@fabricorg/platform 1.5.1 → 1.7.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @fabricorg/platform
 
+## 1.7.0
+
+### Minor Changes
+
+- 8c7d2a1: Make policy resolution invocation-aware and record which policy snapshot was used.
+
+  - `@fabricorg/platform-host`: `resolvePolicies` now receives the new exported `ResolvePoliciesInput`, which extends `ActionExecutionAuthorizationInput` with `declaredPolicyIds`. It adds `actionInvocationId`, `invocation`, `executionReason`, and `parameters`. The `parameters` are the schema-parsed durable (post-redaction) parameters, the same value passed to `authorizeExecution`, not the caller's original input. Two invocations by the same actor for the same action can now be told apart. Existing resolvers keep working because the input only gained fields.
+  - `@fabricorg/platform`: new `PolicyAuthorityReference` (`snapshotId`, optional `contentHash`), an opaque consumer-defined reference that Platform does not interpret. It is an optional `authority` on `RuntimePolicyDefinition` and on `PolicyDispatchEvidence`. `evaluatePolicyDefinition` copies a definition's `authority` into the outcome's `dispatchEvidence` for code, data, and hybrid policies, including missing-evaluator blocks. Hosts persist it with the policy evaluation. Definitions without `authority` produce unchanged evidence.
+  - Host keeps the first persisted policy evaluation per invocation and policy, so a resolver must return the same snapshot for an `actionInvocationId` on every attempt (`initial`, `recovery`, `approval_resume`).
+
+- 8e631b0: Actions can now refuse a submission before Host records anything for it. Before this, `submitAction` persisted an invocation's parameters before anything validated them: the action's schema ran only at execution. An action whose parameters must be checked against trusted context, such as a secret reference the tenant's secret store must hold, could refuse at execution, but the refused value was already in the invocation record. `redactActionParameters` could strip values, but it is synchronous, gets no tenant or actor, and is an option the application has to remember to wire.
+
+  - **`@fabricorg/platform`: `ActionDefinition.admitSubmission`** (optional). It is an async check that receives `ActionAdmissionInput`: `actionId`, `tenantId`, `spaceId`, `actorId`, `actorType`, the submitted `parameters` and a `signal` typed as the new structural `ActionAdmissionSignal` (so the `actions` entry still compiles without DOM or Node type libraries; Host passes a real `AbortSignal`). It answers `ActionAdmissionDecision`, which is `{ admitted: true }` or `{ admitted: false, code }`. The code must be fixed text chosen by the action, never a submitted value. `ActionContext.admittedAt` (optional) is how a handler learns that the host admitted its invocation. Module and action registration now reject an `admitSubmission` that is not a function. A host that does not know the field ignores it, so a handler that depends on admission should refuse without `ctx.admittedAt`.
+  - **`@fabricorg/platform-host`: ordering.** `submitAction` runs the check on every submission of an action that declares it: inline, dispatched, offline replays, and re-submissions under an existing idempotency key. It runs after entitlement and `authorize`, so an unauthorized submitter never reaches it. It is the last await before `createActionInvocation`: for such an action, provenance normalization, `composition.resolveInitiatingReleaseDigest` and runtime evidence run before it, and redaction, the parameter digest and the authorization-binding check after it. Actions without the check keep the previous order (redaction, digest and binding check before provenance normalization and the composition callback). The check gets the submission's trusted scope and actor, never scope taken from the parameters, and a copy of the parameters made for it alone. For an action with the check, Host persists its own copy, taken when `submitAction` was called, so neither the caller nor the check holds a reference to what is stored (tests "the persisted parameters are the copy that was checked …" and "a parameter getter is read exactly once …" in `tests/submission-admission.test.ts`).
+  - **`@fabricorg/platform-host`: one snapshot of the submission's identity.** `submitAction` now reads the scalar fields of the caller's `SubmitActionInput` (`actionId`, `tenantId`, `spaceId`, `actorId`, `actorType`, `correlationId`, `causationId`, `executionReason`, `idempotencyKey`, `authorizationBindingId`) once, before its first await, and every later step uses those values (`snapshotSubmission`, `src/submission-snapshot.ts`). Before this, Host reread the caller's object after awaiting `checkEntitlement`, `authorize` and the composition callback, so a caller that changed `tenantId`, `actorId` or `actionId` during those awaits could get an invocation persisted and executed under values that were never authorized. This affects every action (tests "changing the caller's input while admission awaits …", "… while authorize awaits …" and "the identity snapshot still applies …"). A scalar field that holds an object, a function or a symbol, a read of one that throws, or an input that is not an object makes `submitAction` throw an `Error` with a fixed message and record nothing; in each case the field does not yield a value of its declared type.
+  - **Parameters, provenance and binding.** For an action that declares `admitSubmission`, Host reads each of the three once, before its first await, and keeps its own copies. Parameters are copied as JSON data: `null`, strings, booleans, finite numbers, dense arrays, and objects whose prototype is `Object.prototype` or `null`; each own enumerable string-keyed property is read once, `undefined` values are left out, and symbol keys and non-enumerable properties are skipped. Anything else is refused as `invalid_parameters` before the check runs: a Proxy, a function, a symbol, a bigint, `NaN` or `Infinity`, a Date, a Map, a class instance, an ArrayBuffer, a SharedArrayBuffer, a typed array or DataView (so no caller-held view can write to a checked value), an array hole or `undefined` element, a cycle, or a getter that throws. Provenance and binding are copied field by field, each declared field read once from an own or inherited property, so class instances are accepted and undeclared fields are not kept. For every other action nothing about these three fields changes: Host reads them from the caller's input at the same points and as often as before, and `redactActionParameters`, the digest, the store, the handler and `provenance.onTrace` get what they got before (tests under "an action without admitSubmission: everything but the identity snapshot is as before"). The composition callback, `composition.resolveInitiatingReleaseDigest`, now gets a view of the submission instead of the caller's object, for every action: its scalar fields are the snapshot's, so the release evidence it resolves is for the tenant, actor and action Host persists (before, a caller that changed `tenantId` while `authorize` awaited could have the callback resolve another tenant's release digest, which Host then persisted under the original tenant). For an action without the check, the view's `parameters`, `provenance` and `authorizationBinding` read and assign the caller's input, so the callback reaches the same objects as before; other properties of the caller's object are not on the view (test "scope, actor and action changed while authorize awaits do not reach the composition callback …").
+  - **Fail-closed behaviour.** Only `{ admitted: true }` admits, read as an own data property. `submitAction` throws the new `ActionAdmissionError` (`code: "ACTION_ADMISSION_REFUSED"`, `actionId`, `refusal`, and `refusalCode` for a refusal) in each of these cases: a refusal whose code matches `^[a-z][A-Za-z0-9_.:-]{0,127}$` (`refused`); a throw or a non-function check (`failed`); an answer that does not settle within the new `admissionTimeoutMs` option, default 10 000 (`timed_out`); any other answer (`invalid_decision`); and parameters that are not JSON data (`invalid_parameters`). The deadline is judged when the answer settles, on the monotonic clock (`performance.now()`), not by a race with a timer. An answer or throw that settles `admissionTimeoutMs` or more after the call is `timed_out` even when its handler runs before the timer, as when the check blocked the event loop past the deadline (test "an answer that settles after admissionTimeoutMs is refused even when the check blocked the event loop …"). The timer only ends the wait on a promise that never settles. Every `timed_out` refusal aborts the check's signal before `submitAction` throws. Host writes nothing for a refused submission: no invocation, no idempotency key (the key stays free), no event, no policy record and no error. The error message names the action, the refusal and the check's code only. It never contains a submitted value or anything the check threw. `admissionTimeoutMs` must be a whole number from 1 to 2 147 483 647, the largest delay `setTimeout` honours. Otherwise `createGovernedActionHost` throws: NaN, Infinity, 0, negatives, fractions and 2^31 are refused.
+  - **Durable evidence and execution.** An admitted invocation records `ActionInvocationRecord.admittedAt`, which is set on creation and never patched. Host passes it to the handler as `ActionContext.admittedAt`. Host refuses to execute an invocation of an action that declares `admitSubmission` when its record has no `admittedAt`, whether inline, from the worker or after an approval. The invocation fails with a fixed message and the handler does not run. Such a record comes from an older Host, a direct store write, or a custom store that does not persist `admittedAt`. Custom `PlatformHostStore` implementations should store and return `admittedAt`. Until they do, actions that declare `admitSubmission` fail at execution, and nothing else changes.
+  - **PostgreSQL.** `ensureSchema()` applies migration 6 (`invocation_admission`), which adds the nullable `action_invocations.admitted_at timestamptz` column with no default. Existing rows and rows of actions without the check stay `NULL`.
+  - **Rollout order.** The PostgreSQL store names `admitted_at` only when it inserts an admitted invocation, and every invocation read selects `*` and treats a missing column as no `admittedAt`. So actions without `admitSubmission` are submitted, read back and executed on a schema without migration 6, as before (live test "without migration 6, an action without admitSubmission is submitted …"). Before submitting an action that declares `admitSubmission`: (1) run `ensureSchema()`; without migration 6 such a submission fails with an error naming the migration and writes nothing. (2) Upgrade every Host process, workers included. An older worker executes such an invocation without checking `admittedAt`, and an older submitter persists its parameters unchecked. A handler that requires `ctx.admittedAt` still refuses to act under an older Host.
+  - **Telemetry.** `invocation.admission_refused` (`fabric.platform.invocation.admission_refused`) is emitted with the `refusal` attribute. A refused submission emits no `invocation.submitted`.
+  - **Compatibility.** Every addition is optional. Actions without `admitSubmission` run no check, record no `admittedAt`, get no new parameter refusal and see their parameters, provenance and binding handled as before; the one change for them is that the scalar fields are read once at submission, so a change the caller makes to one of them while `submitAction` awaits is no longer read, and a scalar field that does not yield a value of its declared type is refused with the fixed message above. Rejecting non-JSON parameters for every action would have refused Dates, Maps and class instances that existing callers may pass, a breaking change this minor does not make. On PostgreSQL, only the insert of an admitted invocation names the new `admitted_at` column, so migration 6 is needed only before the first action that declares `admitSubmission` is submitted, as the rollout order above says. `redactActionParameters` stays defense in depth. For an action with the check, it runs on Host's copy after admission.
+
+## 1.6.0
+
+### Minor Changes
+
+- 0b437ed: Add validated action/view discovery surface declarations with required reasons for internal entries.
+  Preserve them in public manifests and validate normalized manifests. Omitted declarations retain
+  public discovery and unchanged serialized shape. Discovery metadata never changes Host authority;
+  external catalogs must withhold internal entries and apply audience disclosure independently.
+
 ## 1.5.1
 
 ### Patch Changes

package/README.md

@@ -23,7 +23,7 @@ const greet: ActionDefinition<unknown> = {
 
 That's the smallest unit. From here, you compose actions into a `FabricModule<TDb>`, register the module at startup, and call `invokeAction("demo.greet", ...)` from any of three call paths (authenticated user, signed token, or system/agent). Every call passes through the same pipeline: **policy → state machine → handler → adapters → events → projections.**
 
-For a complete walkthrough see https://platform.fabric.pro/docs/getting-started/quickstart.
+For a complete walkthrough see https://platform.techfabric.com/docs/getting-started/quickstart.
 
 ## Why use this
 
@@ -42,6 +42,7 @@ That's what this package gives you. Nothing more.
 | Subpath | What you get |
 |---|---|
 | `@fabricorg/platform` | Re-exports everything below |
+| `@fabricorg/platform/discovery` | Portable discovery-surface declarations and validation |
 | `@fabricorg/platform/actions` | `ActionDefinition`, `ActionContext`, `SagaImplementation` |
 | `@fabricorg/platform/policies` | `PolicyEvaluator`, `PolicyContext`, code/data/hybrid evaluation |
 | `@fabricorg/platform/state-machines` | `StateMachineDefinition`, structural and guard-aware transition evaluation |
@@ -102,6 +103,8 @@ const json = JSON.stringify(manifest, null, 2);
 
 An entity schema does not validate arbitrary writes through `TDb`. Persisted-record validation requires an explicit Host/database adapter. When an action declares `resultSchema`, Platform Host validates the public result after the handler and before events or adapters; failure rolls back domain writes only when the Host store has a transaction provider that includes them.
 
+An action may also declare `admitSubmission`, an async check that decides whether a submission may be recorded at all. It receives the trusted `tenantId`, `spaceId`, `actorId` and `actorType`, the submitted parameters and a `signal` (`ActionAdmissionSignal`, a structural subset of `AbortSignal`; Host passes a real one), and answers `{ admitted: true }` or `{ admitted: false, code }` with a fixed code. `@fabricorg/platform-host` 7.3.0 and later runs it after authorizing the submitter and before writing anything for the submission, refuses on a throw, timeout or any other answer, and passes the admission time to the handler as `ActionContext.admittedAt`. An older host ignores the field, so a handler that relies on it should refuse without `ctx.admittedAt`. Registration rejects an `admitSubmission` that is not a function.
+
 ## The action lifecycle
 
 Every `invokeAction(id, params)` call goes through:
@@ -174,7 +177,29 @@ See [`CHANGELOG.md`](./CHANGELOG.md) for release history.
 
