,QACxB,mBAAmB,SAAA,CAAU,OAAA;AAAA,QAC7B,cAAA,EAAgB;AAAA,OACjB;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,iBAAA,EAAmB,qBAAA;AAAA,UACnB,UAAU,SAAA,CAAU,QAAA;AAAA,UACpB,SAAS,SAAA,CAAU,OAAA;AAAA,UACnB,UAAA,EAAY,IAAA;AAAA,UACZ,OAAA,EAAS,IAAA;AAAA,UACT;AAAA;AACD;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AAC5C,EAAA,OAAO,gBAAA,CAAiB,QAAQ,OAAA,EAAS;AAAA,IACxC,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,IACrB,IAAA,EAAM;AAAA,MACL,iBAAA,EAAmB,qBAAA;AAAA,MACnB,UAAU,SAAA,CAAU,QAAA;AAAA,MACpB,SAAS,SAAA,CAAU,OAAA;AAAA,MACnB,UAAA,EAAY;AAAA;AACb,GACA,CAAA;AACF;AAEA,eAAe,oBAAA,CACd,QACA,GAAA,EACyB;AACzB,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,MAAA,EAAQ,GAAG,CAAA;AAClD,EAAA,MAAM,WAAW,MAAA,CAAO,QAAA;AACxB,EAAA,MAAM,gBAAA,GAAmB,QAAA,GACtB,uBAAA,CAAwB,MAAA,EAAQ,WAAA,EAAa,QAAQ,CAAA,GACrD,EAAE,cAAA,EAAgB,KAAA,EAAO,OAAA,EAAS,eAAA,EAAyB;AAE9D,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,gBAAA,CAAiB,cAAA,EAAgB;AAClD,IAAA,IAAI,QAAA,IAAY,YAAY,gBAAA,EAAkB;AAC7C,MAAA,OAAO;AAAA,QACN,GAAG,WAAA;AAAA,QACH,gBAAA,EAAkB;AAAA,UACjB,GAAG,WAAA,CAAY,gBAAA;AAAA,UACf,QAAA,EAAU;AAAA,YACT,IAAA,EAAM,KAAA;AAAA,YACN,OAAA,EAAS,eAAA;AAAA,YACT,MAAA,EAAQ,6CAAA;AAAA,YACR,YAAY,WAAA,CAAY,MAAA;AAAA,YACxB,mBAAmB,MAAA,CAAO,aAAA;AAAA,YAC1B,uBAAuB,QAAA,CAAS;AAAA;AACjC;AACD,OACD;AAAA,IACD;AAEA,IAAA,OAAO,WAAA;AAAA,EACR;AAEA,EAAA,MAAM,UAAA,GAAsC;AAAA,IAC3C,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,IAAA,EAAM,QAAA;AAAA,IACN,uBAAuB,QAAA,CAAS;AAAA,GACjC;AACA,EAAA,MAAM,WAAA,GAAc,MAAM,kBAAA,CAAmB,UAAA,EAAY,GAAG,CAAA;AAE5D,EAAA,OAAO,gBAAA,CAAiB,QAAQ,WAAA,EAAa;AAAA,IAC5C,GAAI,YAAY,gBAAA,IAAoB;AAAA,MACnC,UAAA,EAAY,QAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAA,EAAc,CAAC,MAAM;AAAA,KACtB;AAAA,IACA,UAAA,EAAY,QAAA;AAAA,IACZ,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAA,EAAc,CAAC,MAAA,EAAQ,UAAA,EAAY,MAAM,CAAA;AAAA,IACzC,IAAA,EAAM,YAAY,gBAAA,EAAkB,IAAA;AAAA,IACpC,QAAA,EAAU;AAAA,MACT,IAAA,EAAM,IAAA;AAAA,MACN,SAAS,gBAAA,CAAiB,OAAA;AAAA,MAC1B,MAAA,EAAQ,SAAS,MAAA,IAAU,4CAAA;AAAA,MAC3B,YAAY,WAAA,CAAY,MAAA;AAAA,MACxB,mBAAmB,MAAA,CAAO,aAAA;AAAA,MAC1B,uBAAuB,QAAA,CAAS;AAAA;AACjC,GACA,CAAA;AACF;AAEA,SAAS,uBAAA,CACR,MAAA,EACA,WAAA,EACA,QAAA,EACgF;AAChF,EAAA,MAAM,eAAA,GAAkB,SAAS,QAAA,IAAY;AAAA,IAC5C,aAAA;AAAA,IACA,yBAAA;AAAA,IACA;AAAA,GACD;AACA,EAAA,MAAM,gBAAA,GAAmB,WAAA,CAAY,gBAAA,EAAkB,IAAA,EAAM,gBAAA;AAE7D,EAAA,IAAI,qBAAqB,SAAA,EAAW;AACnC,IAAA,OAAO;AAAA,MACN,cAAA,EAAgB,eAAA,CAAgB,QAAA,CAAS,yBAAyB,CAAA;AAAA,MAClE,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,IAAI,qBAAqB,SAAA,EAAW;AACnC,IAAA,OAAO;AAAA,MACN,cAAA,EAAgB,eAAA,CAAgB,QAAA,CAAS,yBAAyB,CAAA;AAAA,MAClE,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,SAAA,IAAa,CAAC,QAAQ,OAAO,CAAA;AAC9D,EAAA,OAAO;AAAA,IACN,cAAA,EACC,MAAA,CAAO,IAAA,KAAS,QAAA,IAChB,eAAA,CAAgB,QAAA,CAAS,aAAa,CAAA,IACtC,eAAA,CAAgB,QAAA,CAAS,WAAA,CAAY,MAAM,CAAA;AAAA,IAC5C,OAAA,EAAS;AAAA,GACV;AACD;AAEA,SAAS,kBAAA,CAAmB,QAAiC,GAAA,EAAmC;AAC/F,EAAA,MAAM,aAAa,MAAA,CAAO,cAAA;AAE1B,EAAA,IAAI,CAAC,UAAA,EAAY;AAChB,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,mCAAA;AAAA,MACR,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,UAC1B,gBAAA,EAAkB,SAAA;AAAA,UAClB,kBAAkB;AAAC;AACpB;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,6BAA6B,UAAU,CAAA;AAC1D,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACtB,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,QAAQ,CAAA,gCAAA,EAAmC,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,MACvE,QAAA,EAAU;AAAA,QACT,kBAAkB,UAAA,CAAW;AAAA,OAC9B;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,UAC1B,gBAAA,EAAkB,SAAA;AAAA,UAClB,kBAAkB,EAAC;AAAA,UACnB,kBAAkB,UAAA,CAAW;AAAA;AAC9B;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,WAAA,GAAc,WAAW,UAAA,CAAW,GAAA,CAAI,CAAC,SAAA,KAAc,2BAAA,CAA4B,SAAA,EAAW,GAAG,CAAC,CAAA;AACxG,EAAA,MAAM,mBAAmB,WAAA,CAAY,OAAA,CAAQ,CAAC,UAAA,KAAe,WAAW,QAAQ,CAAA;AAChF,EAAA,MAAM,kBAAkB,WAAA,CAAY,GAAA,CAAI,CAAC,UAAA,KAAe,WAAW,MAAM,CAAA;AACzE,EAAA,MAAM,SAAA,GACL,eAAA,CAAgB,IAAA,CAAK,CAACA,YAAWA,OAAAA,CAAO,MAAA,KAAW,OAAO,CAAA,IAC1D,gBAAgB,IAAA,CAAK,CAACA,OAAAA,KAAWA,OAAAA,CAAO,WAAW,MAAM,CAAA;AAC1D,EAAA,MAAM,MAAA,GAAS,SAAA,EAAW,MAAA,IAAU,UAAA,CAAW,aAAA,IAAiB,MAAA;AAEhE,EAAA,OAAO;AAAA,IACN,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,MAAA;AAAA,IACA,MAAA,EAAQ,SAAA,EAAW,MAAA,IAAU,UAAA,CAAW,MAAA;AAAA,IACxC,QAAA,EAAU;AAAA,MACT,cAAA,EAAgB,WAAW,UAAA,CAAW,MAAA;AAAA,MACtC,mBAAmB,SAAA,EAAW;AAAA,KAC/B;AAAA,IACA,gBAAA,EAAkB;AAAA,MACjB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,MACrB,IAAA,EAAM;AAAA,QACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,QAC1B,gBAAA,EAAkB,WAAA;AAAA,QAClB;AAAA;AACD;AACD,GACD;AACD;AAEO,SAAS,6BACf,UAAA,EAC6B;AAC7B,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,IAAK,UAAA,CAAW,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAChF,IAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAAA,EAC7D,CAAA,MAAA,IAAW,UAAA,CAAW,UAAA,CAAW,MAAA,GAAS,mCAAA,EAAqC;AAC9E,IAAA,MAAA,CAAO,IAAA;AAAA,MACN,mCAAmC,mCAAmC,CAAA,qBAAA;AAAA,KACvE;AAAA,EACD;AAEA,EAAA,IAAI,WAAW,aAAA,IAAiB,CAAC,eAAe,GAAA,CAAI,UAAA,CAAW,aAAa,CAAA,EAAG;AAC9E,IAAA,MAAA,CAAO,KAAK,4CAA4C,CAAA;AAAA,EACzD;AAEA,EAAA,IAAI,eAAA,GAAkB,CAAA;AACtB,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA,CAAW,UAAA,IAAc,EAAC,EAAG;AACpD,IAAA,2BAAA,CAA4B,SAAA,EAAW,MAAA,EAAQ,CAAA,EAAG,MAAM;AACvD,MAAA,eAAA,IAAmB,CAAA;AAAA,IACpB,CAAC,CAAA;AAAA,EACF;AAEA,EAAA,IAAI,kBAAkB,gCAAA,EAAkC;AACvD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,4BAAA,EAA+B,gCAAgC,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC/F;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