@fabricorg/platform 1.10.0 → 1.10.2

package/dist/policies-Nxbp1CH8.cjs

@@ -0,0 +1,698 @@
+//#region policies/reconciliation-required.ts
+/** A possibly committed domain effect requiring an operator decision at the handler transaction boundary. */
+var ReconciliationRequiredError = class extends Error {
+	name = "ReconciliationRequiredError";
+	code = "EXECUTION_RECONCILIATION_REQUIRED";
+	constructor(message, options) {
+		super(message, options);
+	}
+};
+/**
+* Recognise a ReconciliationRequiredError, including one constructed by a second
+* package copy (for example ESM and CommonJS builds loaded side by side).
+*/
+function isReconciliationRequiredError(error) {
+	if (error instanceof ReconciliationRequiredError) return true;
+	return typeof error === "object" && error !== null && error.name === "ReconciliationRequiredError" && error.code === "EXECUTION_RECONCILIATION_REQUIRED";
+}
+//#endregion
+//#region policies/retryable-execution.ts
+/** A transient execution dependency failure; the host decides whether retry is safe. */
+var RetryableExecutionError = class extends Error {
+	name = "RetryableExecutionError";
+	code = "EXECUTION_RETRYABLE";
+	constructor(message, options) {
+		super(message, options);
+	}
+};
+/**
+* Recognise a RetryableExecutionError, including one constructed by a second
+* package copy (for example ESM and CommonJS builds loaded side by side).
+*/
+function isRetryableExecutionError(error) {
+	if (error instanceof RetryableExecutionError) return true;
+	return typeof error === "object" && error !== null && error.name === "RetryableExecutionError" && error.code === "EXECUTION_RETRYABLE";
+}
+//#endregion
+//#region policies/index.ts
+function assertPolicyId(policyId) {
+	if (!/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*\.v[0-9]+$/.test(policyId)) throw new Error(`Invalid policy ID: ${policyId}`);
+}
+function validatePolicyGuidance(guidance) {
+	const errors = [];
+	if (!isPlainRecord(guidance)) return {
+		valid: false,
+		errors: ["guidance must be an object"]
+	};
+	if (guidance.summary !== void 0 && typeof guidance.summary !== "string") errors.push("guidance.summary must be a string when present");
+	if (!Array.isArray(guidance.factsUsed)) errors.push("guidance.factsUsed must be an array");
+	else guidance.factsUsed.forEach((fact, index) => {
+		if (!isPlainRecord(fact)) {
+			errors.push(`guidance.factsUsed[${index}] must be an object`);
+			return;
+		}
+		if (typeof fact.name !== "string" || fact.name.length === 0) errors.push(`guidance.factsUsed[${index}].name must be a non-empty string`);
+		if (fact.label !== void 0 && typeof fact.label !== "string") errors.push(`guidance.factsUsed[${index}].label must be a string when present`);
+	});
+	if (!Array.isArray(guidance.correctiveActions)) errors.push("guidance.correctiveActions must be an array");
+	else guidance.correctiveActions.forEach((action, index) => {
+		errors.push(...validatePolicyCorrectiveAction(action, index));
+	});
+	return {
+		valid: errors.length === 0,
+		errors
+	};
+}
+function validatePolicyCorrectiveAction(action, index) {
+	const errors = [];
+	const prefix = `guidance.correctiveActions[${index}]`;
+	if (!isPlainRecord(action)) return [`${prefix} must be an object`];
+	if (action.kind !== "invoke_action" && action.kind !== "navigate" && action.kind !== "manual") errors.push(`${prefix}.kind must be "invoke_action" | "navigate" | "manual"`);
+	if (typeof action.label !== "string" || action.label.length === 0) errors.push(`${prefix}.label must be a non-empty string`);
+	if (action.description !== void 0 && typeof action.description !== "string") errors.push(`${prefix}.description must be a string when present`);