 ## Documentation
 
-Full reference docs at https://platform.fabric.pro
+Full reference docs at https://platform.techfabric.com
+
+## Discovery surface declarations
+
+Actions and views can declare `surface: "internal"` with a non-blank `surfaceReason`.
+Omission means public discovery. Registration, manifest export and manifest normalization reject
+unknown surfaces and missing reasons. Public manifests retain both fields, so contract digests
+cover the declaration. Existing declarations without these fields preserve their exported shape.
+
+External catalog consumers must omit internal entries, including their reason and schemas, and
+apply their existing audience disclosure rules to public entries. This is discovery metadata:
+it does not grant invocation/read access, bypass policy, or stop authorized workers from running
+internal actions through the governed Host. A public entry is not a promise of an authored route.
+
+`surface` controls definition discovery, while action `execution.sensitivity` and view
+`usage.classification` describe execution/data disclosure. These are independent declarations.
+`assertSurfaceDeclaration` is available from the root and `@fabricorg/platform/discovery`.
+Reasons are authored public-package metadata; authors must keep them free of secrets.
+
+No first-party compiler or generator artifact applies discovery filtering. All deliberately
+retain internal contracts for trusted assembly and worker integration; none implements external
+catalog disclosure. A usage contract or generated schema must not
+be served as an audience catalog without the internal-surface and audience filters above.
 
 ## License
 

package/dist/actions/index.cjs

@@ -1,28 +1,28 @@
 'use strict';
 
-var chunkMSABJAED_cjs = require('../chunk-MSABJAED.cjs');
+var chunkXCAOO6KG_cjs = require('../chunk-XCAOO6KG.cjs');
 
 
 
 Object.defineProperty(exports, "ACTOR_TYPES", {
   enumerable: true,
-  get: function () { return chunkMSABJAED_cjs.ACTOR_TYPES; }
+  get: function () { return chunkXCAOO6KG_cjs.ACTOR_TYPES; }
 });
 Object.defineProperty(exports, "assertActionId", {
   enumerable: true,
-  get: function () { return chunkMSABJAED_cjs.assertActionId; }
+  get: function () { return chunkXCAOO6KG_cjs.assertActionId; }
 });
 Object.defineProperty(exports, "assertActorType", {
   enumerable: true,
-  get: function () { return chunkMSABJAED_cjs.assertActorType; }
+  get: function () { return chunkXCAOO6KG_cjs.assertActorType; }
 });
 Object.defineProperty(exports, "createActionRegistry", {
   enumerable: true,
-  get: function () { return chunkMSABJAED_cjs.createActionRegistry; }
+  get: function () { return chunkXCAOO6KG_cjs.createActionRegistry; }
 });
 Object.defineProperty(exports, "isActorType", {
   enumerable: true,
-  get: function () { return chunkMSABJAED_cjs.isActorType; }
+  get: function () { return chunkXCAOO6KG_cjs.isActorType; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/actions/index.d.cts

@@ -1,3 +1,5 @@
+import { SurfaceDeclaration } from '../discovery/index.cjs';
+
 type ActionId = `${string}.${string}`;
 interface SchemaParseIssue {
     path: PropertyKey[];
@@ -38,7 +40,72 @@ interface ActionContext<TDb = unknown> {
     };
     db: TDb;
     services?: FabricRuntimeServices;
+    /**
+     * When the host admitted this invocation's submission through the
+     * action's `admitSubmission` check, read from the durable invocation
+     * record. Absent when the action declares no check, or when the runtime
+     * that built this context does not run declared admission checks (a host
+     * older than the one that introduced them). A handler whose action
+     * declares `admitSubmission` can refuse to run without it.
+     */
+    admittedAt?: Date;
 }
+/**
+ * Trusted facts a host gives an action's `admitSubmission` check. Scope and
+ * actor come from the host's authenticated submission, never from the
+ * parameters.
+ */
+interface ActionAdmissionInput {
+    readonly actionId: ActionId;
+    readonly tenantId: string;
+    readonly spaceId: string;
+    readonly actorId: string;
+    readonly actorType: ActorType;
+    /**
+     * The submitted parameters, unvalidated, as a copy made for this check.
+     * `@fabricorg/platform-host` records its own copy of the same value, taken
+     * before the check ran, and only if the check admits it; changing this
+     * copy changes nothing the host records.
+     */
+    readonly parameters: Readonly<Record<string, unknown>>;
+    /**
+     * Aborted when the host's admission deadline passes. Hosts pass an
+     * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles
+     * at or after the deadline, even one that settles before the abort.
+     */
+    readonly signal: ActionAdmissionSignal;
+}
+/**
+ * The part of an `AbortSignal` an admission check can rely on. Declared
+ * structurally so this module compiles without DOM or Node type libraries; a
+ * host passes a real `AbortSignal`, which satisfies it.
+ */
+interface ActionAdmissionSignal {
+    readonly aborted: boolean;
+    addEventListener(type: "abort", listener: () => void, options?: {
+        once?: boolean;
+    }): void;
+    removeEventListener(type: "abort", listener: () => void): void;
+}
+/**
+ * An admission check's answer. Only `{ admitted: true }` admits. A refusal's
+ * `code` must be a fixed code chosen by the action (lower-case first letter,
+ * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never
+ * a submitted value: the host puts it in the error it throws.
+ */
+type ActionAdmissionDecision = {
+    readonly admitted: true;
+} | {
+    readonly admitted: false;
+    readonly code: string;
+};
+/**
+ * Decides whether a submission may be recorded at all. A host that supports
+ * it runs the check after authorizing the submitter and before it writes
+ * anything durable for the submission; a refusal, a throw, a timeout or any
+ * answer other than `{ admitted: true }` refuses the submission.
+ */
+type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
 interface ActionResult {
     success: boolean;
     data?: Record<string, unknown>;
@@ -63,11 +130,21 @@ interface ActionStateMachineBinding {
     targetState: string | ((params: unknown) => string);
     getEntityId: (params: unknown) => string | undefined;
 }
-interface ActionDefinition<TDb = unknown> {
+interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
     actionId: ActionId;
     namespace: string;
     version: number;
     schema: SchemaValidator;
+    /**
+     * Optional check a host runs on every submission before it records
+     * anything durable for it (invocation, idempotency key, events, errors).
+     * Use it when parameters must be validated against trusted context, for
+     * example a secret reference the tenant's secret store must hold, before
+     * they may be persisted. `@fabricorg/platform-host` runs it from the
+     * release that introduced it; an older host ignores it, so a handler that
+     * relies on it should require `ActionContext.admittedAt`.
+     */
+    admitSubmission?: ActionAdmission;
     /** Optional validation contract for the public handler result data. */
     resultSchema?: SchemaValidator;
     handler?: ActionHandler<TDb>;
@@ -182,4 +259,4 @@ interface ActionRegistry<TDb = unknown> {
 }
 declare function createActionRegistry<TDb = unknown>(definitions?: readonly ActionDefinition<TDb>[]): ActionRegistry<TDb>;
 
-export { ACTOR_TYPES, type ActionCompletionMode, type ActionConnectivity, type ActionConsistency, type ActionContext, type ActionDataSensitivity, type ActionDefinition, type ActionExecutionContract, type ActionHandler, type ActionId, type ActionIdempotencyStance, type ActionRegistry, type ActionResult, type ActionStateMachineBinding, type ActionStatus, type ActorType, type AdapterStep, type AdapterStepRetryPolicy, type AuthorityMoment, type FabricRuntimeServices, type SagaChildActionInput, type SagaCompletion, type SagaCompletionEvent, type SagaContext, type SagaImplementation, type SagaRunChild, type SchemaParseIssue, type SchemaParseResult, type SchemaValidator, assertActionId, assertActorType, createActionRegistry, isActorType };
+export { ACTOR_TYPES, type ActionAdmission, type ActionAdmissionDecision, type ActionAdmissionInput, type ActionAdmissionSignal, type ActionCompletionMode, type ActionConnectivity, type ActionConsistency, type ActionContext, type ActionDataSensitivity, type ActionDefinition, type ActionExecutionContract, type ActionHandler, type ActionId, type ActionIdempotencyStance, type ActionRegistry, type ActionResult, type ActionStateMachineBinding, type ActionStatus, type ActorType, type AdapterStep, type AdapterStepRetryPolicy, type AuthorityMoment, type FabricRuntimeServices, type SagaChildActionInput, type SagaCompletion, type SagaCompletionEvent, type SagaContext, type SagaImplementation, type SagaRunChild, type SchemaParseIssue, type SchemaParseResult, type SchemaValidator, assertActionId, assertActorType, createActionRegistry, isActorType };

package/dist/actions/index.d.ts

@@ -1,3 +1,5 @@
+import { SurfaceDeclaration } from '../discovery/index.js';
+
 type ActionId = `${string}.${string}`;
 interface SchemaParseIssue {
     path: PropertyKey[];
@@ -38,7 +40,72 @@ interface ActionContext<TDb = unknown> {
     };
     db: TDb;
     services?: FabricRuntimeServices;
+    /**
+     * When the host admitted this invocation's submission through the
+     * action's `admitSubmission` check, read from the durable invocation
+     * record. Absent when the action declares no check, or when the runtime
+     * that built this context does not run declared admission checks (a host
+     * older than the one that introduced them). A handler whose action
+     * declares `admitSubmission` can refuse to run without it.
+     */
+    admittedAt?: Date;
 }
+/**
+ * Trusted facts a host gives an action's `admitSubmission` check. Scope and
+ * actor come from the host's authenticated submission, never from the
+ * parameters.
+ */
+interface ActionAdmissionInput {
+    readonly actionId: ActionId;
+    readonly tenantId: string;
+    readonly spaceId: string;
+    readonly actorId: string;
+    readonly actorType: ActorType;
+    /**
+     * The submitted parameters, unvalidated, as a copy made for this check.
+     * `@fabricorg/platform-host` records its own copy of the same value, taken
+     * before the check ran, and only if the check admits it; changing this
+     * copy changes nothing the host records.
+     */
+    readonly parameters: Readonly<Record<string, unknown>>;
+    /**
+     * Aborted when the host's admission deadline passes. Hosts pass an
+     * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles
+     * at or after the deadline, even one that settles before the abort.
+     */
+    readonly signal: ActionAdmissionSignal;
+}
+/**
+ * The part of an `AbortSignal` an admission check can rely on. Declared
+ * structurally so this module compiles without DOM or Node type libraries; a
+ * host passes a real `AbortSignal`, which satisfies it.
+ */
+interface ActionAdmissionSignal {
+    readonly aborted: boolean;
+    addEventListener(type: "abort", listener: () => void, options?: {
+        once?: boolean;
+    }): void;
+    removeEventListener(type: "abort", listener: () => void): void;
+}
+/**
+ * An admission check's answer. Only `{ admitted: true }` admits. A refusal's
+ * `code` must be a fixed code chosen by the action (lower-case first letter,
+ * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never
+ * a submitted value: the host puts it in the error it throws.
+ */
+type ActionAdmissionDecision = {
+    readonly admitted: true;
+} | {
+    readonly admitted: false;
+    readonly code: string;
+};
+/**
+ * Decides whether a submission may be recorded at all. A host that supports
+ * it runs the check after authorizing the submitter and before it writes
+ * anything durable for the submission; a refusal, a throw, a timeout or any
+ * answer other than `{ admitted: true }` refuses the submission.
+ */
+type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
 interface ActionResult {
     success: boolean;
     data?: Record<string, unknown>;
@@ -63,11 +130,21 @@ interface ActionStateMachineBinding {
     targetState: string | ((params: unknown) => string);
     getEntityId: (params: unknown) => string | undefined;
 }
-interface ActionDefinition<TDb = unknown> {
+interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
     actionId: ActionId;
     namespace: string;
     version: number;
     schema: SchemaValidator;
+    /**
+     * Optional check a host runs on every submission before it records
+     * anything durable for it (invocation, idempotency key, events, errors).
+     * Use it when parameters must be validated against trusted context, for
+     * example a secret reference the tenant's secret store must hold, before
+     * they may be persisted. `@fabricorg/platform-host` runs it from the
+     * release that introduced it; an older host ignores it, so a handler that
+     * relies on it should require `ActionContext.admittedAt`.
+     */
+    admitSubmission?: ActionAdmission;
     /** Optional validation contract for the public handler result data. */
     resultSchema?: SchemaValidator;
     handler?: ActionHandler<TDb>;
@@ -182,4 +259,4 @@ interface ActionRegistry<TDb = unknown> {
 }
 declare function createActionRegistry<TDb = unknown>(definitions?: readonly ActionDefinition<TDb>[]): ActionRegistry<TDb>;
 
-export { ACTOR_TYPES, type ActionCompletionMode, type ActionConnectivity, type ActionConsistency, type ActionContext, type ActionDataSensitivity, type ActionDefinition, type ActionExecutionContract, type ActionHandler, type ActionId, type ActionIdempotencyStance, type ActionRegistry, type ActionResult, type ActionStateMachineBinding, type ActionStatus, type ActorType, type AdapterStep, type AdapterStepRetryPolicy, type AuthorityMoment, type FabricRuntimeServices, type SagaChildActionInput, type SagaCompletion, type SagaCompletionEvent, type SagaContext, type SagaImplementation, type SagaRunChild, type SchemaParseIssue, type SchemaParseResult, type SchemaValidator, assertActionId, assertActorType, createActionRegistry, isActorType };
+export { ACTOR_TYPES, type ActionAdmission, type ActionAdmissionDecision, type ActionAdmissionInput, type ActionAdmissionSignal, type ActionCompletionMode, type ActionConnectivity, type ActionConsistency, type ActionContext, type ActionDataSensitivity, type ActionDefinition, type ActionExecutionContract, type ActionHandler, type ActionId, type ActionIdempotencyStance, type ActionRegistry, type ActionResult, type ActionStateMachineBinding, type ActionStatus, type ActorType, type AdapterStep, type AdapterStepRetryPolicy, type AuthorityMoment, type FabricRuntimeServices, type SagaChildActionInput, type SagaCompletion, type SagaCompletionEvent, type SagaContext, type SagaImplementation, type SagaRunChild, type SchemaParseIssue, type SchemaParseResult, type SchemaValidator, assertActionId, assertActorType, createActionRegistry, isActorType };

package/dist/actions/index.js

@@ -1,3 +1,3 @@
-export { ACTOR_TYPES, assertActionId, assertActorType, createActionRegistry, isActorType } from '../chunk-2W6FORTE.js';
+export { ACTOR_TYPES, assertActionId, assertActorType, createActionRegistry, isActorType } from '../chunk-6QX4I45I.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/certification/index.cjs