,MAAA,KAAW,GAAG,MAAA,EAAO;AAC7C;AAEA,SAAS,2BAAA,CACR,SAAA,EACA,MAAA,EACA,KAAA,EACA,KAAA,EACO;AACP,EAAA,KAAA,EAAM;AAEN,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAChD,IAAA,MAAA,CAAO,KAAK,6BAA6B,CAAA;AACzC,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,QAAQ,qBAAA,EAAuB;AAClC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,gCAAA,EAAmC,qBAAqB,CAAA,CAAE,CAAA;AACtE,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,uBAAA,CAAwB,SAAA,CAAU,WAAW,CAAA,EAAG;AACpD,IAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAAA,EAC7D;AAEA,EAAA,4BAAA,CAA6B,YAAY,SAAA,GAAY,SAAA,CAAU,MAAA,GAAS,MAAA,EAAW,UAAU,MAAM,CAAA;AACnG,EAAA,4BAAA,CAA6B,YAAY,SAAA,GAAY,SAAA,CAAU,MAAA,GAAS,MAAA,EAAW,UAAU,MAAM,CAAA;AAEnG,EAAA,IAAI,UAAU,MAAA,KAAW,MAAA,IAAa,CAAC,uBAAA,CAAwB,SAAA,CAAU,MAAM,CAAA,EAAG;AACjF,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACjF;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,QAAA,EAAU;AAChC,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,SAAA,CAAU,MAAM,CAAA,EAAG;AAC1C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,oCAAA,CAAsC,CAAA;AAAA,IACrF;AACA,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,WAAA,EAAa;AACnC,IAAA,YAAA,CAAa,UAAU,IAAA,EAAM,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,SAAS,MAAM,CAAA;AAC9E,IAAA,kBAAA,CAAmB,UAAU,QAAA,EAAU,SAAA,CAAU,KAAA,EAAO,SAAA,CAAU,aAAa,MAAM,CAAA;AACrF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,YAAA,EAAc;AACpC,IAAA,uBAAA,CAAwB,SAAA,CAAU,IAAA,EAAM,SAAA,CAAU,WAAA,EAAa,MAAM,CAAA;AACrE,IAAA,kBAAA,CAAmB,UAAU,QAAA,EAAU,SAAA,CAAU,KAAA,EAAO,SAAA,CAAU,aAAa,MAAM,CAAA;AACrF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,KAAA,IAAS,SAAA,CAAU,SAAS,KAAA,EAAO;AACzD,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,SAAA,CAAU,UAAU,CAAA,IAAK,SAAA,CAAU,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAC9E,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,8BAAA,CAAgC,CAAA;AAC9E,MAAA;AAAA,IACD;AAEA,IAAA,IAAI,SAAA,CAAU,UAAA,CAAW,MAAA,GAAS,mCAAA,EAAqC;AACtE,MAAA,MAAA,CAAO,IAAA;AAAA,QACN,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,sBAAA,EAAyB,mCAAmC,CAAA,iBAAA;AAAA,OAC/F;AAAA,IACD;AAEA,IAAA,KAAA,MAAW,KAAA,IAAS,UAAU,UAAA,EAAY;AACzC,MAAA,2BAAA,CAA4B,KAAA,EAAO,MAAA,EAAQ,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,IAC5D;AACA,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC7B,IAAA,2BAAA,CAA4B,SAAA,CAAU,SAAA,EAAW,MAAA,EAAQ,KAAA,GAAQ,GAAG,KAAK,CAAA;AACzE,IAAA;AAAA,EACD;AAEA,EAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,qBAAA,CAAuB,CAAA;AACtE;AAEA,SAAS,4BAAA,CACR,MAAA,EACA,SAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,WAAW,MAAA,IAAa,CAAC,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AACxD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,6BAAA,CAA+B,CAAA;AAAA,EACxD;AACD;AAEA,SAAS,uBAAA,CACR,SAAA,EACA,WAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAChD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,gCAAA,CAAkC,CAAA;AACtE,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,MAAA,KAAW,YAAA,IAAgB,SAAA,CAAU,WAAW,SAAA,EAAW;AACxE,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,qCAAA,CAAuC,CAAA;AAAA,EAC5E;AAEA,EAAA,YAAA,CAAa,SAAA,CAAU,IAAA,EAAM,CAAA,UAAA,EAAa,WAAW,cAAc,MAAM,CAAA;AAEzE,EAAA,IAAI,SAAA,CAAU,WAAW,SAAA,IAAa,CAAC,0BAA0B,GAAA,CAAI,SAAA,CAAU,IAAI,CAAA,EAAG;AACrF,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,iCAAA,CAAmC,CAAA;AAAA,EACxE;AACD;AAEA,SAAS,kBAAA,CACR,QAAA,EACA,KAAA,EACA,WAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,CAAC,gCAAA,CAAiC,GAAA,CAAI,QAAQ,CAAA,EAAG;AACpD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,yBAAA,CAA2B,CAAA;AAC/D,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,aAAa,QAAA,EAAU;AAC1B,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAChC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,2CAAA,CAA6C,CAAA;AACjF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,IAAK,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/E,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,2CAAA,CAA6C,CAAA;AAAA,EAClF;AACD;AAEA,SAAS,YAAA,CAAa,IAAA,EAAc,SAAA,EAAmB,MAAA,EAAwB;AAC9E,EAAA,IAAI,CAAC,uBAAA,CAAwB,IAAI,CAAA,EAAG;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,mCAAA,CAAqC,CAAA;AAC7D,IAAA;AAAA,EACD;AAEA,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,IAAI,QAAA,CAAS,SAAS,6BAAA,EAA+B;AACpD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,sBAAA,EAAyB,6BAA6B,CAAA,SAAA,CAAW,CAAA;AACzF,IAAA;AAAA,EACD;AAEA,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC/B,IAAA,IAAI,CAAC,0BAAA,CAA2B,IAAA,CAAK,OAAO,CAAA,EAAG;AAC9C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,iCAAA,CAAmC,CAAA;AAC3D,MAAA;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,WAAA,EAAa,aAAA,EAAe,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG;AAChE,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,kCAAA,CAAoC,CAAA;AAC5D,MAAA;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,oBAAoB,KAAA,EAA4C;AACxE,EAAA,IAAI,UAAU,IAAA,IAAQ,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,EAAW;AAC9E,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,IAAU,6BAAA;AACrD;AAEA,SAAS,wBAAwB,KAAA,EAAiC;AACjE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,MAAM,MAAA,GAAS,CAAA,IAAK,MAAM,MAAA,IAAU,6BAAA;AACzE;AAEA,SAAS,2BAAA,CACR,WACA,GAAA,EAC+E;AAC/E,EAAA,IAAI,SAAA,CAAU,SAAS,QAAA,EAAU;AAChC,IAAA,MAAMA,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAQ,UAAU,MAAA,KAAW,MAAA;AAAA,MAC7B,QAAQ,SAAA,CAAU,MAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACnB;AACA,IAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAM,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,KAAA,IAAS,SAAA,CAAU,SAAS,KAAA,EAAO;AACzD,IAAA,MAAM,gBAAA,GAAmB,UAAU,UAAA,CAAW,GAAA,CAAI,CAAC,KAAA,KAAU,2BAAA,CAA4B,KAAA,EAAO,GAAG,CAAC,CAAA;AACpG,IAAA,MAAMC,UACL,SAAA,CAAU,IAAA,KAAS,QAChB,gBAAA,CAAiB,KAAA,CAAM,CAAC,UAAA,KAAe,UAAA,CAAW,MAAA,CAAO,MAAM,IAC/D,gBAAA,CAAiB,IAAA,CAAK,CAAC,UAAA,KAAe,UAAA,CAAW,OAAO,MAAM,CAAA;AAClE,IAAA,MAAMD,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAAC,OAAAA;AAAA,MACA,QAAQA,OAAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,MACrE,MAAA,EAAQA,OAAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,KACxC;AAEA,IAAA,OAAO;AAAA,MACN,MAAA,EAAAD,OAAAA;AAAA,MACA,QAAA,EAAU,CAACA,OAAAA,EAAQ,GAAG,gBAAA,CAAiB,QAAQ,CAAC,UAAA,KAAe,UAAA,CAAW,QAAQ,CAAC;AAAA,KACpF;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC7B,IAAA,MAAM,eAAA,GAAkB,2BAAA,CAA4B,SAAA,CAAU,SAAA,EAAW,GAAG,CAAA;AAC5E,IAAA,MAAMC,OAAAA,GAAS,CAAC,eAAA,CAAgB,MAAA,CAAO,MAAA;AACvC,IAAA,MAAMD,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAAC,OAAAA;AAAA,MACA,QAAQA,OAAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,MACrE,MAAA,EAAQA,OAAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,KACxC;AAEA,IAAA,OAAO,EAAE,QAAAD,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAAA,EAAQ,GAAG,eAAA,CAAgB,QAAQ,CAAA,EAAE;AAAA,EAClE;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,WAAA,IAAe,SAAA,CAAU,SAAS,YAAA,EAAc;AACtE,IAAA,MAAMA,OAAAA,GAAoC;AAAA,MACzC,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT;AACA,IAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAM,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,MAAM,KAAA,GACL,SAAA,CAAU,IAAA,KAAS,WAAA,GAChB,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,SAAA,CAAU,IAAI,CAAA,GACvC,oBAAA,CAAqB,GAAA,EAAK,UAAU,IAAI,CAAA;AAC5C,EAAA,MAAM,WAAW,SAAA,CAAU,QAAA;AAC3B,EAAA,MAAM,WAAW,SAAA,CAAU,KAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAU,QAAQ,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS;AAAA,IACd,aAAa,SAAA,CAAU,WAAA;AAAA,IACvB,MAAA;AAAA,IACA,QAAQ,MAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,IACrE,MAAA,EAAQ,MAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,GACxC;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAC,MAAM,CAAA,EAAE;AACrC;AAEA,SAAS,gBAAA,CACR,MAAA,EACA,QAAA,EACA,QAAA,EACU;AACV,EAAA,QAAQ,QAAA;AAAU,IACjB,KAAK,QAAA;AACJ,MAAA,OAAO,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,MAAA,KAAW,EAAA;AAAA,IAC9D,KAAK,QAAA;AACJ,MAAA,OAAO,MAAA,KAAW,QAAA;AAAA,IACnB,KAAK,WAAA;AACJ,MAAA,OAAO,MAAA,KAAW,QAAA;AAAA,IACnB,KAAK,IAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,GAAS,QAAA;AAAA,IAC/E,KAAK,KAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,IAAU,QAAA;AAAA,IAChF,KAAK,IAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,GAAS,QAAA;AAAA,IAC/E,KAAK,KAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,IAAU,QAAA;AAAA;AAElF;AAEA,SAAS,oBAAA,CAAqB,KAAoB,SAAA,EAA+C;AAChG,EAAA,IAAI,SAAA,CAAU,WAAW,YAAA,EAAc;AACtC,IAAA,OAAO,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,SAAA,CAAU,IAAI,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAO,QAAA;AAAA,IACN;AAAA,MACC,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,oBAAoB,GAAA,CAAI,kBAAA;AAAA,MACxB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,MAAM,GAAA,CAAI;AAAA,KACX;AAAA,IACA,SAAA,CAAU;AAAA,GACX;AACD;AAEA,SAAS,QAAA,CAAS,QAAiB,IAAA,EAAuB;AACzD,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,IAAA,OAAO,MAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,KAAA,CAAM,GAAG,EAAE,MAAA,CAAgB,CAAC,SAAS,OAAA,KAAY;AAC5D,IAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC5C,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAQ,QAAoC,OAAO,CAAA;AAAA,EACpD,GAAG,MAAM,CAAA;AACV;AAEA,SAAS,gBAAA,CACR,MAAA,EACA,OAAA,EACA,gBAAA,EACgB;AAKhB,EAAA,MAAM,MAAA,GAAS,QAAQ,gBAAA,EAAkB,MAAA;AACzC,EAAA,OAAO;AAAA,IACN,GAAG,OAAA;AAAA,IACH,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,QAAA,EAAU;AAAA,MACT,GAAI,OAAA,CAAQ,QAAA,IAAY,EAAC;AAAA,MACzB,YAAA,EAAc,gBAAA,CAAiB,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,QAAA;AAAA,MACzD,iBAAA,EAAmB,gBAAA,CAAiB,IAAA,EAAM,OAAA,IAAW,OAAA,CAAQ;AAAA,KAC9D;AAAA,IACA,kBAAkB,MAAA,GAAS,EAAE,GAAG,gBAAA,EAAkB,QAAO,GAAI;AAAA,GAC9D;AACD;AAEA,SAAS,mBAAmB,QAAA,EAA4B;AACvD,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA;AACpC,EAAA,OAAO,OAAO,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,KAAK,CAAC,CAAA;AACjD;AAEO,SAAS,wBAAwB,QAAA,EAAsD;AAC7F,EAAA,OACC,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,QAAQ,MAAA,KAAW,OAAO,CAAA,IACrD,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAEtD","file":"chunk-I3BMSYDF.js","sourcesContent":["import type { FabricRuntimeServices } from \"../actions\";\n\nexport type PolicyEvaluationResult = \"pass\" | \"warn\" | \"block\";\n\nexport type PolicyKind = \"code\" | \"data\" | \"hybrid\";\n\nexport type PolicyId = `${string}.v${number}`;\n\nexport type PolicyEvaluationMode = \"preview\" | \"execute\";\n\nexport function assertPolicyId(policyId: string): asserts policyId is PolicyId {\n\tif (!/^[a-z][a-z0-9_-]*(\\.[a-z][a-z0-9_-]*)*\\.v[0-9]+$/.test(policyId)) {\n\t\tthrow new Error(`Invalid policy ID: ${policyId}`);\n\t}\n}\n\nexport interface PolicyContext<TDb = unknown> {\n\ttenantId: string;\n\tspaceId: string;\n\tactionInvocationId: string;\n\tactionId: string;\n\tparameters: unknown;\n\tdb: TDb;\n\tnow?: Date;\n\tmode?: PolicyEvaluationMode;\n\t/**\n\t * Optional runtime services bag, mirroring {@link FabricRuntimeServices} on\n\t * `ActionContext`. Lets the host inject dependencies (HTTP clients, secret\n\t * managers, external policy engines such as OPA, feature flags, etc.) that\n\t * a code policy evaluator may need without resorting to module-level\n\t * globals. The shape is opaque to the platform — adapters narrow it.