+	if (action.requiresConfirmation !== void 0 && typeof action.requiresConfirmation !== "boolean") errors.push(`${prefix}.requiresConfirmation must be a boolean when present`);
+	if (action.requiresRole !== void 0) {
+		if (!Array.isArray(action.requiresRole)) errors.push(`${prefix}.requiresRole must be an array when present`);
+		else if (action.requiresRole.some((role) => typeof role !== "string" || role.length === 0)) errors.push(`${prefix}.requiresRole must contain only non-empty strings`);
+	}
+	if (action.kind === "invoke_action") {
+		if (typeof action.actionId !== "string" || action.actionId.length === 0) errors.push(`${prefix}.actionId must be a non-empty string for invoke_action`);
+		if (action.parameters !== void 0 && !isPlainRecord(action.parameters)) errors.push(`${prefix}.parameters must be an object when present`);
+	}
+	if (action.kind === "navigate") {
+		if (action.route !== void 0 && typeof action.route !== "string") errors.push(`${prefix}.route must be a string when present`);
+		if (action.target !== void 0 && !isPlainRecord(action.target)) errors.push(`${prefix}.target must be an object when present`);
+	}
+	return errors;
+}
+function isPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+const DATA_POLICY_MAX_DEPTH = 5;
+const DATA_POLICY_MAX_CONDITIONS_PER_NODE = 20;
+const DATA_POLICY_MAX_TOTAL_CONDITIONS = 100;
+const DATA_POLICY_MAX_PATH_SEGMENTS = 12;
+const DATA_POLICY_MAX_STRING_LENGTH = 500;
+const DATA_POLICY_CONTEXT_PATHS = Object.freeze([
+	"tenantId",
+	"spaceId",
+	"actionInvocationId",
+	"actionId",
+	"mode"
+]);
+const DATA_POLICY_COMPARISON_OPERATORS = Object.freeze([
+	"exists",
+	"equals",
+	"notEquals",
+	"gt",
+	"gte",
+	"lt",
+	"lte"
+]);
+const POLICY_RESULTS = Object.freeze([
+	"pass",
+	"warn",
+	"block"
+]);
+function createPolicyRegistry(evaluators = []) {
+	const policies = /* @__PURE__ */ new Map();
+	const register = (evaluator) => {
+		assertPolicyId(evaluator.policyId);
+		const existing = policies.get(evaluator.policyId);
+		if (existing && existing !== evaluator) throw new Error(`Conflicting policy registration for "${evaluator.policyId}". A different evaluator is already registered.`);
+		policies.set(evaluator.policyId, evaluator);
+	};
+	for (const evaluator of evaluators) register(evaluator);
+	return {
+		register,
+		registerIfMissing(evaluator) {
+			const existing = policies.get(evaluator.policyId);
+			if (!existing) register(evaluator);
+			else if (existing !== evaluator) throw new Error(`Conflicting policy registration for "${evaluator.policyId}". A different evaluator is already registered.`);
+		},
+		resolve: (policyId) => policies.get(policyId),
+		ids: () => Array.from(policies.keys())
+	};
+}
+async function evaluateRegisteredPolicies(policyIds, ctx) {
+	return evaluatePolicyDefinitions(policyIds.map((policyId) => ({
+		policyId,
+		policyVersion: parsePolicyVersion(policyId),
+		kind: "code",
+		codeEvaluatorPolicyId: policyId
+	})), ctx);
+}
+async function evaluatePolicyDefinitions(policies, ctx) {
+	const outcomes = [];
+	for (const policy of policies) {
+		assertPolicyId(policy.policyId);
+		outcomes.push(await evaluatePolicyDefinition(policy, ctx));
+	}
+	return outcomes;
+}
+async function evaluatePolicyDefinition(policy, ctx) {
+	const authority = policy.authority ? { ...policy.authority } : void 0;
+	const outcome = policy.kind === "data" ? await evaluateDataPolicy(policy, ctx) : policy.kind === "code" ? await evaluateCodePolicy(policy, ctx) : await evaluateHybridPolicy(policy, ctx);
+	if (!authority) return outcome;
+	return {
+		...outcome,
+		dispatchEvidence: {
+			...outcome.dispatchEvidence ?? {
+				policyKind: policy.kind,
+				policyId: policy.policyId,
+				policyVersion: policy.policyVersion,
+				dispatchPath: []
+			},
+			authority
+		}
+	};
+}