@@ -1,25 +1,26 @@
 'use strict';
 
-var chunkPFKTD7V5_cjs = require('../chunk-PFKTD7V5.cjs');
-require('../chunk-ZBXFRJON.cjs');
-require('../chunk-KIVQBZOA.cjs');
+var chunkMCWSUGB3_cjs = require('../chunk-MCWSUGB3.cjs');
+require('../chunk-WQ3BYI7T.cjs');
+require('../chunk-DBTAUI6C.cjs');
 require('../chunk-IFW43ELT.cjs');
-require('../chunk-CXR6KEKQ.cjs');
+require('../chunk-SNTV45LH.cjs');
+require('../chunk-D4SWRBUH.cjs');
 require('../chunk-2AE6TMAX.cjs');
 
 
 
 Object.defineProperty(exports, "STRICT_EXECUTION_CONTRACT_PROFILE", {
   enumerable: true,
-  get: function () { return chunkPFKTD7V5_cjs.STRICT_EXECUTION_CONTRACT_PROFILE; }
+  get: function () { return chunkMCWSUGB3_cjs.STRICT_EXECUTION_CONTRACT_PROFILE; }
 });
 Object.defineProperty(exports, "STRICT_EXECUTION_CONTRACT_PROFILE_ID", {
   enumerable: true,
-  get: function () { return chunkPFKTD7V5_cjs.STRICT_EXECUTION_CONTRACT_PROFILE_ID; }
+  get: function () { return chunkMCWSUGB3_cjs.STRICT_EXECUTION_CONTRACT_PROFILE_ID; }
 });
 Object.defineProperty(exports, "executionContractProfile", {
   enumerable: true,
-  get: function () { return chunkPFKTD7V5_cjs.executionContractProfile; }
+  get: function () { return chunkMCWSUGB3_cjs.executionContractProfile; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/certification/index.d.cts

@@ -1,6 +1,7 @@
 import { ActionCompletionMode } from '../actions/index.cjs';
 import { ModuleManifest } from '../manifest/index.cjs';
 import { FabricModule } from '../modules/index.cjs';
+import '../discovery/index.cjs';
 import '../objects/index.cjs';
 import '../policies/index.cjs';
 import '../state-machines/index.cjs';

package/dist/certification/index.d.ts

@@ -1,6 +1,7 @@
 import { ActionCompletionMode } from '../actions/index.js';
 import { ModuleManifest } from '../manifest/index.js';
 import { FabricModule } from '../modules/index.js';
+import '../discovery/index.js';
 import '../objects/index.js';
 import '../policies/index.js';
 import '../state-machines/index.js';

package/dist/certification/index.js

@@ -1,8 +1,9 @@
-export { STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, executionContractProfile } from '../chunk-DDO4EQ2J.js';
-import '../chunk-MC3GSVJ6.js';
-import '../chunk-GRBZYDEV.js';
+export { STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, executionContractProfile } from '../chunk-EMSAFNPX.js';
+import '../chunk-PDN5DOLQ.js';
+import '../chunk-WNZP53GI.js';
 import '../chunk-ZAEVQSB5.js';
-import '../chunk-JG35DT2G.js';
+import '../chunk-MLBALEUR.js';
+import '../chunk-LFE74IJX.js';
 import '../chunk-B5DOGDPG.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/{chunk-VZ6C4LXC.cjs → chunk-45OKKLNY.cjs}

@@ -147,13 +147,21 @@ async function evaluatePolicyDefinitions(policies, ctx) {
   return outcomes;
 }
 async function evaluatePolicyDefinition(policy, ctx) {
-  if (policy.kind === "data") {
-    return evaluateDataPolicy(policy, ctx);
-  }
-  if (policy.kind === "code") {
-    return evaluateCodePolicy(policy, ctx);
-  }
-  return evaluateHybridPolicy(policy, ctx);
+  const authority = policy.authority ? { ...policy.authority } : void 0;
+  const outcome = policy.kind === "data" ? await evaluateDataPolicy(policy, ctx) : policy.kind === "code" ? await evaluateCodePolicy(policy, ctx) : await evaluateHybridPolicy(policy, ctx);
+  if (!authority) return outcome;
+  return {
+    ...outcome,
+    dispatchEvidence: {
+      ...outcome.dispatchEvidence ?? {
+        policyKind: policy.kind,
+        policyId: policy.policyId,
+        policyVersion: policy.policyVersion,
+        dispatchPath: []
+      },
+      authority
+    }
+  };
 }
 async function evaluateCodePolicy(policy, ctx) {
   const codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId ?? policy.policyId;
@@ -657,5 +665,5 @@ exports.evaluatePolicyDefinitions = evaluatePolicyDefinitions;
 exports.evaluateRegisteredPolicies = evaluateRegisteredPolicies;
 exports.validateDataPolicyDefinition = validateDataPolicyDefinition;
 exports.validatePolicyGuidance = validatePolicyGuidance;
-//# sourceMappingURL=chunk-VZ6C4LXC.cjs.map
-//# sourceMappingURL=chunk-VZ6C4LXC.cjs.map
+//# sourceMappingURL=chunk-45OKKLNY.cjs.map
+//# sourceMappingURL=chunk-45OKKLNY.cjs.map