\n\t */\n\tservices?: FabricRuntimeServices;\n}\n\nexport interface PolicyFact {\n\tname: string;\n\tvalue: unknown;\n\tlabel?: string;\n}\n\nexport interface PolicyCorrectiveAction {\n\tlabel: string;\n\tdescription?: string;\n\tactionId?: string;\n\tparameters?: Record<string, unknown>;\n\ttarget?: {\n\t\tsurface?: string;\n\t\ttab?: string;\n\t\tfield?: string;\n\t};\n\trequiresConfirmation?: boolean;\n}\n\nexport interface PolicyGuidance {\n\tsummary?: string;\n\tfactsUsed: PolicyFact[];\n\tcorrectiveActions: PolicyCorrectiveAction[];\n}\n\nexport interface PolicyOutcome {\n\tpolicyId: PolicyId;\n\tpolicyVersion: number;\n\tpolicyKind?: PolicyKind;\n\tresult: PolicyEvaluationResult;\n\treason?: string;\n\tguidance?: PolicyGuidance;\n\tmetadata?: Record<string, unknown>;\n\tdispatchEvidence?: PolicyDispatchEvidence;\n}\n\nexport interface PolicyEvaluator<TDb = unknown> {\n\tpolicyId: PolicyId;\n\tversion: number;\n\tkind?: Extract<PolicyKind, \"code\">;\n\tpreviewSafe?: boolean;\n\tevaluate: (ctx: PolicyContext<TDb>) => Promise<PolicyOutcome>;\n}\n\nexport type DataPolicySource = \"parameters\" | \"context\";\n\nexport type DataPolicyLiteral = string | number | boolean | null;\n\nexport type DataPolicyComparisonOperator =\n\t| \"exists\"\n\t| \"equals\"\n\t| \"notEquals\"\n\t| \"gt\"\n\t| \"gte\"\n\t| \"lt\"\n\t| \"lte\";\n\nexport interface DataPolicySourceReference {\n\tsource: DataPolicySource;\n\tpath: string;\n}\n\nexport type DataPolicyCondition =\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"always\";\n\t\t\tresult: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"parameter\";\n\t\t\tpath: string;\n\t\t\toperator: DataPolicyComparisonOperator;\n\t\t\tvalue?: DataPolicyLiteral;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"comparison\";\n\t\t\tleft: DataPolicySourceReference;\n\t\t\toperator: DataPolicyComparisonOperator;\n\t\t\tvalue?: DataPolicyLiteral;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"all\" | \"any\";\n\t\t\tconditions: DataPolicyCondition[];\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"not\";\n\t\t\tcondition: DataPolicyCondition;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t};\n\nexport interface DataPolicyDefinition {\n\tconditions: DataPolicyCondition[];\n\tdefaultResult?: PolicyEvaluationResult;\n\treason?: string;\n}\n\nexport interface DataPolicyValidationResult {\n\tvalid: boolean;\n\terrors: string[];\n}\n\nconst DATA_POLICY_MAX_DEPTH = 5;\nconst DATA_POLICY_MAX_CONDITIONS_PER_NODE = 20;\nconst DATA_POLICY_MAX_TOTAL_CONDITIONS = 100;\nconst DATA_POLICY_MAX_PATH_SEGMENTS = 12;\nconst DATA_POLICY_MAX_STRING_LENGTH = 500;\n\nconst DATA_POLICY_CONTEXT_PATHS = new Set([\n\t\"tenantId\",\n\t\"spaceId\",\n\t\"actionInvocationId\",\n\t\"actionId\",\n\t\"mode\",\n]);\n\nconst DATA_POLICY_COMPARISON_OPERATORS = new Set<DataPolicyComparisonOperator>([\n\t\"exists\",\n\t\"equals\",\n\t\"notEquals\",\n\t\"gt\",\n\t\"gte\",\n\t\"lt\",\n\t\"lte\",\n]);\n\nconst POLICY_RESULTS = new Set<PolicyEvaluationResult>([\"pass\", \"warn\", \"block\"]);\n\nexport interface PolicyFallbackDefinition {\n\tcodeEvaluatorPolicyId: PolicyId;\n\tonResults?: PolicyEvaluationResult[];\n\ttriggers?: PolicyFallbackTrigger[];\n\treason?: string;\n}\n\nexport type PolicyFallbackTrigger =\n\t| \"data_result\"\n\t| \"missing_data_definition\"\n\t| \"invalid_data_definition\";\n\nexport interface DataPolicyConditionResult {\n\tconditionId: string;\n\tpassed: boolean;\n\tresult: PolicyEvaluationResult;\n\treason?: string;\n}\n\nexport interface RuntimePolicyDefinition {\n\tpolicyId: PolicyId;\n\tpolicyVersion: number;\n\tkind: PolicyKind;\n\tdataDefinition?: DataPolicyDefinition;\n\tcodeEvaluatorPolicyId?: PolicyId;\n\tfallback?: PolicyFallbackDefinition;\n}\n\nexport interface PolicyDispatchEvidence {\n\tpolicyKind: PolicyKind;\n\tpolicyId?: PolicyId;\n\tpolicyVersion?: number;\n\tdispatchPath: Array<\"data\" | \"code\" | \"fallback\">;\n\tdata?: {\n\t\tdefinitionVersion: number;\n\t\tdefinitionStatus: \"evaluated\" | \"missing\" | \"invalid\";\n\t\tconditionResults: DataPolicyConditionResult[];\n\t\tvalidationErrors?: string[];\n\t};\n\tcode?: {\n\t\trequestedPolicyId?: PolicyId;\n\t\tpolicyId: PolicyId;\n\t\tversion?: number;\n\t\tregistered: boolean;\n\t\tskipped?: boolean;\n\t\tskipReason?: string;\n\t};\n\tfallback?: {\n\t\tused: boolean;\n\t\ttrigger: PolicyFallbackTrigger | \"not_triggered\";\n\t\treason: string;\n\t\tfromResult?: PolicyEvaluationResult;\n\t\tdefinitionVersion: number;\n\t\tcodeEvaluatorPolicyId: PolicyId;\n\t};\n\t/**\n\t * Provenance for the engine that produced this decision when a code\n\t * evaluator delegates to an external policy engine (OPA, Cedar, Cerbos,\n\t * Topaz, etc.). Fabric's `policyId` / `policyVersion` remain canonical for\n\t * audit; this block carries deployment provenance (decision path, bundle\n\t * revision, decision ID, input hash). Adapters populate it; the platform\n\t * keeps `metadata` open-ended so engine-specific typing can live in the\n\t * adapter package.\n\t */\n\tengine?: {\n\t\tname: string;\n\t\tversion?: string;\n\t\tmetadata?: Record<string, unknown>;\n\t};\n}\n\nconst registry = new Map<PolicyId, PolicyEvaluator>();\n\nexport function registerPolicy(evaluator: PolicyEvaluator): void {\n\tassertPolicyId(evaluator.policyId);\n\n\tconst existing = registry.get(evaluator.policyId);\n\tif (existing && existing !