+async function evaluateCodePolicy(policy, ctx) {
+	const codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId ?? policy.policyId;
+	const evaluator = ctx.resolveCodePolicy?.(codeEvaluatorPolicyId);
+	if (!evaluator) return {
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		policyKind: policy.kind,
+		result: "block",
+		reason: `No evaluator registered for policy ${codeEvaluatorPolicyId}`,
+		metadata: { missingCodeEvaluatorPolicyId: codeEvaluatorPolicyId },
+		dispatchEvidence: {
+			policyKind: policy.kind,
+			policyId: policy.policyId,
+			policyVersion: policy.policyVersion,
+			dispatchPath: ["code"],
+			code: {
+				requestedPolicyId: codeEvaluatorPolicyId,
+				policyId: codeEvaluatorPolicyId,
+				registered: false
+			}
+		}
+	};
+	if (ctx.mode === "preview" && evaluator.previewSafe !== true) {
+		const skipReason = `Policy ${evaluator.policyId} skipped in preview mode (evaluator is not declared previewSafe)`;
+		return {
+			policyId: policy.policyId,
+			policyVersion: policy.policyVersion,
+			policyKind: policy.kind,
+			result: "warn",
+			reason: skipReason,
+			metadata: {
+				codePolicyId: evaluator.policyId,
+				codePolicyVersion: evaluator.version,
+				previewSkipped: true
+			},
+			dispatchEvidence: {
+				policyKind: policy.kind,
+				policyId: policy.policyId,
+				policyVersion: policy.policyVersion,
+				dispatchPath: ["code"],
+				code: {
+					requestedPolicyId: codeEvaluatorPolicyId,
+					policyId: evaluator.policyId,
+					version: evaluator.version,
+					registered: true,
+					skipped: true,
+					skipReason
+				}
+			}
+		};
+	}
+	return normalizeOutcome(policy, await evaluator.evaluate(ctx), {
+		policyKind: policy.kind,
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		dispatchPath: ["code"],
+		code: {
+			requestedPolicyId: codeEvaluatorPolicyId,
+			policyId: evaluator.policyId,
+			version: evaluator.version,
+			registered: true
+		}
+	});
+}
+async function evaluateHybridPolicy(policy, ctx) {
+	const dataOutcome = evaluateDataPolicy(policy, ctx);
+	const fallback = policy.fallback;
+	const fallbackDecision = fallback ? resolveFallbackDecision(policy, dataOutcome, fallback) : {
+		shouldFallback: false,
+		trigger: "not_triggered"
+	};
+	if (!fallback || !fallbackDecision.shouldFallback) {
+		if (fallback && dataOutcome.dispatchEvidence) return {
+			...dataOutcome,
+			dispatchEvidence: {
+				...dataOutcome.dispatchEvidence,
+				fallback: {
+					used: false,
+					trigger: "not_triggered",
+					reason: "Data policy result did not trigger fallback",
+					fromResult: dataOutcome.result,
+					definitionVersion: policy.policyVersion,
+					codeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId
+				}
+			}
+		};
+		return dataOutcome;
+	}
+	const codeOutcome = await evaluateCodePolicy({
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		kind: "hybrid",
+		codeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId
+	}, ctx);
+	return normalizeOutcome(policy, codeOutcome, {
+		...codeOutcome.dispatchEvidence ?? {
+			policyKind: "hybrid",
+			policyId: policy.policyId,
+			policyVersion: policy.policyVersion,
+			dispatchPath: ["code"]
+		},
+		policyKind: "hybrid",
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		dispatchPath: [
+			"data",
+			"fallback",
+			"code"
+		],
+		data: dataOutcome.dispatchEvidence?.data,
+		fallback: {
+			used: true,
+			trigger: fallbackDecision.trigger,
+			reason: fallback.reason ?? "Data policy result triggered code fallback",
+			fromResult: dataOutcome.result,
+			definitionVersion: policy.policyVersion,
+			codeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId
+		}
+	});
+}
+function resolveFallbackDecision(policy, dataOutcome, fallback) {
+	const allowedTriggers = fallback.triggers ?? [