package/dist/chunk-45OKKLNY.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../policies/index.ts"],"names":["result","passed"],"mappings":";;;AAUO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,kDAAA,CAAmD,IAAA,CAAK,QAAQ,CAAA,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AA8EO,SAAS,uBAAuB,QAAA,EAAmD;AACzF,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,IAAI,CAAC,aAAA,CAAc,QAAQ,CAAA,EAAG;AAC7B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,CAAC,4BAA4B,CAAA,EAAE;AAAA,EAC/D;AAEA,EAAA,IAAI,SAAS,OAAA,KAAY,MAAA,IAAa,OAAO,QAAA,CAAS,YAAY,QAAA,EAAU;AAC3E,IAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAAA,EAC7D;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAA,EAAG;AACvC,IAAA,MAAA,CAAO,KAAK,qCAAqC,CAAA;AAAA,EAClD,CAAA,MAAO;AACN,IAAA,QAAA,CAAS,SAAA,CAAU,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC3C,MAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AACzB,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,EAAsB,KAAK,CAAA,mBAAA,CAAqB,CAAA;AAC5D,QAAA;AAAA,MACD;AACA,MAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,IAAA,CAAK,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5D,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,EAAsB,KAAK,CAAA,iCAAA,CAAmC,CAAA;AAAA,MAC3E;AACA,MAAA,IAAI,KAAK,KAAA,KAAU,MAAA,IAAa,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC/D,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,EAAsB,KAAK,CAAA,qCAAA,CAAuC,CAAA;AAAA,MAC/E;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,iBAAiB,CAAA,EAAG;AAC/C,IAAA,MAAA,CAAO,KAAK,6CAA6C,CAAA;AAAA,EAC1D,CAAA,MAAO;AACN,IAAA,QAAA,CAAS,iBAAA,CAAkB,OAAA,CAAQ,CAAC,MAAA,EAAQ,KAAA,KAAU;AACrD,MAAA,MAAA,CAAO,IAAA,CAAK,GAAG,8BAAA,CAA+B,MAAA,EAAQ,KAAK,CAAC,CAAA;AAAA,IAC7D,CAAC,CAAA;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,MAAA,KAAW,GAAG,MAAA,EAAO;AAC7C;AAEA,SAAS,8BAAA,CAA+B,QAAiB,KAAA,EAAyB;AACjF,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,MAAA,GAAS,8BAA8B,KAAK,CAAA,CAAA,CAAA;AAElD,EAAA,IAAI,CAAC,aAAA,CAAc,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,CAAC,CAAA,EAAG,MAAM,CAAA,kBAAA,CAAoB,CAAA;AAAA,EACtC;AAEA,EAAA,IACC,MAAA,CAAO,SAAS,eAAA,IAChB,MAAA,CAAO,SAAS,UAAA,IAChB,MAAA,CAAO,SAAS,QAAA,EACf;AACD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,qDAAA,CAAuD,CAAA;AAAA,EAC7E;AACA,EAAA,IAAI,OAAO,MAAA,CAAO,KAAA,KAAU,YAAY,MAAA,CAAO,KAAA,CAAM,WAAW,CAAA,EAAG;AAClE,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,iCAAA,CAAmC,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,OAAO,WAAA,KAAgB,MAAA,IAAa,OAAO,MAAA,CAAO,gBAAgB,QAAA,EAAU;AAC/E,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,0CAAA,CAA4C,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,OAAO,oBAAA,KAAyB,MAAA,IAAa,OAAO,MAAA,CAAO,yBAAyB,SAAA,EAAW;AAClG,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,oDAAA,CAAsD,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,MAAA,CAAO,iBAAiB,MAAA,EAAW;AACtC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA,EAAG;AACxC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,2CAAA,CAA6C,CAAA;AAAA,IACnE,CAAA,MAAA,IAAW,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,CAAC,IAAA,KAAS,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,MAAA,KAAW,CAAC,CAAA,EAAG;AAC7F,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,iDAAA,CAAmD,CAAA;AAAA,IACzE;AAAA,EACD;AAEA,EAAA,IAAI,MAAA,CAAO,SAAS,eAAA,EAAiB;AACpC,IAAA,IAAI,OAAO,MAAA,CAAO,QAAA,KAAa,YAAY,MAAA,CAAO,QAAA,CAAS,WAAW,CAAA,EAAG;AACxE,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,sDAAA,CAAwD,CAAA;AAAA,IAC9E;AACA,IAAA,IAAI,OAAO,UAAA,KAAe,MAAA,IAAa,CAAC,aAAA,CAAc,MAAA,CAAO,UAAU,CAAA,EAAG;AACzE,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,0CAAA,CAA4C,CAAA;AAAA,IAClE;AAAA,EACD;AAEA,EAAA,IAAI,MAAA,CAAO,SAAS,UAAA,EAAY;AAC/B,IAAA,IAAI,OAAO,KAAA,KAAU,MAAA,IAAa,OAAO,MAAA,CAAO,UAAU,QAAA,EAAU;AACnE,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,oCAAA,CAAsC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,OAAO,MAAA,KAAW,MAAA,IAAa,CAAC,aAAA,CAAc,MAAA,CAAO,MAAM,CAAA,EAAG;AACjE,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,sCAAA,CAAwC,CAAA;AAAA,IAC9D;AAAA,EACD;AAEA,EAAA,OAAO,MAAA;AACR;AAEA,SAAS,cAAc,KAAA,EAAkD;AACxE,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC3E;AA8FA,IAAM,qBAAA,GAAwB,CAAA;AAC9B,IAAM,mCAAA,GAAsC,EAAA;AAC5C,IAAM,gCAAA,GAAmC,GAAA;AACzC,IAAM,6BAAA,GAAgC,EAAA;AACtC,IAAM,6BAAA,GAAgC,GAAA;AAEtC,IAAM,yBAAA,GAA4B,OAAO,MAAA,CAAO;AAAA,EAC/C,UAAA;AAAA,EACA,SAAA;AAAA,EACA,oBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,gCAAA,GAA4E,OAAO,MAAA,CAAO;AAAA,EAC/F,QAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,IAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,iBAAoD,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC,CAAA;AA8F1F,SAAS,oBAAA,CAAqB,UAAA,GAAyC,EAAC,EAAmB;AACjG,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA+B;AACpD,EAAA,MAAM,QAAA,GAAW,CAAC,SAAA,KAAqC;AACtD,IAAA,cAAA,CAAe,UAAU,QAAQ,CAAA;AACjC,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA;AAChD,IAAA,IAAI,QAAA,IAAY,aAAa,SAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,SAAA,CAAU,QAAQ,CAAA,+CAAA,CAAiD,CAAA;AACnK,IAAA,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAA,EAAU,SAAS,CAAA;AAAA,EAC3C,CAAA;AACA,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA,EAAY,QAAA,CAAS,SAAS,CAAA;AACtD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,SAAA,EAAW;AAC5B,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,QAAQ,CAAA;AAChD,MAAA,IAAI,CAAC,QAAA,EAAU,QAAA,CAAS,SAAS,CAAA;AAAA,WAAA,IACxB,QAAA,KAAa,WAAW,MAAM,IAAI,MAAM,CAAA,qCAAA,EAAwC,SAAA,CAAU,QAAQ,CAAA,+CAAA,CAAiD,CAAA;AAAA,IAC7J,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,QAAA,CAAS,IAAI,QAAQ,CAAA;AAAA,IAC5C,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAM;AAAA,GACtC;AACD;AAEA,eAAsB,0BAAA,CACrB,WACA,GAAA,EAC2B;AAC3B,EAAA,OAAO,yBAAA;AAAA,IACN,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc;AAAA,MAC5B,QAAA;AAAA,MACA,aAAA,EAAe,mBAAmB,QAAQ,CAAA;AAAA,MAC1C,IAAA,EAAM,MAAA;AAAA,MACN,qBAAA,EAAuB;AAAA,KACxB,CAAE,CAAA;AAAA,IACF;AAAA,GACD;AACD;AAEA,eAAsB,yBAAA,CACrB,UACA,GAAA,EAC2B;AAC3B,EAAA,MAAM,WAA4B,EAAC;AAEnC,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC9B,IAAA,cAAA,CAAe,OAAO,QAAQ,CAAA;AAC9B,IAAA,QAAA,CAAS,IAAA,CAAK,MAAM,wBAAA,CAAyB,MAAA,EAAQ,GAAG,CAAC,CAAA;AAAA,EAC1D;AAEA,EAAA,OAAO,QAAA;AACR;AAEA,eAAsB,wBAAA,CACrB,QACA,GAAA,EACyB;AAGzB,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA,GAAY,EAAE,GAAG,MAAA,CAAO,WAAU,GAAI,MAAA;AAC/D,EAAA,MAAM,OAAA,GACL,OAAO,IAAA,KAAS,MAAA,GACb,MAAM,kBAAA,CAAmB,MAAA,EAAQ,GAAG,CAAA,GACpC,MAAA,CAAO,SAAS,MAAA,GACf,MAAM,mBAAmB,MAAA,EAAQ,GAAG,IACpC,MAAM,oBAAA,CAAqB,QAAQ,GAAG,CAAA;AAC3C,EAAA,IAAI,CAAC,WAAW,OAAO,OAAA;AACvB,EAAA,OAAO;AAAA,IACN,GAAG,OAAA;AAAA,IACH,gBAAA,EAAkB;AAAA,MACjB,GAAI,QAAQ,gBAAA,IAAoB;AAAA,QAC/B,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,cAAc;AAAC,OAChB;AAAA,MACA;AAAA;AACD,GACD;AACD;AAEA,eAAe,kBAAA,CACd,QACA,GAAA,EACyB;AACzB,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,IAAyB,MAAA,CAAO,QAAA;AACrE,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,iBAAA,GAAoB,qBAAqB,CAAA;AAE/D,EAAA,IAAI,CAAC,SAAA,EAAW;AACf,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,sCAAsC,qBAAqB,CAAA,CAAA;AAAA,MACnE,QAAA,EAAU;AAAA,QACT,4BAAA,EAA8B;AAAA,OAC/B;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,iBAAA,EAAmB,qBAAA;AAAA,UACnB,QAAA,EAAU,qBAAA;AAAA,UACV,UAAA,EAAY;AAAA;AACb;AACD,KACD;AAAA,EACD;AAEA,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,SAAA,IAAa,SAAA,CAAU,gBAAgB,IAAA,EAAM;AAC7D,IAAA,MAAM,UAAA,GACL,CAAA,OAAA,EAAU,SAAA,CAAU,QAAQ,CAAA,gEAAA,CAAA;AAE7B,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,MAAA;AAAA,MACR,MAAA,EAAQ,UAAA;AAAA,MACR,QAAA,EAAU;AAAA,QACT,cAAc,SAAA,CAAU,QAAA;AAAA,QACxB,mBAAmB,SAAA,CAAU,OAAA;AAAA,QAC7B,cAAA,EAAgB;AAAA,OACjB;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,iBAAA,EAAmB,qBAAA;AAAA,UACnB,UAAU,SAAA,CAAU,QAAA;AAAA,UACpB,SAAS,SAAA,CAAU,OAAA;AAAA,UACnB,UAAA,EAAY,IAAA;AAAA,UACZ,OAAA,EAAS,IAAA;AAAA,UACT;AAAA;AACD;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AAC5C,EAAA,OAAO,gBAAA,CAAiB,QAAQ,OAAA,EAAS;AAAA,IACxC,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,IACrB,IAAA,EAAM;AAAA,MACL,iBAAA,EAAmB,qBAAA;AAAA,MACnB,UAAU,SAAA,CAAU,QAAA;AAAA,MACpB,SAAS,SAAA,CAAU,OAAA;AAAA,MACnB,UAAA,EAAY;AAAA;AACb,GACA,CAAA;AACF;AAEA,eAAe,oBAAA,CACd,QACA,GAAA,EACyB;AACzB,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,MAAA,EAAQ,GAAG,CAAA;AAClD,EAAA,MAAM,WAAW,MAAA,CAAO,QAAA;AACxB,EAAA,MAAM,gBAAA,GAAmB,QAAA,GACtB,uBAAA,CAAwB,MAAA,EAAQ,WAAA,EAAa,QAAQ,CAAA,GACrD,EAAE,cAAA,EAAgB,KAAA,EAAO,OAAA,EAAS,eAAA,EAAyB;AAE9D,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,gBAAA,CAAiB,cAAA,EAAgB;AAClD,IAAA,IAAI,QAAA,IAAY,YAAY,gBAAA,EAAkB;AAC7C,MAAA,OAAO;AAAA,QACN,GAAG,WAAA;AAAA,QACH,gBAAA,EAAkB;AAAA,UACjB,GAAG,WAAA,CAAY,gBAAA;AAAA,UACf,QAAA,EAAU;AAAA,YACT,IAAA,EAAM,KAAA;AAAA,YACN,OAAA,EAAS,eAAA;AAAA,YACT,MAAA,EAAQ,6CAAA;AAAA,YACR,YAAY,WAAA,CAAY,MAAA;AAAA,YACxB,mBAAmB,MAAA,CAAO,aAAA;AAAA,YAC1B,uBAAuB,QAAA,CAAS;AAAA;AACjC;AACD,OACD;AAAA,IACD;AAEA,IAAA,OAAO,WAAA;AAAA,EACR;AAEA,EAAA,MAAM,UAAA,GAAsC;AAAA,IAC3C,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,IAAA,EAAM,QAAA;AAAA,IACN,uBAAuB,QAAA,CAAS;AAAA,GACjC;AACA,EAAA,MAAM,WAAA,GAAc,MAAM,kBAAA,CAAmB,UAAA,EAAY,GAAG,CAAA;AAE5D,EAAA,OAAO,gBAAA,CAAiB,QAAQ,WAAA,EAAa;AAAA,IAC5C,GAAI,YAAY,gBAAA,IAAoB;AAAA,MACnC,UAAA,EAAY,QAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAA,EAAc,CAAC,MAAM;AAAA,KACtB;AAAA,IACA,UAAA,EAAY,QAAA;AAAA,IACZ,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAA,EAAc,CAAC,MAAA,EAAQ,UAAA,EAAY,MAAM,CAAA;AAAA,IACzC,IAAA,EAAM,YAAY,gBAAA,EAAkB,IAAA;AAAA,IACpC,QAAA,EAAU;AAAA,MACT,IAAA,EAAM,IAAA;AAAA,MACN,SAAS,gBAAA,CAAiB,OAAA;AAAA,MAC1B,MAAA,EAAQ,SAAS,MAAA,IAAU,4CAAA;AAAA,MAC3B,YAAY,WAAA,CAAY,MAAA;AAAA,MACxB,mBAAmB,MAAA,CAAO,aAAA;AAAA,MAC1B,uBAAuB,QAAA,CAAS;AAAA;AACjC,GACA,CAAA;AACF;AAEA,SAAS,uBAAA,CACR,MAAA,EACA,WAAA,EACA,QAAA,EACgF;AAChF,EAAA,MAAM,eAAA,GAAkB,SAAS,QAAA,IAAY;AAAA,IAC5C,aAAA;AAAA,IACA,yBAAA;AAAA,IACA;AAAA,GACD;AACA,EAAA,MAAM,gBAAA,GAAmB,WAAA,CAAY,gBAAA,EAAkB,IAAA,EAAM,gBAAA;AAE7D,EAAA,IAAI,qBAAqB,SAAA,EAAW;AACnC,IAAA,OAAO;AAAA,MACN,cAAA,EAAgB,eAAA,CAAgB,QAAA,CAAS,yBAAyB,CAAA;AAAA,MAClE,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,IAAI,qBAAqB,SAAA,EAAW;AACnC,IAAA,OAAO;AAAA,MACN,cAAA,EAAgB,eAAA,CAAgB,QAAA,CAAS,yBAAyB,CAAA;AAAA,MAClE,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,SAAA,IAAa,CAAC,QAAQ,OAAO,CAAA;AAC9D,EAAA,OAAO;AAAA,IACN,cAAA,EACC,MAAA,CAAO,IAAA,KAAS,QAAA,IAChB,eAAA,CAAgB,QAAA,CAAS,aAAa,CAAA,IACtC,eAAA,CAAgB,QAAA,CAAS,WAAA,CAAY,MAAM,CAAA;AAAA,IAC5C,OAAA,EAAS;AAAA,GACV;AACD;AAEA,SAAS,kBAAA,CAAmB,QAAiC,GAAA,EAAmC;AAC/F,EAAA,MAAM,aAAa,MAAA,CAAO,cAAA;AAE1B,EAAA,IAAI,CAAC,UAAA,EAAY;AAChB,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,mCAAA;AAAA,MACR,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,UAC1B,gBAAA,EAAkB,SAAA;AAAA,UAClB,kBAAkB;AAAC;AACpB;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,6BAA6B,UAAU,CAAA;AAC1D,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACtB,IAAA,OAAO;AAAA,MACN,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,MAAA,EAAQ,OAAA;AAAA,MACR,QAAQ,CAAA,gCAAA,EAAmC,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,MACvE,QAAA,EAAU;AAAA,QACT,kBAAkB,UAAA,CAAW;AAAA,OAC9B;AAAA,MACA,gBAAA,EAAkB;AAAA,QACjB,YAAY,MAAA,CAAO,IAAA;AAAA,QACnB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,eAAe,MAAA,CAAO,aAAA;AAAA,QACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,QACrB,IAAA,EAAM;AAAA,UACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,UAC1B,gBAAA,EAAkB,SAAA;AAAA,UAClB,kBAAkB,EAAC;AAAA,UACnB,kBAAkB,UAAA,CAAW;AAAA;AAC9B;AACD,KACD;AAAA,EACD;AAEA,EAAA,MAAM,WAAA,GAAc,WAAW,UAAA,CAAW,GAAA,CAAI,CAAC,SAAA,KAAc,2BAAA,