== evaluator) {\n\t\tthrow new Error(\n\t\t\t`Conflicting policy registration for \"${evaluator.policyId}\". ` +\n\t\t\t\t`A different evaluator is already registered.`,\n\t\t);\n\t}\n\n\tregistry.set(evaluator.policyId, evaluator);\n}\n\nexport function registerPolicyIfMissing(evaluator: PolicyEvaluator): void {\n\tif (!registry.has(evaluator.policyId)) {\n\t\tregisterPolicy(evaluator);\n\t\treturn;\n\t}\n\n\tconst existing = registry.get(evaluator.policyId);\n\tif (existing && existing !== evaluator) {\n\t\tthrow new Error(\n\t\t\t`Conflicting policy registration for \"${evaluator.policyId}\". ` +\n\t\t\t\t`A different evaluator is already registered.`,\n\t\t);\n\t}\n}\n\nexport function resolvePolicy(policyId: PolicyId): PolicyEvaluator | undefined {\n\treturn registry.get(policyId);\n}\n\nexport function getRegisteredPolicyIds(): PolicyId[] {\n\treturn Array.from(registry.keys());\n}\n\nexport async function evaluateRegisteredPolicies(\n\tpolicyIds: PolicyId[],\n\tctx: PolicyContext,\n): Promise<PolicyOutcome[]> {\n\treturn evaluatePolicyDefinitions(\n\t\tpolicyIds.map((policyId) => ({\n\t\t\tpolicyId,\n\t\t\tpolicyVersion: parsePolicyVersion(policyId),\n\t\t\tkind: \"code\",\n\t\t\tcodeEvaluatorPolicyId: policyId,\n\t\t})),\n\t\tctx,\n\t);\n}\n\nexport async function evaluatePolicyDefinitions(\n\tpolicies: RuntimePolicyDefinition[],\n\tctx: PolicyContext,\n): Promise<PolicyOutcome[]> {\n\tconst outcomes: PolicyOutcome[] = [];\n\n\tfor (const policy of policies) {\n\t\tassertPolicyId(policy.policyId);\n\t\toutcomes.push(await evaluatePolicyDefinition(policy, ctx));\n\t}\n\n\treturn outcomes;\n}\n\nexport async function evaluatePolicyDefinition(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tif (policy.kind === \"data\") {\n\t\treturn evaluateDataPolicy(policy, ctx);\n\t}\n\n\tif (policy.kind === \"code\") {\n\t\treturn evaluateCodePolicy(policy, ctx);\n\t}\n\n\treturn evaluateHybridPolicy(policy, ctx);\n}\n\nasync function evaluateCodePolicy(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tconst codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId ?? policy.policyId;\n\tconst evaluator = registry.get(codeEvaluatorPolicyId);\n\n\tif (!evaluator) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: `No evaluator registered for policy ${codeEvaluatorPolicyId}`,\n\t\t\tmetadata: {\n\t\t\t\tmissingCodeEvaluatorPolicyId: codeEvaluatorPolicyId,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"code\"],\n\t\t\t\tcode: {\n\t\t\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tpolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tregistered: false,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tif (ctx.mode === \"preview\" && evaluator.previewSafe !== true) {\n\t\tconst skipReason =\n\t\t\t`Policy ${evaluator.policyId} skipped in preview mode ` +\n\t\t\t`(evaluator is not declared previewSafe)`;\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"warn\",\n\t\t\treason: skipReason,\n\t\t\tmetadata: {\n\t\t\t\tcodePolicyId: evaluator.policyId,\n\t\t\t\tcodePolicyVersion: evaluator.version,\n\t\t\t\tpreviewSkipped: true,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"code\"],\n\t\t\t\tcode: {\n\t\t\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tpolicyId: evaluator.policyId,\n\t\t\t\t\tversion: evaluator.version,\n\t\t\t\t\tregistered: true,\n\t\t\t\t\tskipped: true,\n\t\t\t\t\tskipReason,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst outcome = await evaluator.evaluate(ctx);\n\treturn normalizeOutcome(policy, outcome, {\n\t\tpolicyKind: policy.kind,\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tdispatchPath: [\"code\"],\n\t\tcode: {\n\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\tpolicyId: evaluator.policyId,\n\t\t\tversion: evaluator.version,\n\t\t\tregistered: true,\n\t\t},\n\t});\n}\n\nasync function evaluateHybridPolicy(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tconst dataOutcome = evaluateDataPolicy(policy, ctx);\n\tconst fallback = policy.fallback;\n\tconst fallbackDecision = fallback\n\t\t? resolveFallbackDecision(policy, dataOutcome, fallback)\n\t\t: { shouldFallback: false, trigger: \"not_triggered\" as const };\n\n\tif (!fallback || !fallbackDecision.shouldFallback) {\n\t\tif (fallback && dataOutcome.dispatchEvidence) {\n\t\t\treturn {\n\t\t\t\t...dataOutcome,\n\t\t\t\tdispatchEvidence: {\n\t\t\t\t\t...dataOutcome.dispatchEvidence,\n\t\t\t\t\tfallback: {\n\t\t\t\t\t\tused: false,\n\t\t\t\t\t\ttrigger: \"not_triggered\",\n\t\t\t\t\t\treason: \"Data policy result did not trigger fallback\",\n\t\t\t\t\t\tfromResult: dataOutcome.result,\n\t\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn dataOutcome;\n\t}\n\n\tconst codePolicy: RuntimePolicyDefinition = {\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tkind: \"hybrid\",\n\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t};\n\tconst codeOutcome = await evaluateCodePolicy(codePolicy, ctx);\n\n\treturn normalizeOutcome(policy, codeOutcome, {\n\t\t...