+		"data_result",
+		"missing_data_definition",
+		"invalid_data_definition"
+	];
+	const definitionStatus = dataOutcome.dispatchEvidence?.data?.definitionStatus;
+	if (definitionStatus === "missing") return {
+		shouldFallback: allowedTriggers.includes("missing_data_definition"),
+		trigger: "missing_data_definition"
+	};
+	if (definitionStatus === "invalid") return {
+		shouldFallback: allowedTriggers.includes("invalid_data_definition"),
+		trigger: "invalid_data_definition"
+	};
+	const fallbackResults = fallback.onResults ?? ["warn", "block"];
+	return {
+		shouldFallback: policy.kind === "hybrid" && allowedTriggers.includes("data_result") && fallbackResults.includes(dataOutcome.result),
+		trigger: "data_result"
+	};
+}
+function evaluateDataPolicy(policy, ctx) {
+	const definition = policy.dataDefinition;
+	if (!definition) return {
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		policyKind: policy.kind,
+		result: "block",
+		reason: "Data policy definition is missing",
+		dispatchEvidence: {
+			policyKind: policy.kind,
+			policyId: policy.policyId,
+			policyVersion: policy.policyVersion,
+			dispatchPath: ["data"],
+			data: {
+				definitionVersion: policy.policyVersion,
+				definitionStatus: "missing",
+				conditionResults: []
+			}
+		}
+	};
+	const validation = validateDataPolicyDefinition(definition);
+	if (!validation.valid) return {
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		policyKind: policy.kind,
+		result: "block",
+		reason: `Invalid data policy definition: ${validation.errors.join("; ")}`,
+		metadata: { validationErrors: validation.errors },
+		dispatchEvidence: {
+			policyKind: policy.kind,
+			policyId: policy.policyId,
+			policyVersion: policy.policyVersion,
+			dispatchPath: ["data"],
+			data: {
+				definitionVersion: policy.policyVersion,
+				definitionStatus: "invalid",
+				conditionResults: [],
+				validationErrors: validation.errors
+			}
+		}
+	};
+	const evaluations = definition.conditions.map((condition) => evaluateDataPolicyCondition(condition, ctx));
+	const conditionResults = evaluations.flatMap((evaluation) => evaluation.evidence);
+	const topLevelResults = evaluations.map((evaluation) => evaluation.result);
+	const aggregate = topLevelResults.find((result) => result.result === "block") ?? topLevelResults.find((result) => result.result === "warn");
+	const result = aggregate?.result ?? definition.defaultResult ?? "pass";
+	return {
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		policyKind: policy.kind,
+		result,
+		reason: aggregate?.reason ?? definition.reason,
+		metadata: {
+			conditionCount: definition.conditions.length,
+			failedConditionId: aggregate?.conditionId
+		},
+		dispatchEvidence: {
+			policyKind: policy.kind,
+			policyId: policy.policyId,
+			policyVersion: policy.policyVersion,
+			dispatchPath: ["data"],
+			data: {
+				definitionVersion: policy.policyVersion,
+				definitionStatus: "evaluated",
+				conditionResults
+			}
+		}
+	};
+}
+function validateDataPolicyDefinition(definition) {
+	const errors = [];
+	if (!Array.isArray(definition.conditions) || definition.conditions.length === 0) errors.push("conditions must contain at least one condition");
+	else if (definition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) errors.push(`conditions must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} top-level conditions`);
+	if (definition.defaultResult && !POLICY_RESULTS.includes(definition.defaultResult)) errors.push("defaultResult must be pass, warn, or block");
+	let totalConditions = 0;
+	for (const condition of definition.conditions ?? []) validateDataPolicyCondition(condition, errors, 1, () => {
+		totalConditions += 1;
+	});