CAA4B,SAAA,EAAW,GAAG,CAAC,CAAA;AACxG,EAAA,MAAM,mBAAmB,WAAA,CAAY,OAAA,CAAQ,CAAC,UAAA,KAAe,WAAW,QAAQ,CAAA;AAChF,EAAA,MAAM,kBAAkB,WAAA,CAAY,GAAA,CAAI,CAAC,UAAA,KAAe,WAAW,MAAM,CAAA;AACzE,EAAA,MAAM,SAAA,GACL,eAAA,CAAgB,IAAA,CAAK,CAACA,YAAWA,OAAAA,CAAO,MAAA,KAAW,OAAO,CAAA,IAC1D,gBAAgB,IAAA,CAAK,CAACA,OAAAA,KAAWA,OAAAA,CAAO,WAAW,MAAM,CAAA;AAC1D,EAAA,MAAM,MAAA,GAAS,SAAA,EAAW,MAAA,IAAU,UAAA,CAAW,aAAA,IAAiB,MAAA;AAEhE,EAAA,OAAO;AAAA,IACN,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,MAAA;AAAA,IACA,MAAA,EAAQ,SAAA,EAAW,MAAA,IAAU,UAAA,CAAW,MAAA;AAAA,IACxC,QAAA,EAAU;AAAA,MACT,cAAA,EAAgB,WAAW,UAAA,CAAW,MAAA;AAAA,MACtC,mBAAmB,SAAA,EAAW;AAAA,KAC/B;AAAA,IACA,gBAAA,EAAkB;AAAA,MACjB,YAAY,MAAA,CAAO,IAAA;AAAA,MACnB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,MACrB,IAAA,EAAM;AAAA,QACL,mBAAmB,MAAA,CAAO,aAAA;AAAA,QAC1B,gBAAA,EAAkB,WAAA;AAAA,QAClB;AAAA;AACD;AACD,GACD;AACD;AAEO,SAAS,6BACf,UAAA,EAC6B;AAC7B,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,IAAK,UAAA,CAAW,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAChF,IAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAAA,EAC7D,CAAA,MAAA,IAAW,UAAA,CAAW,UAAA,CAAW,MAAA,GAAS,mCAAA,EAAqC;AAC9E,IAAA,MAAA,CAAO,IAAA;AAAA,MACN,mCAAmC,mCAAmC,CAAA,qBAAA;AAAA,KACvE;AAAA,EACD;AAEA,EAAA,IAAI,WAAW,aAAA,IAAiB,CAAC,eAAe,QAAA,CAAS,UAAA,CAAW,aAAa,CAAA,EAAG;AACnF,IAAA,MAAA,CAAO,KAAK,4CAA4C,CAAA;AAAA,EACzD;AAEA,EAAA,IAAI,eAAA,GAAkB,CAAA;AACtB,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA,CAAW,UAAA,IAAc,EAAC,EAAG;AACpD,IAAA,2BAAA,CAA4B,SAAA,EAAW,MAAA,EAAQ,CAAA,EAAG,MAAM;AACvD,MAAA,eAAA,IAAmB,CAAA;AAAA,IACpB,CAAC,CAAA;AAAA,EACF;AAEA,EAAA,IAAI,kBAAkB,gCAAA,EAAkC;AACvD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,4BAAA,EAA+B,gCAAgC,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC/F;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,MAAA,KAAW,GAAG,MAAA,EAAO;AAC7C;AAEA,SAAS,2BAAA,CACR,SAAA,EACA,MAAA,EACA,KAAA,EACA,KAAA,EACO;AACP,EAAA,KAAA,EAAM;AAEN,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAChD,IAAA,MAAA,CAAO,KAAK,6BAA6B,CAAA;AACzC,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,QAAQ,qBAAA,EAAuB;AAClC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,gCAAA,EAAmC,qBAAqB,CAAA,CAAE,CAAA;AACtE,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,uBAAA,CAAwB,SAAA,CAAU,WAAW,CAAA,EAAG;AACpD,IAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAAA,EAC7D;AAEA,EAAA,4BAAA,CAA6B,YAAY,SAAA,GAAY,SAAA,CAAU,MAAA,GAAS,MAAA,EAAW,UAAU,MAAM,CAAA;AACnG,EAAA,4BAAA,CAA6B,YAAY,SAAA,GAAY,SAAA,CAAU,MAAA,GAAS,MAAA,EAAW,UAAU,MAAM,CAAA;AAEnG,EAAA,IAAI,UAAU,MAAA,KAAW,MAAA,IAAa,CAAC,uBAAA,CAAwB,SAAA,CAAU,MAAM,CAAA,EAAG;AACjF,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACjF;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,QAAA,EAAU;AAChC,IAAA,IAAI,CAAC,cAAA,CAAe,QAAA,CAAS,SAAA,CAAU,MAAM,CAAA,EAAG;AAC/C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,oCAAA,CAAsC,CAAA;AAAA,IACrF;AACA,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,WAAA,EAAa;AACnC,IAAA,YAAA,CAAa,UAAU,IAAA,EAAM,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,SAAS,MAAM,CAAA;AAC9E,IAAA,kBAAA,CAAmB,UAAU,QAAA,EAAU,SAAA,CAAU,KAAA,EAAO,SAAA,CAAU,aAAa,MAAM,CAAA;AACrF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,YAAA,EAAc;AACpC,IAAA,uBAAA,CAAwB,SAAA,CAAU,IAAA,EAAM,SAAA,CAAU,WAAA,EAAa,MAAM,CAAA;AACrE,IAAA,kBAAA,CAAmB,UAAU,QAAA,EAAU,SAAA,CAAU,KAAA,EAAO,SAAA,CAAU,aAAa,MAAM,CAAA;AACrF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,KAAA,IAAS,SAAA,CAAU,SAAS,KAAA,EAAO;AACzD,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,SAAA,CAAU,UAAU,CAAA,IAAK,SAAA,CAAU,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAC9E,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,8BAAA,CAAgC,CAAA;AAC9E,MAAA;AAAA,IACD;AAEA,IAAA,IAAI,SAAA,CAAU,UAAA,CAAW,MAAA,GAAS,mCAAA,EAAqC;AACtE,MAAA,MAAA,CAAO,IAAA;AAAA,QACN,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,sBAAA,EAAyB,mCAAmC,CAAA,iBAAA;AAAA,OAC/F;AAAA,IACD;AAEA,IAAA,KAAA,MAAW,KAAA,IAAS,UAAU,UAAA,EAAY;AACzC,MAAA,2BAAA,CAA4B,KAAA,EAAO,MAAA,EAAQ,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,IAC5D;AACA,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC7B,IAAA,2BAAA,CAA4B,SAAA,CAAU,SAAA,EAAW,MAAA,EAAQ,KAAA,GAAQ,GAAG,KAAK,CAAA;AACzE,IAAA;AAAA,EACD;AAEA,EAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,SAAA,CAAU,WAAW,CAAA,qBAAA,CAAuB,CAAA;AACtE;AAEA,SAAS,4BAAA,CACR,MAAA,EACA,SAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,WAAW,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC7D,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,6BAAA,CAA+B,CAAA;AAAA,EACxD;AACD;AAEA,SAAS,uBAAA,CACR,SAAA,EACA,WAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAChD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,gCAAA,CAAkC,CAAA;AACtE,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,MAAA,KAAW,YAAA,IAAgB,SAAA,CAAU,WAAW,SAAA,EAAW;AACxE,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,qCAAA,CAAuC,CAAA;AAAA,EAC5E;AAEA,EAAA,YAAA,CAAa,SAAA,CAAU,IAAA,EAAM,CAAA,UAAA,EAAa,WAAW,cAAc,MAAM,CAAA;AAEzE,EAAA,IAAI,SAAA,CAAU,WAAW,SAAA,IAAa,CAAC,0BAA0B,QAAA,CAAS,SAAA,CAAU,IAAI,CAAA,EAAG;AAC1F,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,iCAAA,CAAmC,CAAA;AAAA,EACxE;AACD;AAEA,SAAS,kBAAA,CACR,QAAA,EACA,KAAA,EACA,WAAA,EACA,MAAA,EACO;AACP,EAAA,IAAI,CAAC,gCAAA,CAAiC,QAAA,CAAS,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,yBAAA,CAA2B,CAAA;AAC/D,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,aAAa,QAAA,EAAU;AAC1B,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAChC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,2CAAA,CAA6C,CAAA;AACjF,IAAA;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,IAAK,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/E,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,WAAW,CAAA,2CAAA,CAA6C,CAAA;AAAA,EAClF;AACD;AAEA,SAAS,YAAA,CAAa,IAAA,EAAc,SAAA,EAAmB,MAAA,EAAwB;AAC9E,EAAA,IAAI,CAAC,uBAAA,CAAwB,IAAI,CAAA,EAAG;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,mCAAA,CAAqC,CAAA;AAC7D,IAAA;AAAA,EACD;AAEA,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,IAAI,QAAA,CAAS,SAAS,6BAAA,EAA+B;AACpD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,sBAAA,EAAyB,6BAA6B,CAAA,SAAA,CAAW,CAAA;AACzF,IAAA;AAAA,EACD;AAEA,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC/B,IAAA,IAAI,CAAC,0BAAA,CAA2B,IAAA,CAAK,OAAO,CAAA,EAAG;AAC9C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,iCAAA,CAAmC,CAAA;AAC3D,MAAA;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,WAAA,EAAa,aAAA,EAAe,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG;AAChE,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,kCAAA,CAAoC,CAAA;AAC5D,MAAA;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,oBAAoB,KAAA,EAA4C;AACxE,EAAA,IAAI,UAAU,IAAA,IAAQ,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,EAAW;AAC9E,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,IAAU,6BAAA;AACrD;AAEA,SAAS,wBAAwB,KAAA,EAAiC;AACjE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,MAAM,MAAA,GAAS,CAAA,IAAK,MAAM,MAAA,IAAU,6BAAA;AACzE;AAEA,SAAS,2BAAA,CACR,WACA,GAAA,EAC+E;AAC/E,EAAA,IAAI,SAAA,CAAU,SAAS,QAAA,EAAU;AAChC,IAAA,MAAMA,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAQ,UAAU,MAAA,KAAW,MAAA;AAAA,MAC7B,QAAQ,SAAA,CAAU,MAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACnB;AACA,IAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAM,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,KAAA,IAAS,SAAA,CAAU,SAAS,KAAA,EAAO;AACzD,IAAA,MAAM,gBAAA,GAAmB,UAAU,UAAA,CAAW,GAAA,CAAI,CAAC,KAAA,KAAU,2BAAA,CAA4B,KAAA,EAAO,GAAG,CAAC,CAAA;AACpG,IAAA,MAAMC,UACL,SAAA,CAAU,IAAA,KAAS,QAChB,gBAAA,CAAiB,KAAA,CAAM,CAAC,UAAA,KAAe,UAAA,CAAW,MAAA,CAAO,MAAM,IAC/D,gBAAA,CAAiB,IAAA,CAAK,CAAC,UAAA,KAAe,UAAA,CAAW,OAAO,MAAM,CAAA;AAClE,IAAA,MAAMD,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAAC,OAAAA;AAAA,MACA,QAAQA,OAAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,MACrE,MAAA,EAAQA,OAAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,KACxC;AAEA,IAAA,OAAO;AAAA,MACN,MAAA,EAAAD,OAAAA;AAAA,MACA,QAAA,EAAU,CAACA,OAAAA,EAAQ,GAAG,gBAAA,CAAiB,QAAQ,CAAC,UAAA,KAAe,UAAA,CAAW,QAAQ,CAAC;AAAA,KACpF;AAAA,EACD;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC7B,IAAA,MAAM,eAAA,GAAkB,2BAAA,CAA4B,SAAA,CAAU,SAAA,EAAW,GAAG,CAAA;AAC5E,IAAA,MAAMC,OAAAA,GAAS,CAAC,eAAA,CAAgB,MAAA,CAAO,MAAA;AACvC,IAAA,MAAMD,OAAAA,GAAS;AAAA,MACd,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAAC,OAAAA;AAAA,MACA,QAAQA,OAAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,MACrE,MAAA,EAAQA,OAAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,KACxC;AAEA,IAAA,OAAO,EAAE,QAAAD,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAAA,EAAQ,GAAG,eAAA,CAAgB,QAAQ,CAAA,EAAE;AAAA,EAClE;AAEA,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,WAAA,IAAe,SAAA,CAAU,SAAS,YAAA,EAAc;AACtE,IAAA,MAAMA,OAAAA,GAAoC;AAAA,MACzC,aAAa,SAAA,CAAU,WAAA;AAAA,MACvB,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT;AACA,IAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,QAAA,EAAU,CAACA,OAAM,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,MAAM,KAAA,GACL,SAAA,CAAU,IAAA,KAAS,WAAA,GAChB,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,SAAA,CAAU,IAAI,CAAA,GACvC,oBAAA,CAAqB,GAAA,EAAK,UAAU,IAAI,CAAA;AAC5C,EAAA,MAAM,WAAW,SAAA,CAAU,QAAA;AAC3B,EAAA,MAAM,WAAW,SAAA,CAAU,KAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAU,QAAQ,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS;AAAA,IACd,aAAa,SAAA,CAAU,WAAA;AAAA,IACvB,MAAA;AAAA,IACA,QAAQ,MAAA,GAAU,SAAA,CAAU,MAAA,IAAU,MAAA,GAAW,UAAU,MAAA,IAAU,OAAA;AAAA,IACrE,MAAA,EAAQ,MAAA,GAAS,MAAA,GAAY,SAAA,CAAU;AAAA,GACxC;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAC,MAAM,CAAA,EAAE;AACrC;AAEA,SAAS,gBAAA,CACR,MAAA,EACA,QAAA,EACA,QAAA,EACU;AACV,EAAA,QAAQ,QAAA;AAAU,IACjB,KAAK,QAAA;AACJ,MAAA,OAAO,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,MAAA,KAAW,EAAA;AAAA,IAC9D,KAAK,QAAA;AACJ,MAAA,OAAO,MAAA,KAAW,QAAA;AAAA,IACnB,KAAK,WAAA;AACJ,MAAA,OAAO,MAAA,KAAW,QAAA;AAAA,IACnB,KAAK,IAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,GAAS,QAAA;AAAA,IAC/E,KAAK,KAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,IAAU,QAAA;AAAA,IAChF,KAAK,IAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,GAAS,QAAA;AAAA,IAC/E,KAAK,KAAA;AACJ,MAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,QAAA,KAAa,YAAY,MAAA,IAAU,QAAA;AAAA;AAElF;AAEA,SAAS,oBAAA,CAAqB,KAAoB,SAAA,EAA+C;AAChG,EAAA,IAAI,SAAA,CAAU,WAAW,YAAA,EAAc;AACtC,IAAA,OAAO,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,SAAA,CAAU,IAAI,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAO,QAAA;AAAA,IACN;AAAA,MACC,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,oBAAoB,GAAA,CAAI,kBAAA;AAAA,MACxB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,MAAM,GAAA,CAAI;AAAA,KACX;AAAA,IACA,SAAA,CAAU;AAAA,GACX;AACD;AAEA,SAAS,QAAA,CAAS,QAAiB,IAAA,EAAuB;AACzD,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,IAAA,OAAO,MAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,KAAA,CAAM,GAAG,EAAE,MAAA,CAAgB,CAAC,SAAS,OAAA,KAAY;AAC5D,IAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC5C,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAQ,QAAoC,OAAO,CAAA;AAAA,EACpD,GAAG,MAAM,CAAA;AACV;AAEA,SAAS,gBAAA,CACR,MAAA,EACA,OAAA,EACA,gBAAA,EACgB;AAChB,EAAA,IAAI,OAAA,CAAQ,aAAa,MAAA,EAAW;AACnC,IAAA,MAAM,kBAAA,GAAqB,sBAAA,CAAuB,OAAA,CAAQ,QAAQ,CAAA;AAClE,IAAA,IAAI,CAAC,mBAAmB,KAAA,EAAO;AAC9B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,4BAAA,EAA+B,QAAQ,QAAQ,CAAA,EAAA,EAAK,mBAAmB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACzF;AAAA,IACD;AAAA,EACD;AAMA,EAAA,MAAM,MAAA,GAAS,QAAQ,gBAAA,EAAkB,MAAA;AACzC,EAAA,OAAO;AAAA,IACN,GAAG,OAAA;AAAA,IACH,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,YAAY,MAAA,CAAO,IAAA;AAAA,IACnB,QAAA,EAAU;AAAA,MACT,GAAI,OAAA,CAAQ,QAAA,IAAY,EAAC;AAAA,MACzB,YAAA,EAAc,gBAAA,CAAiB,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,QAAA;AAAA,MACzD,iBAAA,EAAmB,gBAAA,CAAiB,IAAA,EAAM,OAAA,IAAW,OAAA,CAAQ;AAAA,KAC9D;AAAA,IACA,kBAAkB,MAAA,GAAS,EAAE,GAAG,gBAAA,EAAkB,QAAO,GAAI;AAAA,GAC9D;AACD;AAEA,SAAS,mBAAmB,QAAA,EAA4B;AACvD,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA;AACpC,EAAA,OAAO,OAAO,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,KAAK,CAAC,CAAA;AACjD;AAEO,SAAS,wBAAwB,QAAA,EAAsD;AAC7F,EAAA,OACC,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,QAAQ,MAAA,KAAW,OAAO,CAAA,IACrD,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAEtD","file":"chunk-45OKKLNY.cjs","sourcesContent":["import type { ActionId, ActorType, FabricRuntimeServices } from \"../actions\";\n\nexport type PolicyEvaluationResult = \"pass\" | \"warn\" | \"block\";\n\nexport type PolicyKind = \"code\" | \"data\" | \"hybrid\";\n\nexport type PolicyId = `${string}.v${number}`;\n\nexport type PolicyEvaluationMode = \"preview\" | \"execute\";\n\nexport function assertPolicyId(policyId: string): asserts policyId is PolicyId {\n\tif (!