(codeOutcome.dispatchEvidence ?? {\n\t\t\tpolicyKind: \"hybrid\",\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tdispatchPath: [\"code\"],\n\t\t}),\n\t\tpolicyKind: \"hybrid\",\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tdispatchPath: [\"data\", \"fallback\", \"code\"],\n\t\tdata: dataOutcome.dispatchEvidence?.data,\n\t\tfallback: {\n\t\t\tused: true,\n\t\t\ttrigger: fallbackDecision.trigger,\n\t\t\treason: fallback.reason ?? \"Data policy result triggered code fallback\",\n\t\t\tfromResult: dataOutcome.result,\n\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t\t},\n\t});\n}\n\nfunction resolveFallbackDecision(\n\tpolicy: RuntimePolicyDefinition,\n\tdataOutcome: PolicyOutcome,\n\tfallback: PolicyFallbackDefinition,\n): { shouldFallback: boolean; trigger: PolicyFallbackTrigger | \"not_triggered\" } {\n\tconst allowedTriggers = fallback.triggers ?? [\n\t\t\"data_result\",\n\t\t\"missing_data_definition\",\n\t\t\"invalid_data_definition\",\n\t];\n\tconst definitionStatus = dataOutcome.dispatchEvidence?.data?.definitionStatus;\n\n\tif (definitionStatus === \"missing\") {\n\t\treturn {\n\t\t\tshouldFallback: allowedTriggers.includes(\"missing_data_definition\"),\n\t\t\ttrigger: \"missing_data_definition\",\n\t\t};\n\t}\n\n\tif (definitionStatus === \"invalid\") {\n\t\treturn {\n\t\t\tshouldFallback: allowedTriggers.includes(\"invalid_data_definition\"),\n\t\t\ttrigger: \"invalid_data_definition\",\n\t\t};\n\t}\n\n\tconst fallbackResults = fallback.onResults ?? [\"warn\", \"block\"];\n\treturn {\n\t\tshouldFallback:\n\t\t\tpolicy.kind === \"hybrid\" &&\n\t\t\tallowedTriggers.includes(\"data_result\") &&\n\t\t\tfallbackResults.includes(dataOutcome.result),\n\t\ttrigger: \"data_result\",\n\t};\n}\n\nfunction evaluateDataPolicy(policy: RuntimePolicyDefinition, ctx: PolicyContext): PolicyOutcome {\n\tconst definition = policy.dataDefinition;\n\n\tif (!definition) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: \"Data policy definition is missing\",\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"data\"],\n\t\t\t\tdata: {\n\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\tdefinitionStatus: \"missing\",\n\t\t\t\t\tconditionResults: [],\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst validation = validateDataPolicyDefinition(definition);\n\tif (!validation.valid) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: `Invalid data policy definition: ${validation.errors.join(\"; \")}`,\n\t\t\tmetadata: {\n\t\t\t\tvalidationErrors: validation.errors,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"data\"],\n\t\t\t\tdata: {\n\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\tdefinitionStatus: \"invalid\",\n\t\t\t\t\tconditionResults: [],\n\t\t\t\t\tvalidationErrors: validation.errors,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst evaluations = definition.conditions.map((condition) => evaluateDataPolicyCondition(condition, ctx));\n\tconst conditionResults = evaluations.flatMap((evaluation) => evaluation.evidence);\n\tconst topLevelResults = evaluations.map((evaluation) => evaluation.result);\n\tconst aggregate =\n\t\ttopLevelResults.find((result) => result.result === \"block\") ??\n\t\ttopLevelResults.find((result) => result.result === \"warn\");\n\tconst result = aggregate?.result ?? definition.defaultResult ?? \"pass\";\n\n\treturn {\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tpolicyKind: policy.kind,\n\t\tresult,\n\t\treason: aggregate?.reason ?? definition.reason,\n\t\tmetadata: {\n\t\t\tconditionCount: definition.conditions.length,\n\t\t\tfailedConditionId: aggregate?.conditionId,\n\t\t},\n\t\tdispatchEvidence: {\n\t\t\tpolicyKind: policy.kind,\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tdispatchPath: [\"data\"],\n\t\t\tdata: {\n\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\tdefinitionStatus: \"evaluated\",\n\t\t\t\tconditionResults,\n\t\t\t},\n\t\t},\n\t};\n}\n\nexport function validateDataPolicyDefinition(\n\tdefinition: DataPolicyDefinition,\n): DataPolicyValidationResult {\n\tconst errors: string[] = [];\n\n\tif (!Array.isArray(definition.conditions) || definition.conditions.length === 0) {\n\t\terrors.push(\"conditions must contain at least one condition\");\n\t} else if (definition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {\n\t\terrors.push(\n\t\t\t`conditions must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} top-level conditions`,\n\t\t);\n\t}\n\n\tif (definition.defaultResult && !POLICY_RESULTS.has(definition.defaultResult)) {\n\t\terrors.push(\"defaultResult must be pass, warn, or block\");\n\t}\n\n\tlet totalConditions = 0;\n\tfor (const condition of definition.conditions ?? []) {\n\t\tvalidateDataPolicyCondition(condition, errors, 1, () => {\n\t\t\ttotalConditions += 1;\n\t\t});\n\t}\n\n\tif (totalConditions > DATA_POLICY_MAX_TOTAL_CONDITIONS) {\n\t\terrors.push(`policy must contain at most ${DATA_POLICY_MAX_TOTAL_CONDITIONS} total conditions`);\n\t}\n\n\treturn { valid: errors.length === 0, errors };\n}\n\nfunction validateDataPolicyCondition(\n\tcondition: DataPolicyCondition,\n\terrors: string[],\n\tdepth: number,\n\tcount: () => void,\n): void {\n\tcount();\n\n\tif (!condition || typeof condition !== \"object\") {\n\t\terrors.push(\"condition must be an object\");\n\t\treturn;\n\t}\n\n\tif (depth > DATA_POLICY_MAX_DEPTH) {\n\t\terrors.push(`condition depth must not exceed ${DATA_POLICY_MAX_DEPTH}`);\n\t\treturn;\n\t}\n\n\tif (!isNonEmptyBoundedString(condition.conditionId)) {\n\t\terrors.push(\"conditionId must be a non-empty bounded string\");\n\t}\n\n\tvalidateOptionalPolicyResult(\"onPass\" in condition ? condition.onPass : undefined, \"onPass\", errors);\n\tvalidateOptionalPolicyResult(\"onFail\" in condition ? condition.onFail : undefined, \"onFail\", errors);\n\n\tif (condition.reason !