+	if (totalConditions > DATA_POLICY_MAX_TOTAL_CONDITIONS) errors.push(`policy must contain at most ${DATA_POLICY_MAX_TOTAL_CONDITIONS} total conditions`);
+	return {
+		valid: errors.length === 0,
+		errors
+	};
+}
+function validateDataPolicyCondition(condition, errors, depth, count) {
+	count();
+	if (!condition || typeof condition !== "object") {
+		errors.push("condition must be an object");
+		return;
+	}
+	if (depth > DATA_POLICY_MAX_DEPTH) {
+		errors.push(`condition depth must not exceed ${DATA_POLICY_MAX_DEPTH}`);
+		return;
+	}
+	if (!isNonEmptyBoundedString(condition.conditionId)) errors.push("conditionId must be a non-empty bounded string");
+	validateOptionalPolicyResult("onPass" in condition ? condition.onPass : void 0, "onPass", errors);
+	validateOptionalPolicyResult("onFail" in condition ? condition.onFail : void 0, "onFail", errors);
+	if (condition.reason !== void 0 && !isNonEmptyBoundedString(condition.reason)) errors.push(`condition ${condition.conditionId} reason must be a bounded string`);
+	if (condition.type === "always") {
+		if (!POLICY_RESULTS.includes(condition.result)) errors.push(`condition ${condition.conditionId} result must be pass, warn, or block`);
+		return;
+	}
+	if (condition.type === "parameter") {
+		validatePath(condition.path, `condition ${condition.conditionId} path`, errors);
+		validateComparison(condition.operator, condition.value, condition.conditionId, errors);
+		return;
+	}
+	if (condition.type === "comparison") {
+		validateSourceReference(condition.left, condition.conditionId, errors);
+		validateComparison(condition.operator, condition.value, condition.conditionId, errors);
+		return;
+	}
+	if (condition.type === "all" || condition.type === "any") {
+		if (!Array.isArray(condition.conditions) || condition.conditions.length === 0) {
+			errors.push(`condition ${condition.conditionId} must contain child conditions`);
+			return;
+		}
+		if (condition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) errors.push(`condition ${condition.conditionId} must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} child conditions`);
+		for (const child of condition.conditions) validateDataPolicyCondition(child, errors, depth + 1, count);
+		return;
+	}
+	if (condition.type === "not") {
+		validateDataPolicyCondition(condition.condition, errors, depth + 1, count);
+		return;
+	}
+	errors.push(`condition ${condition.conditionId} has unsupported type`);
+}
+function validateOptionalPolicyResult(result, fieldName, errors) {
+	if (result !== void 0 && !POLICY_RESULTS.includes(result)) errors.push(`${fieldName} must be pass, warn, or block`);
+}
+function validateSourceReference(reference, conditionId, errors) {
+	if (!reference || typeof reference !== "object") {
+		errors.push(`condition ${conditionId} left must be a source reference`);
+		return;
+	}
+	if (reference.source !== "parameters" && reference.source !== "context") errors.push(`condition ${conditionId} source must be parameters or context`);
+	validatePath(reference.path, `condition ${conditionId} left.path`, errors);
+	if (reference.source === "context" && !DATA_POLICY_CONTEXT_PATHS.includes(reference.path)) errors.push(`condition ${conditionId} uses an unsupported context path`);
+}
+function validateComparison(operator, value, conditionId, errors) {
+	if (!DATA_POLICY_COMPARISON_OPERATORS.includes(operator)) {
+		errors.push(`condition ${conditionId} has unsupported operator`);
+		return;
+	}
+	if (operator === "exists") return;
+	if (!isDataPolicyLiteral(value)) {
+		errors.push(`condition ${conditionId} comparison value must be a bounded literal`);
+		return;
+	}
+	if ([
+		"gt",
+		"gte",
+		"lt",
+		"lte"
+	].includes(operator) && typeof value !== "number") errors.push(`condition ${conditionId} numeric comparison requires a number value`);