/^[a-z][a-z0-9_-]*(\\.[a-z][a-z0-9_-]*)*\\.v[0-9]+$/.test(policyId)) {\n\t\tthrow new Error(`Invalid policy ID: ${policyId}`);\n\t}\n}\n\nexport interface PolicyContext<TDb = unknown> {\n\ttenantId: string;\n\tspaceId: string;\n\tactionInvocationId: string;\n\tactionId: string;\n\t/** Authenticated actor identity supplied by the host. Omitted only by legacy hosts and previews. */\n\tactorId?: string;\n\tactorType?: ActorType;\n\tparameters: unknown;\n\tdb: TDb;\n\tnow?: Date;\n\tmode?: PolicyEvaluationMode;\n\t/**\n\t * Optional runtime services bag, mirroring {@link FabricRuntimeServices} on\n\t * `ActionContext`. Lets the host inject dependencies (HTTP clients, secret\n\t * managers, external policy engines such as OPA, feature flags, etc.) that\n\t * a code policy evaluator may need without resorting to module-level\n\t * globals. The shape is opaque to the platform — adapters narrow it.\n\t */\n\tservices?: FabricRuntimeServices;\n\t/** Explicit code-policy catalog for this runtime; absence fails closed. */\n\tresolveCodePolicy?: (policyId: PolicyId) => PolicyEvaluator | undefined;\n}\n\nexport interface PolicyFact {\n\tname: string;\n\tvalue: unknown;\n\tlabel?: string;\n}\n\nexport type PolicyCorrectiveActionKind = \"invoke_action\" | \"navigate\" | \"manual\";\n\nexport interface PolicyCorrectiveActionBase {\n\tkind: PolicyCorrectiveActionKind;\n\tlabel: string;\n\tdescription?: string;\n\trequiresRole?: string[];\n\trequiresConfirmation?: boolean;\n}\n\nexport interface PolicyInvokeActionCorrectiveAction extends PolicyCorrectiveActionBase {\n\tkind: \"invoke_action\";\n\tactionId: ActionId;\n\tparameters?: Record<string, unknown>;\n}\n\nexport interface PolicyNavigateCorrectiveAction extends PolicyCorrectiveActionBase {\n\tkind: \"navigate\";\n\troute?: string;\n\ttarget?: {\n\t\tsurface?: string;\n\t\ttab?: string;\n\t\tfield?: string;\n\t};\n}\n\nexport interface PolicyManualCorrectiveAction extends PolicyCorrectiveActionBase {\n\tkind: \"manual\";\n}\n\nexport type PolicyCorrectiveAction =\n\t| PolicyInvokeActionCorrectiveAction\n\t| PolicyNavigateCorrectiveAction\n\t| PolicyManualCorrectiveAction;\n\nexport interface PolicyGuidance {\n\tsummary?: string;\n\tfactsUsed: PolicyFact[];\n\tcorrectiveActions: PolicyCorrectiveAction[];\n}\n\nexport interface PolicyGuidanceValidationResult {\n\tvalid: boolean;\n\terrors: string[];\n}\n\nexport function validatePolicyGuidance(guidance: unknown): PolicyGuidanceValidationResult {\n\tconst errors: string[] = [];\n\n\tif (!isPlainRecord(guidance)) {\n\t\treturn { valid: false, errors: [\"guidance must be an object\"] };\n\t}\n\n\tif (guidance.summary !== undefined && typeof guidance.summary !== \"string\") {\n\t\terrors.push(\"guidance.summary must be a string when present\");\n\t}\n\n\tif (!Array.isArray(guidance.factsUsed)) {\n\t\terrors.push(\"guidance.factsUsed must be an array\");\n\t} else {\n\t\tguidance.factsUsed.forEach((fact, index) => {\n\t\t\tif (!isPlainRecord(fact)) {\n\t\t\t\terrors.push(`guidance.factsUsed[${index}] must be an object`);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (typeof fact.name !== \"string\" || fact.name.length === 0) {\n\t\t\t\terrors.push(`guidance.factsUsed[${index}].name must be a non-empty string`);\n\t\t\t}\n\t\t\tif (fact.label !== undefined && typeof fact.label !== \"string\") {\n\t\t\t\terrors.push(`guidance.factsUsed[${index}].label must be a string when present`);\n\t\t\t}\n\t\t});\n\t}\n\n\tif (!Array.isArray(guidance.correctiveActions)) {\n\t\terrors.push(\"guidance.correctiveActions must be an array\");\n\t} else {\n\t\tguidance.correctiveActions.forEach((action, index) => {\n\t\t\terrors.push(...validatePolicyCorrectiveAction(action, index));\n\t\t});\n\t}\n\n\treturn { valid: errors.length === 0, errors };\n}\n\nfunction validatePolicyCorrectiveAction(action: unknown, index: number): string[] {\n\tconst errors: string[] = [];\n\tconst prefix = `guidance.correctiveActions[${index}]`;\n\n\tif (!isPlainRecord(action)) {\n\t\treturn [`${prefix} must be an object`];\n\t}\n\n\tif (\n\t\taction.kind !== \"invoke_action\" &&\n\t\taction.kind !== \"navigate\" &&\n\t\taction.kind !== \"manual\"\n\t) {\n\t\terrors.push(`${prefix}.kind must be \"invoke_action\" | \"navigate\" | \"manual\"`);\n\t}\n\tif (typeof action.label !== \"string\" || action.label.length === 0) {\n\t\terrors.push(`${prefix}.label must be a non-empty string`);\n\t}\n\tif (action.description !== undefined && typeof action.description !== \"string\") {\n\t\terrors.push(`${prefix}.description must be a string when present`);\n\t}\n\tif (action.requiresConfirmation !== undefined && typeof action.requiresConfirmation !== \"boolean\") {\n\t\terrors.push(`${prefix}.requiresConfirmation must be a boolean when present`);\n\t}\n\tif (action.requiresRole !== undefined) {\n\t\tif (!Array.isArray(action.requiresRole)) {\n\t\t\terrors.push(`${prefix}.requiresRole must be an array when present`);\n\t\t} else if (action.requiresRole.some((role) => typeof role !== \"string\" || role.length === 0)) {\n\t\t\terrors.push(`${prefix}.requiresRole must contain only non-empty strings`);\n\t\t}\n\t}\n\n\tif (action.kind === \"invoke_action\") {\n\t\tif (typeof action.actionId !== \"string\" || action.actionId.length === 0) {\n\t\t\terrors.push(`${prefix}.actionId must be a non-empty string for invoke_action`);\n\t\t}\n\t\tif (action.parameters !== undefined && !isPlainRecord(action.parameters)) {\n\t\t\terrors.push(`${prefix}.parameters must be an object when present`);\n\t\t}\n\t}\n\n\tif (action.kind === \"navigate\") {\n\t\tif (action.route !== undefined && typeof action.route !== \"string\") {\n\t\t\terrors.push(`${prefix}.route must be a string when present`);\n\t\t}\n\t\tif (action.target !== undefined && !isPlainRecord(action.target)) {\n\t\t\terrors.push(`${prefix}.target must be an object when present`);\n\t\t}\n\t}\n\n\treturn errors;\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport interface PolicyOutcome {\n\tpolicyId: PolicyId;\n\tpolicyVersion: number;\n\tpolicyKind?: PolicyKind;\n\tresult: PolicyEvaluationResult;\n\treason?: string;\n\tguidance?: PolicyGuidance;\n\tmetadata?: Record<string, unknown>;\n\tdispatchEvidence?: PolicyDispatchEvidence;\n}\n\nexport interface PolicyEvaluator<TDb = unknown> {\n\tpolicyId: PolicyId;\n\tversion: number;\n\tkind?: Extract<PolicyKind, \"code\">;\n\tpreviewSafe?: boolean;\n\tevaluate: (ctx: PolicyContext<TDb>) => Promise<PolicyOutcome>;\n}\n\nexport type DataPolicySource = \"parameters\" | \"context\";\n\nexport type DataPolicyLiteral = string | number | boolean | null;\n\nexport type DataPolicyComparisonOperator =\n\t| \"exists\"\n\t| \"equals\"\n\t| \"notEquals\"\n\t| \"gt\"\n\t| \"gte\"\n\t| \"lt\"\n\t| \"lte\";\n\nexport interface DataPolicySourceReference {\n\tsource: DataPolicySource;\n\tpath: string;\n}\n\nexport type DataPolicyCondition =\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"always\";\n\t\t\tresult: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"parameter\";\n\t\t\tpath: string;\n\t\t\toperator: DataPolicyComparisonOperator;\n\t\t\tvalue?: DataPolicyLiteral;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"comparison\";\n\t\t\tleft: DataPolicySourceReference;\n\t\t\toperator: DataPolicyComparisonOperator;\n\t\t\tvalue?: DataPolicyLiteral;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"all\" | \"any\";\n\t\t\tconditions: DataPolicyCondition[];\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t}\n\t| {\n\t\t\tconditionId: string;\n\t\t\ttype: \"not\";\n\t\t\tcondition: DataPolicyCondition;\n\t\t\tonPass?: PolicyEvaluationResult;\n\t\t\tonFail?: PolicyEvaluationResult;\n\t\t\treason?: string;\n\t\t};\n\nexport interface DataPolicyDefinition {\n\tconditions: DataPolicyCondition[];\n\tdefaultResult?: PolicyEvaluationResult;\n\treason?: string;\n}\n\nexport interface DataPolicyValidationResult {\n\tvalid: boolean;\n\terrors: string[];\n}\n\nconst DATA_POLICY_MAX_DEPTH = 5;\nconst DATA_POLICY_MAX_CONDITIONS_PER_NODE = 20;\nconst DATA_POLICY_MAX_TOTAL_CONDITIONS = 100;\nconst DATA_POLICY_MAX_PATH_SEGMENTS = 12;\nconst DATA_POLICY_MAX_STRING_LENGTH = 500;\n\nconst DATA_POLICY_CONTEXT_PATHS = Object.freeze([\n\t\"tenantId\",\n\t\"spaceId\",\n\t\"actionInvocationId\",\n\t\"actionId\",\n\t\"mode\",\n]);\n\nconst DATA_POLICY_COMPARISON_OPERATORS: readonly DataPolicyComparisonOperator[] = Object.freeze([\n\t\"exists\",\n\t\"equals\",\n\t\"notEquals\",\n\t\"gt\",\n\t\"gte\",\n\t\"lt\",\n\t\"lte\",\n]);\n\nconst POLICY_RESULTS: readonly PolicyEvaluationResult[] = Object.freeze([\"pass\", \"warn\", \"block\"]);\n\nexport interface PolicyFallbackDefinition {\n\tcodeEvaluatorPolicyId: PolicyId;\n\tonResults?: PolicyEvaluationResult[];\n\ttriggers?: PolicyFallbackTrigger[];\n\treason?: string;\n}\n\nexport type PolicyFallbackTrigger =\n\t| \"data_result\"\n\t| \"missing_data_definition\"\n\t| \"invalid_data_definition\";\n\nexport interface DataPolicyConditionResult {\n\tconditionId: string;\n\tpassed: boolean;\n\tresult: PolicyEvaluationResult;\n\treason?: string;\n}\n\n/**\n * Opaque, consumer-defined reference to the immutable policy authority or\n * snapshot a runtime policy definition was resolved from. Platform records it\n * in dispatch evidence and does not interpret it.\n */\nexport interface PolicyAuthorityReference {\n\tsnapshotId: string;\n\tcontentHash?: string;\n}\n\nexport interface RuntimePolicyDefinition {\n\tpolicyId: PolicyId;\n\tpolicyVersion: number;\n\tkind: PolicyKind;\n\t/** Snapshot/authority this definition came from; copied into dispatch evidence. */\n\tauthority?: PolicyAuthorityReference;\n\tdataDefinition?: DataPolicyDefinition;\n\tcodeEvaluatorPolicyId?: PolicyId;\n\tfallback?: PolicyFallbackDefinition;\n}\n\nexport interface PolicyDispatchEvidence {\n\tpolicyKind: PolicyKind;\n\tpolicyId?: PolicyId;\n\tpolicyVersion?: number;\n\t/** Snapshot/authority the evaluated definition was resolved from, when supplied. */\n\tauthority?: PolicyAuthorityReference;\n\tdispatchPath: Array<\"data\" | \"code\" | \"fallback\">;\n\tdata?: {\n\t\tdefinitionVersion: number;\n\t\tdefinitionStatus: \"evaluated\" | \"missing\" | \"invalid\";\n\t\tconditionResults: DataPolicyConditionResult[];\n\t\tvalidationErrors?: string[];\n\t};\n\tcode?: {\n\t\trequestedPolicyId?: PolicyId;\n\t\tpolicyId: PolicyId;\n\t\tversion?: number;\n\t\tregistered: boolean;\n\t\tskipped?: boolean;\n\t\tskipReason?: string;\n\t};\n\tfallback?: {\n\t\tused: boolean;\n\t\ttrigger: PolicyFallbackTrigger | \"not_triggered\";\n\t\treason: string;\n\t\tfromResult?: PolicyEvaluationResult;\n\t\tdefinitionVersion: number;\n\t\tcodeEvaluatorPolicyId: PolicyId;\n\t};\n\t/**\n\t * Provenance for the engine that produced this decision when a code\n\t * evaluator delegates to an external policy engine (OPA, Cedar, Cerbos,\n\t * Topaz, etc.). Fabric's `policyId` / `policyVersion` remain canonical for\n\t * audit; this block carries deployment provenance (decision path, bundle\n\t * revision, decision ID, input hash). Adapters populate it; the platform\n\t * keeps `metadata` open-ended so engine-specific typing can live in the\n\t * adapter package.