== undefined && !isNonEmptyBoundedString(condition.reason)) {\n\t\terrors.push(`condition ${condition.conditionId} reason must be a bounded string`);\n\t}\n\n\tif (condition.type === \"always\") {\n\t\tif (!POLICY_RESULTS.has(condition.result)) {\n\t\t\terrors.push(`condition ${condition.conditionId} result must be pass, warn, or block`);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (condition.type === \"parameter\") {\n\t\tvalidatePath(condition.path, `condition ${condition.conditionId} path`, errors);\n\t\tvalidateComparison(condition.operator, condition.value, condition.conditionId, errors);\n\t\treturn;\n\t}\n\n\tif (condition.type === \"comparison\") {\n\t\tvalidateSourceReference(condition.left, condition.conditionId, errors);\n\t\tvalidateComparison(condition.operator, condition.value, condition.conditionId, errors);\n\t\treturn;\n\t}\n\n\tif (condition.type === \"all\" || condition.type === \"any\") {\n\t\tif (!Array.isArray(condition.conditions) || condition.conditions.length === 0) {\n\t\t\terrors.push(`condition ${condition.conditionId} must contain child conditions`);\n\t\t\treturn;\n\t\t}\n\n\t\tif (condition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {\n\t\t\terrors.push(\n\t\t\t\t`condition ${condition.conditionId} must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} child conditions`,\n\t\t\t);\n\t\t}\n\n\t\tfor (const child of condition.conditions) {\n\t\t\tvalidateDataPolicyCondition(child, errors, depth + 1, count);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (condition.type === \"not\") {\n\t\tvalidateDataPolicyCondition(condition.condition, errors, depth + 1, count);\n\t\treturn;\n\t}\n\n\terrors.push(`condition ${condition.conditionId} has unsupported type`);\n}\n\nfunction validateOptionalPolicyResult(\n\tresult: PolicyEvaluationResult | undefined,\n\tfieldName: string,\n\terrors: string[],\n): void {\n\tif (result !== undefined && !POLICY_RESULTS.has(result)) {\n\t\terrors.push(`${fieldName} must be pass, warn, or block`);\n\t}\n}\n\nfunction validateSourceReference(\n\treference: DataPolicySourceReference,\n\tconditionId: string,\n\terrors: string[],\n): void {\n\tif (!reference || typeof reference !== \"object\") {\n\t\terrors.push(`condition ${conditionId} left must be a source reference`);\n\t\treturn;\n\t}\n\n\tif (reference.source !== \"parameters\" && reference.source !== \"context\") {\n\t\terrors.push(`condition ${conditionId} source must be parameters or context`);\n\t}\n\n\tvalidatePath(reference.path, `condition ${conditionId} left.path`, errors);\n\n\tif (reference.source === \"context\" && !DATA_POLICY_CONTEXT_PATHS.has(reference.path)) {\n\t\terrors.push(`condition ${conditionId} uses an unsupported context path`);\n\t}\n}\n\nfunction validateComparison(\n\toperator: DataPolicyComparisonOperator,\n\tvalue: DataPolicyLiteral | undefined,\n\tconditionId: string,\n\terrors: string[],\n): void {\n\tif (!DATA_POLICY_COMPARISON_OPERATORS.has(operator)) {\n\t\terrors.push(`condition ${conditionId} has unsupported operator`);\n\t\treturn;\n\t}\n\n\tif (operator === \"exists\") {\n\t\treturn;\n\t}\n\n\tif (!isDataPolicyLiteral(value)) {\n\t\terrors.push(`condition ${conditionId} comparison value must be a bounded literal`);\n\t\treturn;\n\t}\n\n\tif ([\"gt\", \"gte\", \"lt\", \"lte\"].includes(operator) && typeof value !== \"number\") {\n\t\terrors.push(`condition ${conditionId} numeric comparison requires a number value`);\n\t}\n}\n\nfunction validatePath(path: string, fieldName: string, errors: string[]): void {\n\tif (!isNonEmptyBoundedString(path)) {\n\t\terrors.push(`${fieldName} must be a non-empty bounded string`);\n\t\treturn;\n\t}\n\n\tconst segments = path.split(\".\");\n\tif (segments.length > DATA_POLICY_MAX_PATH_SEGMENTS) {\n\t\terrors.push(`${fieldName} must contain at most ${DATA_POLICY_MAX_PATH_SEGMENTS} segments`);\n\t\treturn;\n\t}\n\n\tfor (const segment of segments) {\n\t\tif (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(segment)) {\n\t\t\terrors.push(`${fieldName} contains an invalid path segment`);\n\t\t\treturn;\n\t\t}\n\n\t\tif ([\"__proto__\", \"constructor\", \"prototype\"].includes(segment)) {\n\t\t\terrors.push(`${fieldName} contains a forbidden path segment`);\n\t\t\treturn;\n\t\t}\n\t}\n}\n\nfunction isDataPolicyLiteral(value: unknown): value is DataPolicyLiteral {\n\tif (value === null || typeof value === \"number\" || typeof value === \"boolean\") {\n\t\treturn true;\n\t}\n\n\treturn typeof value === \"string\" && value.length <= DATA_POLICY_MAX_STRING_LENGTH;\n}\n\nfunction isNonEmptyBoundedString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.length > 0 && value.length <= DATA_POLICY_MAX_STRING_LENGTH;\n}\n\nfunction evaluateDataPolicyCondition(\n\tcondition: DataPolicyCondition,\n\tctx: PolicyContext,\n): { result: DataPolicyConditionResult; evidence: DataPolicyConditionResult[] } {\n\tif (condition.type === \"always\") {\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed: condition.result === \"pass\",\n\t\t\tresult: condition.result,\n\t\t\treason: condition.reason,\n\t\t};\n\t\treturn { result, evidence: [result] };\n\t}\n\n\tif (condition.type === \"all\" || condition.type === \"any\") {\n\t\tconst childEvaluations = condition.conditions.map((child) => evaluateDataPolicyCondition(child, ctx));\n\t\tconst passed =\n\t\t\tcondition.type === \"all\"\n\t\t\t\t? childEvaluations.every((evaluation) => evaluation.result.passed)\n\t\t\t\t: childEvaluations.some((evaluation) => evaluation.result.passed);\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed,\n\t\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\t\treason: passed ? undefined : condition.reason,\n\t\t};\n\n\t\treturn {\n\t\t\tresult,\n\t\t\tevidence: [result, ...childEvaluations.flatMap((evaluation) => evaluation.evidence)],\n\t\t};\n\t}\n\n\tif (condition.type === \"not\") {\n\t\tconst childEvaluation = evaluateDataPolicyCondition(condition.condition, ctx);\n\t\tconst passed = !childEvaluation.result.passed;\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed,\n\t\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\t\treason: passed ? undefined : condition.reason,\n\t\t};\n\n\t\treturn { result, evidence: [result, ...childEvaluation.evidence] };\n\t}\n\n\tif (condition.type !