+}
+function validatePath(path, fieldName, errors) {
+	if (!isNonEmptyBoundedString(path)) {
+		errors.push(`${fieldName} must be a non-empty bounded string`);
+		return;
+	}
+	const segments = path.split(".");
+	if (segments.length > DATA_POLICY_MAX_PATH_SEGMENTS) {
+		errors.push(`${fieldName} must contain at most ${DATA_POLICY_MAX_PATH_SEGMENTS} segments`);
+		return;
+	}
+	for (const segment of segments) {
+		if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(segment)) {
+			errors.push(`${fieldName} contains an invalid path segment`);
+			return;
+		}
+		if ([
+			"__proto__",
+			"constructor",
+			"prototype"
+		].includes(segment)) {
+			errors.push(`${fieldName} contains a forbidden path segment`);
+			return;
+		}
+	}
+}
+function isDataPolicyLiteral(value) {
+	if (value === null || typeof value === "number" || typeof value === "boolean") return true;
+	return typeof value === "string" && value.length <= DATA_POLICY_MAX_STRING_LENGTH;
+}
+function isNonEmptyBoundedString(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= DATA_POLICY_MAX_STRING_LENGTH;
+}
+function evaluateDataPolicyCondition(condition, ctx) {
+	if (condition.type === "always") {
+		const result = {
+			conditionId: condition.conditionId,
+			passed: condition.result === "pass",
+			result: condition.result,
+			reason: condition.reason
+		};
+		return {
+			result,
+			evidence: [result]
+		};
+	}
+	if (condition.type === "all" || condition.type === "any") {
+		const childEvaluations = condition.conditions.map((child) => evaluateDataPolicyCondition(child, ctx));
+		const passed = condition.type === "all" ? childEvaluations.every((evaluation) => evaluation.result.passed) : childEvaluations.some((evaluation) => evaluation.result.passed);
+		const result = {
+			conditionId: condition.conditionId,
+			passed,
+			result: passed ? condition.onPass ?? "pass" : condition.onFail ?? "block",
+			reason: passed ? void 0 : condition.reason
+		};
+		return {
+			result,
+			evidence: [result, ...childEvaluations.flatMap((evaluation) => evaluation.evidence)]
+		};
+	}
+	if (condition.type === "not") {
+		const childEvaluation = evaluateDataPolicyCondition(condition.condition, ctx);
+		const passed = !childEvaluation.result.passed;
+		const result = {
+			conditionId: condition.conditionId,
+			passed,
+			result: passed ? condition.onPass ?? "pass" : condition.onFail ?? "block",
+			reason: passed ? void 0 : condition.reason
+		};
+		return {
+			result,
+			evidence: [result, ...childEvaluation.evidence]
+		};
+	}
+	if (condition.type !== "parameter" && condition.type !== "comparison") {
+		const result = {
+			conditionId: condition.conditionId,
+			passed: false,
+			result: "block",
+			reason: "Unsupported data policy condition type"
+		};
+		return {
+			result,
+			evidence: [result]
+		};
+	}
+	const value = condition.type === "parameter" ? readPath(ctx.parameters, condition.path) : readDataPolicySource(ctx, condition.left);
+	const operator = condition.operator;
+	const expected = condition.value;
+	const passed = evaluateOperator(value, operator, expected);
+	const result = {
+		conditionId: condition.conditionId,
+		passed,
+		result: passed ? condition.onPass ?? "pass" : condition.onFail ?? "block",
+		reason: passed ? void 0 : condition.reason
+	};
+	return {
+		result,
+		evidence: [result]
+	};
+}
+function evaluateOperator(actual, operator, expected) {
+	switch (operator) {
+		case "exists": return actual !== void 0 && actual !== null && actual !== "";
+		case "equals": return actual === expected;
+		case "notEquals": return actual !== expected;
+		case "gt": return typeof actual === "number" && typeof expected === "number" && actual > expected;
+		case "gte": return typeof actual === "number" && typeof expected === "number" && actual >= expected;