\n\t */\n\tengine?: {\n\t\tname: string;\n\t\tversion?: string;\n\t\tmetadata?: Record<string, unknown>;\n\t};\n}\n\nexport interface PolicyRegistry {\n\tregister(evaluator: PolicyEvaluator): void;\n\tregisterIfMissing(evaluator: PolicyEvaluator): void;\n\tresolve(policyId: PolicyId): PolicyEvaluator | undefined;\n\tids(): PolicyId[];\n}\n\nexport function createPolicyRegistry(evaluators: readonly PolicyEvaluator[] = []): PolicyRegistry {\n\tconst policies = new Map<PolicyId, PolicyEvaluator>();\n\tconst register = (evaluator: PolicyEvaluator): void => {\n\t\tassertPolicyId(evaluator.policyId);\n\t\tconst existing = policies.get(evaluator.policyId);\n\t\tif (existing && existing !== evaluator) throw new Error(`Conflicting policy registration for \"${evaluator.policyId}\". A different evaluator is already registered.`);\n\t\tpolicies.set(evaluator.policyId, evaluator);\n\t};\n\tfor (const evaluator of evaluators) register(evaluator);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(evaluator) {\n\t\t\tconst existing = policies.get(evaluator.policyId);\n\t\t\tif (!existing) register(evaluator);\n\t\t\telse if (existing !== evaluator) throw new Error(`Conflicting policy registration for \"${evaluator.policyId}\". A different evaluator is already registered.`);\n\t\t},\n\t\tresolve: (policyId) => policies.get(policyId),\n\t\tids: () => Array.from(policies.keys()),\n\t};\n}\n\nexport async function evaluateRegisteredPolicies(\n\tpolicyIds: PolicyId[],\n\tctx: PolicyContext,\n): Promise<PolicyOutcome[]> {\n\treturn evaluatePolicyDefinitions(\n\t\tpolicyIds.map((policyId) => ({\n\t\t\tpolicyId,\n\t\t\tpolicyVersion: parsePolicyVersion(policyId),\n\t\t\tkind: \"code\",\n\t\t\tcodeEvaluatorPolicyId: policyId,\n\t\t})),\n\t\tctx,\n\t);\n}\n\nexport async function evaluatePolicyDefinitions(\n\tpolicies: RuntimePolicyDefinition[],\n\tctx: PolicyContext,\n): Promise<PolicyOutcome[]> {\n\tconst outcomes: PolicyOutcome[] = [];\n\n\tfor (const policy of policies) {\n\t\tassertPolicyId(policy.policyId);\n\t\toutcomes.push(await evaluatePolicyDefinition(policy, ctx));\n\t}\n\n\treturn outcomes;\n}\n\nexport async function evaluatePolicyDefinition(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\t// Copy before awaiting so a resolver that mutates or replaces a cached\n\t// definition mid-evaluation cannot change the authority this outcome records.\n\tconst authority = policy.authority ? { ...policy.authority } : undefined;\n\tconst outcome =\n\t\tpolicy.kind === \"data\"\n\t\t\t? await evaluateDataPolicy(policy, ctx)\n\t\t\t: policy.kind === \"code\"\n\t\t\t\t? await evaluateCodePolicy(policy, ctx)\n\t\t\t\t: await evaluateHybridPolicy(policy, ctx);\n\tif (!authority) return outcome;\n\treturn {\n\t\t...outcome,\n\t\tdispatchEvidence: {\n\t\t\t...(outcome.dispatchEvidence ?? {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [],\n\t\t\t}),\n\t\t\tauthority,\n\t\t},\n\t};\n}\n\nasync function evaluateCodePolicy(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tconst codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId ?? policy.policyId;\n\tconst evaluator = ctx.resolveCodePolicy?.(codeEvaluatorPolicyId);\n\n\tif (!evaluator) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: `No evaluator registered for policy ${codeEvaluatorPolicyId}`,\n\t\t\tmetadata: {\n\t\t\t\tmissingCodeEvaluatorPolicyId: codeEvaluatorPolicyId,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"code\"],\n\t\t\t\tcode: {\n\t\t\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tpolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tregistered: false,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tif (ctx.mode === \"preview\" && evaluator.previewSafe !== true) {\n\t\tconst skipReason =\n\t\t\t`Policy ${evaluator.policyId} skipped in preview mode ` +\n\t\t\t`(evaluator is not declared previewSafe)`;\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"warn\",\n\t\t\treason: skipReason,\n\t\t\tmetadata: {\n\t\t\t\tcodePolicyId: evaluator.policyId,\n\t\t\t\tcodePolicyVersion: evaluator.version,\n\t\t\t\tpreviewSkipped: true,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"code\"],\n\t\t\t\tcode: {\n\t\t\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\t\t\tpolicyId: evaluator.policyId,\n\t\t\t\t\tversion: evaluator.version,\n\t\t\t\t\tregistered: true,\n\t\t\t\t\tskipped: true,\n\t\t\t\t\tskipReason,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst outcome = await evaluator.evaluate(ctx);\n\treturn normalizeOutcome(policy, outcome, {\n\t\tpolicyKind: policy.kind,\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tdispatchPath: [\"code\"],\n\t\tcode: {\n\t\t\trequestedPolicyId: codeEvaluatorPolicyId,\n\t\t\tpolicyId: evaluator.policyId,\n\t\t\tversion: evaluator.version,\n\t\t\tregistered: true,\n\t\t},\n\t});\n}\n\nasync function evaluateHybridPolicy(\n\tpolicy: RuntimePolicyDefinition,\n\tctx: PolicyContext,\n): Promise<PolicyOutcome> {\n\tconst dataOutcome = evaluateDataPolicy(policy, ctx);\n\tconst fallback = policy.fallback;\n\tconst fallbackDecision = fallback\n\t\t? resolveFallbackDecision(policy, dataOutcome, fallback)\n\t\t: { shouldFallback: false, trigger: \"not_triggered\" as const };\n\n\tif (!fallback || !fallbackDecision.shouldFallback) {\n\t\tif (fallback && dataOutcome.dispatchEvidence) {\n\t\t\treturn {\n\t\t\t\t...dataOutcome,\n\t\t\t\tdispatchEvidence: {\n\t\t\t\t\t...dataOutcome.dispatchEvidence,\n\t\t\t\t\tfallback: {\n\t\t\t\t\t\tused: false,\n\t\t\t\t\t\ttrigger: \"not_triggered\",\n\t\t\t\t\t\treason: \"Data policy result did not trigger fallback\",\n\t\t\t\t\t\tfromResult: dataOutcome.result,\n\t\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn dataOutcome;\n\t}\n\n\tconst codePolicy: RuntimePolicyDefinition = {\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tkind: \"hybrid\",\n\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t};\n\tconst codeOutcome = await evaluateCodePolicy(codePolicy, ctx);\n\n\treturn normalizeOutcome(policy, codeOutcome, {\n\t\t...(codeOutcome.dispatchEvidence ?? {\n\t\t\tpolicyKind: \"hybrid\",\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tdispatchPath: [\"code\"],\n\t\t}),\n\t\tpolicyKind: \"hybrid\",\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tdispatchPath: [\"data\", \"fallback\", \"code\"],\n\t\tdata: dataOutcome.dispatchEvidence?.data,\n\t\tfallback: {\n\t\t\tused: true,\n\t\t\ttrigger: fallbackDecision.trigger,\n\t\t\treason: fallback.reason ?? \"Data policy result triggered code fallback\",\n\t\t\tfromResult: dataOutcome.result,\n\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\tcodeEvaluatorPolicyId: fallback.codeEvaluatorPolicyId,\n\t\t},\n\t});\n}\n\nfunction resolveFallbackDecision(\n\tpolicy: RuntimePolicyDefinition,\n\tdataOutcome: PolicyOutcome,\n\tfallback: PolicyFallbackDefinition,\n): { shouldFallback: boolean; trigger: PolicyFallbackTrigger | \"not_triggered\" } {\n\tconst allowedTriggers = fallback.triggers ?? [\n\t\t\"data_result\",\n\t\t\"missing_data_definition\",\n\t\t\"invalid_data_definition\",\n\t];\n\tconst definitionStatus = dataOutcome.dispatchEvidence?.data?.definitionStatus;\n\n\tif (definitionStatus === \"missing\") {\n\t\treturn {\n\t\t\tshouldFallback: allowedTriggers.includes(\"missing_data_definition\"),\n\t\t\ttrigger: \"missing_data_definition\",\n\t\t};\n\t}\n\n\tif (definitionStatus === \"invalid\") {\n\t\treturn {\n\t\t\tshouldFallback: allowedTriggers.includes(\"invalid_data_definition\"),\n\t\t\ttrigger: \"invalid_data_definition\",\n\t\t};\n\t}\n\n\tconst fallbackResults = fallback.onResults ?? [\"warn\", \"block\"];\n\treturn {\n\t\tshouldFallback:\n\t\t\tpolicy.kind === \"hybrid\" &&\n\t\t\tallowedTriggers.includes(\"data_result\") &&\n\t\t\tfallbackResults.includes(dataOutcome.result),\n\t\ttrigger: \"data_result\",\n\t};\n}\n\nfunction evaluateDataPolicy(policy: RuntimePolicyDefinition, ctx: PolicyContext): PolicyOutcome {\n\tconst definition = policy.dataDefinition;\n\n\tif (!definition) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: \"Data policy definition is missing\",\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"data\"],\n\t\t\t\tdata: {\n\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\tdefinitionStatus: \"missing\",\n\t\t\t\t\tconditionResults: [],\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst validation = validateDataPolicyDefinition(definition);\n\tif (!validation.valid) {\n\t\treturn {\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tpolicyKind: policy.kind,\n\t\t\tresult: \"block\",\n\t\t\treason: `Invalid data policy definition: ${validation.errors.join(\"; \")}`,\n\t\t\tmetadata: {\n\t\t\t\tvalidationErrors: validation.errors,\n\t\t\t},\n\t\t\tdispatchEvidence: {\n\t\t\t\tpolicyKind: policy.kind,\n\t\t\t\tpolicyId: policy.policyId,\n\t\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\t\tdispatchPath: [\"data\"],\n\t\t\t\tdata: {\n\t\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\t\tdefinitionStatus: \"invalid\",\n\t\t\t\t\tconditionResults: [],\n\t\t\t\t\tvalidationErrors: validation.errors,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\tconst evaluations = definition.conditions.map((condition) => evaluateDataPolicyCondition(condition, ctx));\n\tconst conditionResults = evaluations.flatMap((evaluation) => evaluation.evidence);\n\tconst topLevelResults = evaluations.map((evaluation) => evaluation.result);\n\tconst aggregate =\n\t\ttopLevelResults.find((result) => result.result === \"block\") ??\n\t\ttopLevelResults.find((result) => result.result === \"warn\");\n\tconst result = aggregate?.result ?? definition.defaultResult ?? \"pass\";\n\n\treturn {\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tpolicyKind: policy.kind,\n\t\tresult,\n\t\treason: aggregate?.reason ?? definition.reason,\n\t\tmetadata: {\n\t\t\tconditionCount: definition.conditions.length,\n\t\t\tfailedConditionId: aggregate?.conditionId,\n\t\t},\n\t\tdispatchEvidence: {\n\t\t\tpolicyKind: policy.kind,\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tdispatchPath: [\"data\"],\n\t\t\tdata: {\n\t\t\t\tdefinitionVersion: policy.policyVersion,\n\t\t\t\tdefinitionStatus: \"evaluated\",\n\t\t\t\tconditionResults,\n\t\t\t},\n\t\t},\n\t};\n}\n\nexport function validateDataPolicyDefinition(\n\tdefinition: DataPolicyDefinition,\n): DataPolicyValidationResult {\n\tconst errors: string[] = [];\n\n\tif (!Array.isArray(definition.conditions) || definition.conditions.length === 0) {\n\t\terrors.push(\"conditions must contain at least one condition\");\n\t} else if (definition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {\n\t\terrors.push(\n\t\t\t`conditions must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} top-level conditions`,\n\t\t);\n\t}\n\n\tif (definition.defaultResult && !POLICY_RESULTS.includes(definition.defaultResult)) {\n\t\terrors.push(\"defaultResult must be pass, warn, or block\");\n\t}\n\n\tlet totalConditions = 0;\n\tfor (const condition of definition.conditions ?? []) {\n\t\tvalidateDataPolicyCondition(condition, errors, 1, () => {\n\t\t\ttotalConditions += 1;\n\t\t});\n\t}\n\n\tif (totalConditions > DATA_POLICY_MAX_TOTAL_CONDITIONS) {\n\t\terrors.push(`policy must contain at most ${DATA_POLICY_MAX_TOTAL_CONDITIONS} total conditions`);\n\t}\n\n\treturn { valid: errors.length === 0, errors };\n}\n\nfunction validateDataPolicyCondition(\n\tcondition: DataPolicyCondition,\n\terrors: string[],\n\tdepth: number,\n\tcount: () => void,\n): void {\n\tcount();\n\n\tif (!condition || typeof condition !