== \"parameter\" && condition.type !== \"comparison\") {\n\t\tconst result: DataPolicyConditionResult = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed: false,\n\t\t\tresult: \"block\",\n\t\t\treason: \"Unsupported data policy condition type\",\n\t\t};\n\t\treturn { result, evidence: [result] };\n\t}\n\n\tconst value =\n\t\tcondition.type === \"parameter\"\n\t\t\t? readPath(ctx.parameters, condition.path)\n\t\t\t: readDataPolicySource(ctx, condition.left);\n\tconst operator = condition.operator;\n\tconst expected = condition.value;\n\tconst passed = evaluateOperator(value, operator, expected);\n\tconst result = {\n\t\tconditionId: condition.conditionId,\n\t\tpassed,\n\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\treason: passed ? undefined : condition.reason,\n\t};\n\treturn { result, evidence: [result] };\n}\n\nfunction evaluateOperator(\n\tactual: unknown,\n\toperator: DataPolicyComparisonOperator,\n\texpected: unknown,\n): boolean {\n\tswitch (operator) {\n\t\tcase \"exists\":\n\t\t\treturn actual !== undefined && actual !== null && actual !== \"\";\n\t\tcase \"equals\":\n\t\t\treturn actual === expected;\n\t\tcase \"notEquals\":\n\t\t\treturn actual !== expected;\n\t\tcase \"gt\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual > expected;\n\t\tcase \"gte\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual >= expected;\n\t\tcase \"lt\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual < expected;\n\t\tcase \"lte\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual <= expected;\n\t}\n}\n\nfunction readDataPolicySource(ctx: PolicyContext, reference: DataPolicySourceReference): unknown {\n\tif (reference.source === \"parameters\") {\n\t\treturn readPath(ctx.parameters, reference.path);\n\t}\n\n\treturn readPath(\n\t\t{\n\t\t\ttenantId: ctx.tenantId,\n\t\t\tspaceId: ctx.spaceId,\n\t\t\tactionInvocationId: ctx.actionInvocationId,\n\t\t\tactionId: ctx.actionId,\n\t\t\tmode: ctx.mode,\n\t\t},\n\t\treference.path,\n\t);\n}\n\nfunction readPath(source: unknown, path: string): unknown {\n\tif (!source || typeof source !== \"object\") {\n\t\treturn undefined;\n\t}\n\n\treturn path.split(\".\").reduce<unknown>((current, segment) => {\n\t\tif (!current || typeof current !== \"object\") {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn (current as Record<string, unknown>)[segment];\n\t}, source);\n}\n\nfunction normalizeOutcome(\n\tpolicy: RuntimePolicyDefinition,\n\toutcome: PolicyOutcome,\n\tdispatchEvidence: PolicyDispatchEvidence,\n): PolicyOutcome {\n\t// The platform owns the dispatch envelope (kind, id, version, path,\n\t// data/code/fallback blocks). Engine provenance is evaluator-controlled —\n\t// preserve it so BYO-engine adapters (OPA, Cedar, ...) can attach decision\n\t// path, bundle revision, decision ID, input hash, etc.\n\tconst engine = outcome.dispatchEvidence?.engine;\n\treturn {\n\t\t...outcome,\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tpolicyKind: policy.kind,\n\t\tmetadata: {\n\t\t\t...(outcome.metadata ?? {}),\n\t\t\tcodePolicyId: dispatchEvidence.code?.policyId ?? outcome.policyId,\n\t\t\tcodePolicyVersion: dispatchEvidence.code?.version ?? outcome.policyVersion,\n\t\t},\n\t\tdispatchEvidence: engine ? { ...dispatchEvidence, engine } : dispatchEvidence,\n\t};\n}\n\nfunction parsePolicyVersion(policyId: PolicyId): number {\n\tconst segments = policyId.split(\".v\");\n\treturn Number(segments[segments.length - 1] ?? 1);\n}\n\nexport function aggregatePolicyOutcomes(outcomes: PolicyOutcome[]): PolicyOutcome | undefined {\n\treturn (\n\t\toutcomes.find((outcome) => outcome.result === \"block\") ??\n\t\toutcomes.find((outcome) => outcome.result === \"warn\")\n\t);\n}\n"]}

package/dist/{chunk-GLUBIGV2.cjs → chunk-P76WWJIJ.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkQETQGAXJ_cjs = require('./chunk-QETQGAXJ.cjs');
-var chunkSDXDHVTV_cjs = require('./chunk-SDXDHVTV.cjs');
+var chunkDBZRPM72_cjs = require('./chunk-DBZRPM72.cjs');
 var chunkUV252FLT_cjs = require('./chunk-UV252FLT.cjs');
 var chunkRMI3BIND_cjs = require('./chunk-RMI3BIND.cjs');
 var chunkEO4VSB2O_cjs = require('./chunk-EO4VSB2O.cjs');
@@ -153,7 +153,7 @@ function registerFabricModule(module) {
     chunkJAXDEK5Z_cjs.registerEventType(getEventTypeName(eventType));
   }
   for (const policy of module.policies ?? []) {
-    chunkSDXDHVTV_cjs.registerPolicyIfMissing(policy);
+    chunkDBZRPM72_cjs.registerPolicyIfMissing(policy);
   }
   for (const machine of module.stateMachines ?? []) {
     chunkUV252FLT_cjs.registerStateMachineIfMissing(machine);
@@ -191,5 +191,5 @@ exports.getObjectTypeName = getObjectTypeName;
 exports.registerFabricModule = registerFabricModule;
 exports.registerFabricModules = registerFabricModules;
 exports.validateModuleNamespace = validateModuleNamespace;
-//# sourceMappingURL=chunk-GLUBIGV2.cjs.map
-//# sourceMappingURL=chunk-GLUBIGV2.cjs.map
+//# sourceMappingURL=chunk-P76WWJIJ.cjs.map
+//# sourceMappingURL=chunk-P76WWJIJ.cjs.map