+		case "lt": return typeof actual === "number" && typeof expected === "number" && actual < expected;
+		case "lte": return typeof actual === "number" && typeof expected === "number" && actual <= expected;
+	}
+}
+function readDataPolicySource(ctx, reference) {
+	if (reference.source === "parameters") return readPath(ctx.parameters, reference.path);
+	return readPath({
+		tenantId: ctx.tenantId,
+		spaceId: ctx.spaceId,
+		actionInvocationId: ctx.actionInvocationId,
+		actionId: ctx.actionId,
+		mode: ctx.mode
+	}, reference.path);
+}
+function readPath(source, path) {
+	if (!source || typeof source !== "object") return;
+	return path.split(".").reduce((current, segment) => {
+		if (!current || typeof current !== "object") return;
+		return current[segment];
+	}, source);
+}
+function normalizeOutcome(policy, outcome, dispatchEvidence) {
+	if (outcome.guidance !== void 0) {
+		const guidanceValidation = validatePolicyGuidance(outcome.guidance);
+		if (!guidanceValidation.valid) throw new Error(`Invalid guidance for policy ${outcome.policyId}: ${guidanceValidation.errors.join("; ")}`);
+	}
+	const engine = outcome.dispatchEvidence?.engine;
+	return {
+		...outcome,
+		policyId: policy.policyId,
+		policyVersion: policy.policyVersion,
+		policyKind: policy.kind,
+		metadata: {
+			...outcome.metadata ?? {},
+			codePolicyId: dispatchEvidence.code?.policyId ?? outcome.policyId,
+			codePolicyVersion: dispatchEvidence.code?.version ?? outcome.policyVersion
+		},
+		dispatchEvidence: engine ? {
+			...dispatchEvidence,
+			engine
+		} : dispatchEvidence
+	};
+}
+function parsePolicyVersion(policyId) {
+	const segments = policyId.split(".v");
+	return Number(segments[segments.length - 1] ?? 1);
+}
+function aggregatePolicyOutcomes(outcomes) {
+	return outcomes.find((outcome) => outcome.result === "block") ?? outcomes.find((outcome) => outcome.result === "warn");
+}
+//#endregion
+Object.defineProperty(exports, "ReconciliationRequiredError", {
+	enumerable: true,
+	get: function() {
+		return ReconciliationRequiredError;
+	}
+});
+Object.defineProperty(exports, "RetryableExecutionError", {
+	enumerable: true,
+	get: function() {
+		return RetryableExecutionError;
+	}
+});
+Object.defineProperty(exports, "aggregatePolicyOutcomes", {
+	enumerable: true,
+	get: function() {
+		return aggregatePolicyOutcomes;
+	}
+});
+Object.defineProperty(exports, "assertPolicyId", {
+	enumerable: true,
+	get: function() {
+		return assertPolicyId;
+	}
+});
+Object.defineProperty(exports, "createPolicyRegistry", {
+	enumerable: true,
+	get: function() {
+		return createPolicyRegistry;
+	}
+});
+Object.defineProperty(exports, "evaluatePolicyDefinition", {
+	enumerable: true,
+	get: function() {
+		return evaluatePolicyDefinition;
+	}
+});
+Object.defineProperty(exports, "evaluatePolicyDefinitions", {
+	enumerable: true,
+	get: function() {
+		return evaluatePolicyDefinitions;
+	}
+});
+Object.defineProperty(exports, "evaluateRegisteredPolicies", {
+	enumerable: true,
+	get: function() {
+		return evaluateRegisteredPolicies;
+	}
+});
+Object.defineProperty(exports, "isReconciliationRequiredError", {
+	enumerable: true,
+	get: function() {
+		return isReconciliationRequiredError;
+	}
+});
+Object.defineProperty(exports, "isRetryableExecutionError", {
+	enumerable: true,
+	get: function() {
+		return isRetryableExecutionError;
+	}
+});
+Object.defineProperty(exports, "validateDataPolicyDefinition", {
+	enumerable: true,
+	get: function() {
+		return validateDataPolicyDefinition;
+	}
+});
+Object.defineProperty(exports, "validatePolicyGuidance", {
+	enumerable: true,
+	get: function() {
+		return validatePolicyGuidance;
+	}
+});
+
+//# sourceMappingURL=policies-Nxbp1CH8.cjs.map