== \"object\") {\n\t\terrors.push(\"condition must be an object\");\n\t\treturn;\n\t}\n\n\tif (depth > DATA_POLICY_MAX_DEPTH) {\n\t\terrors.push(`condition depth must not exceed ${DATA_POLICY_MAX_DEPTH}`);\n\t\treturn;\n\t}\n\n\tif (!isNonEmptyBoundedString(condition.conditionId)) {\n\t\terrors.push(\"conditionId must be a non-empty bounded string\");\n\t}\n\n\tvalidateOptionalPolicyResult(\"onPass\" in condition ? condition.onPass : undefined, \"onPass\", errors);\n\tvalidateOptionalPolicyResult(\"onFail\" in condition ? condition.onFail : undefined, \"onFail\", errors);\n\n\tif (condition.reason !== undefined && !isNonEmptyBoundedString(condition.reason)) {\n\t\terrors.push(`condition ${condition.conditionId} reason must be a bounded string`);\n\t}\n\n\tif (condition.type === \"always\") {\n\t\tif (!POLICY_RESULTS.includes(condition.result)) {\n\t\t\terrors.push(`condition ${condition.conditionId} result must be pass, warn, or block`);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (condition.type === \"parameter\") {\n\t\tvalidatePath(condition.path, `condition ${condition.conditionId} path`, errors);\n\t\tvalidateComparison(condition.operator, condition.value, condition.conditionId, errors);\n\t\treturn;\n\t}\n\n\tif (condition.type === \"comparison\") {\n\t\tvalidateSourceReference(condition.left, condition.conditionId, errors);\n\t\tvalidateComparison(condition.operator, condition.value, condition.conditionId, errors);\n\t\treturn;\n\t}\n\n\tif (condition.type === \"all\" || condition.type === \"any\") {\n\t\tif (!Array.isArray(condition.conditions) || condition.conditions.length === 0) {\n\t\t\terrors.push(`condition ${condition.conditionId} must contain child conditions`);\n\t\t\treturn;\n\t\t}\n\n\t\tif (condition.conditions.length > DATA_POLICY_MAX_CONDITIONS_PER_NODE) {\n\t\t\terrors.push(\n\t\t\t\t`condition ${condition.conditionId} must contain at most ${DATA_POLICY_MAX_CONDITIONS_PER_NODE} child conditions`,\n\t\t\t);\n\t\t}\n\n\t\tfor (const child of condition.conditions) {\n\t\t\tvalidateDataPolicyCondition(child, errors, depth + 1, count);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (condition.type === \"not\") {\n\t\tvalidateDataPolicyCondition(condition.condition, errors, depth + 1, count);\n\t\treturn;\n\t}\n\n\terrors.push(`condition ${condition.conditionId} has unsupported type`);\n}\n\nfunction validateOptionalPolicyResult(\n\tresult: PolicyEvaluationResult | undefined,\n\tfieldName: string,\n\terrors: string[],\n): void {\n\tif (result !== undefined && !POLICY_RESULTS.includes(result)) {\n\t\terrors.push(`${fieldName} must be pass, warn, or block`);\n\t}\n}\n\nfunction validateSourceReference(\n\treference: DataPolicySourceReference,\n\tconditionId: string,\n\terrors: string[],\n): void {\n\tif (!reference || typeof reference !== \"object\") {\n\t\terrors.push(`condition ${conditionId} left must be a source reference`);\n\t\treturn;\n\t}\n\n\tif (reference.source !== \"parameters\" && reference.source !== \"context\") {\n\t\terrors.push(`condition ${conditionId} source must be parameters or context`);\n\t}\n\n\tvalidatePath(reference.path, `condition ${conditionId} left.path`, errors);\n\n\tif (reference.source === \"context\" && !DATA_POLICY_CONTEXT_PATHS.includes(reference.path)) {\n\t\terrors.push(`condition ${conditionId} uses an unsupported context path`);\n\t}\n}\n\nfunction validateComparison(\n\toperator: DataPolicyComparisonOperator,\n\tvalue: DataPolicyLiteral | undefined,\n\tconditionId: string,\n\terrors: string[],\n): void {\n\tif (!DATA_POLICY_COMPARISON_OPERATORS.includes(operator)) {\n\t\terrors.push(`condition ${conditionId} has unsupported operator`);\n\t\treturn;\n\t}\n\n\tif (operator === \"exists\") {\n\t\treturn;\n\t}\n\n\tif (!isDataPolicyLiteral(value)) {\n\t\terrors.push(`condition ${conditionId} comparison value must be a bounded literal`);\n\t\treturn;\n\t}\n\n\tif ([\"gt\", \"gte\", \"lt\", \"lte\"].includes(operator) && typeof value !== \"number\") {\n\t\terrors.push(`condition ${conditionId} numeric comparison requires a number value`);\n\t}\n}\n\nfunction validatePath(path: string, fieldName: string, errors: string[]): void {\n\tif (!isNonEmptyBoundedString(path)) {\n\t\terrors.push(`${fieldName} must be a non-empty bounded string`);\n\t\treturn;\n\t}\n\n\tconst segments = path.split(\".\");\n\tif (segments.length > DATA_POLICY_MAX_PATH_SEGMENTS) {\n\t\terrors.push(`${fieldName} must contain at most ${DATA_POLICY_MAX_PATH_SEGMENTS} segments`);\n\t\treturn;\n\t}\n\n\tfor (const segment of segments) {\n\t\tif (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(segment)) {\n\t\t\terrors.push(`${fieldName} contains an invalid path segment`);\n\t\t\treturn;\n\t\t}\n\n\t\tif ([\"__proto__\", \"constructor\", \"prototype\"].includes(segment)) {\n\t\t\terrors.push(`${fieldName} contains a forbidden path segment`);\n\t\t\treturn;\n\t\t}\n\t}\n}\n\nfunction isDataPolicyLiteral(value: unknown): value is DataPolicyLiteral {\n\tif (value === null || typeof value === \"number\" || typeof value === \"boolean\") {\n\t\treturn true;\n\t}\n\n\treturn typeof value === \"string\" && value.length <= DATA_POLICY_MAX_STRING_LENGTH;\n}\n\nfunction isNonEmptyBoundedString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.length > 0 && value.length <= DATA_POLICY_MAX_STRING_LENGTH;\n}\n\nfunction evaluateDataPolicyCondition(\n\tcondition: DataPolicyCondition,\n\tctx: PolicyContext,\n): { result: DataPolicyConditionResult; evidence: DataPolicyConditionResult[] } {\n\tif (condition.type === \"always\") {\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed: condition.result === \"pass\",\n\t\t\tresult: condition.result,\n\t\t\treason: condition.reason,\n\t\t};\n\t\treturn { result, evidence: [result] };\n\t}\n\n\tif (condition.type === \"all\" || condition.type === \"any\") {\n\t\tconst childEvaluations = condition.conditions.map((child) => evaluateDataPolicyCondition(child, ctx));\n\t\tconst passed =\n\t\t\tcondition.type === \"all\"\n\t\t\t\t? childEvaluations.every((evaluation) => evaluation.result.passed)\n\t\t\t\t: childEvaluations.some((evaluation) => evaluation.result.passed);\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed,\n\t\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\t\treason: passed ? undefined : condition.reason,\n\t\t};\n\n\t\treturn {\n\t\t\tresult,\n\t\t\tevidence: [result, ...childEvaluations.flatMap((evaluation) => evaluation.evidence)],\n\t\t};\n\t}\n\n\tif (condition.type === \"not\") {\n\t\tconst childEvaluation = evaluateDataPolicyCondition(condition.condition, ctx);\n\t\tconst passed = !childEvaluation.result.passed;\n\t\tconst result = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed,\n\t\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\t\treason: passed ? undefined : condition.reason,\n\t\t};\n\n\t\treturn { result, evidence: [result, ...childEvaluation.evidence] };\n\t}\n\n\tif (condition.type !== \"parameter\" && condition.type !== \"comparison\") {\n\t\tconst result: DataPolicyConditionResult = {\n\t\t\tconditionId: condition.conditionId,\n\t\t\tpassed: false,\n\t\t\tresult: \"block\",\n\t\t\treason: \"Unsupported data policy condition type\",\n\t\t};\n\t\treturn { result, evidence: [result] };\n\t}\n\n\tconst value =\n\t\tcondition.type === \"parameter\"\n\t\t\t? readPath(ctx.parameters, condition.path)\n\t\t\t: readDataPolicySource(ctx, condition.left);\n\tconst operator = condition.operator;\n\tconst expected = condition.value;\n\tconst passed = evaluateOperator(value, operator, expected);\n\tconst result = {\n\t\tconditionId: condition.conditionId,\n\t\tpassed,\n\t\tresult: passed ? (condition.onPass ?? \"pass\") : (condition.onFail ?? \"block\"),\n\t\treason: passed ? undefined : condition.reason,\n\t};\n\treturn { result, evidence: [result] };\n}\n\nfunction evaluateOperator(\n\tactual: unknown,\n\toperator: DataPolicyComparisonOperator,\n\texpected: unknown,\n): boolean {\n\tswitch (operator) {\n\t\tcase \"exists\":\n\t\t\treturn actual !== undefined && actual !== null && actual !== \"\";\n\t\tcase \"equals\":\n\t\t\treturn actual === expected;\n\t\tcase \"notEquals\":\n\t\t\treturn actual !== expected;\n\t\tcase \"gt\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual > expected;\n\t\tcase \"gte\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual >= expected;\n\t\tcase \"lt\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual < expected;\n\t\tcase \"lte\":\n\t\t\treturn typeof actual === \"number\" && typeof expected === \"number\" && actual <= expected;\n\t}\n}\n\nfunction readDataPolicySource(ctx: PolicyContext, reference: DataPolicySourceReference): unknown {\n\tif (reference.source === \"parameters\") {\n\t\treturn readPath(ctx.parameters, reference.path);\n\t}\n\n\treturn readPath(\n\t\t{\n\t\t\ttenantId: ctx.tenantId,\n\t\t\tspaceId: ctx.spaceId,\n\t\t\tactionInvocationId: ctx.actionInvocationId,\n\t\t\tactionId: ctx.actionId,\n\t\t\tmode: ctx.mode,\n\t\t},\n\t\treference.path,\n\t);\n}\n\nfunction readPath(source: unknown, path: string): unknown {\n\tif (!source || typeof source !== \"object\") {\n\t\treturn undefined;\n\t}\n\n\treturn path.split(\".\").reduce<unknown>((current, segment) => {\n\t\tif (!current || typeof current !== \"object\") {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn (current as Record<string, unknown>)[segment];\n\t}, source);\n}\n\nfunction normalizeOutcome(\n\tpolicy: RuntimePolicyDefinition,\n\toutcome: PolicyOutcome,\n\tdispatchEvidence: PolicyDispatchEvidence,\n): PolicyOutcome {\n\tif (outcome.guidance !== undefined) {\n\t\tconst guidanceValidation = validatePolicyGuidance(outcome.guidance);\n\t\tif (!guidanceValidation.valid) {\n\t\t\tthrow new Error(\n\t\t\t\t`Invalid guidance for policy ${outcome.policyId}: ${guidanceValidation.errors.join(\"; \")}`,\n\t\t\t);\n\t\t}\n\t}\n\n\t// The platform owns the dispatch envelope (kind, id, version, path,\n\t// data/code/fallback blocks). Engine provenance is evaluator-controlled —\n\t// preserve it so BYO-engine adapters (OPA, Cedar, ...) can attach decision\n\t// path, bundle revision, decision ID, input hash, etc.\n\tconst engine = outcome.dispatchEvidence?.engine;\n\treturn {\n\t\t...outcome,\n\t\tpolicyId: policy.policyId,\n\t\tpolicyVersion: policy.policyVersion,\n\t\tpolicyKind: policy.kind,\n\t\tmetadata: {\n\t\t\t...(outcome.metadata ?? {}),\n\t\t\tcodePolicyId: dispatchEvidence.code?.policyId ?? outcome.policyId,\n\t\t\tcodePolicyVersion: dispatchEvidence.code?.version ?? outcome.policyVersion,\n\t\t},\n\t\tdispatchEvidence: engine ? { ...dispatchEvidence, engine } : dispatchEvidence,\n\t};\n}\n\nfunction parsePolicyVersion(policyId: PolicyId): number {\n\tconst segments = policyId.split(\".v\");\n\treturn Number(segments[segments.length - 1] ?? 1);\n}\n\nexport function aggregatePolicyOutcomes(outcomes: PolicyOutcome[]): PolicyOutcome | undefined {\n\treturn (\n\t\toutcomes.find((outcome) => outcome.result === \"block\") ??\n\t\toutcomes.find((outcome) => outcome.result === \"warn\")\n\t);\n}\n"]}