@fabricorg/policy-opa 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# @fabricorg/policy-opa
+
+## 0.1.0 — 2026-05-16
+
+### Initial release
+
+The official Open Policy Agent (OPA) adapter for `@fabricorg/platform`. Wraps a Rego decision behind Fabric's `PolicyEvaluator` contract so a tenant or vertical can centralize compliance rules in Rego without giving up Fabric's canonical audit identity.
+
+- **`createOpaPolicyEvaluator({ binding, buildInput, serviceKey?, onError?, previewSafe?, engineVersion?, mapDecision?, hashInput? })`** — returns a `PolicyEvaluator` ready to `registerPolicy()`.
+- **`OpaPolicyBinding`** — typed pair of `{ policyId, version, decisionPath, regoPackage? }` for the vertical manifest. Keeps Fabric platform identity and OPA artifact paths aligned in one place.
+- **Decision shape (`OpaDecision`)** — Rego "house style" the adapter validates: `result` (required, tri-state), `reason`, `conditionResults[]`, `factsUsed`, `obligations`. Per-condition shape preserves the same evidence granularity Fabric's data policies provide.
+- **Engine evidence** — populates `PolicyDispatchEvidence.engine` with `name: "opa"`, optional `version`, and `metadata.{ decisionPath, regoPackage, inputHash, conditionResults, factsUsed, obligations }`. Fabric's `policyId.vN` / `policyVersion` remain canonical for audit.
+- **Default-deny failure handling.** `onError: "block"` (default) returns `result: "block"` with structured `engine.metadata.error` (`client_unavailable`, `input_build_failed`, `evaluation_failed`, `invalid_response`). `onError: "throw"` propagates errors instead.
+- **`previewSafe: false` by default.** Network-backed evaluators are skipped in `preview` mode by Fabric's runtime; consumers don't need extra wiring.
+- **Structurally-typed OPA client** (`{ evaluate(path, input): Promise<unknown> }`). The high-level `@open-policy-agent/opa` SDK works out of the box; hand-rolled wrappers around the low-level `OpaApiClient` work too.
+- **Zero runtime dependencies.** Dual ESM + CJS distribution. Hand-rolled decision validator (no zod runtime dep). Default `hashInput` uses `node:crypto`; override via the `hashInput` option for FIPS environments or non-Node runtimes.
+- **Peer-deps:** `@fabricorg/platform ^0.3.2`. No hard dep on `@open-policy-agent/opa` — the OPA SDK is consumer-supplied.
+- **25 unit tests** covering: happy path with engine evidence, custom `serviceKey`, custom `mapDecision`, all four failure-mode categories under both `block` and `throw` modes, decision schema validation, and hash determinism.
+
+### Known limitations
+
+- The adapter does not yet capture `bundleRevision` / `decisionId` from OPA responses. The high-level `OPAClient.evaluate(...)` API discards them; a richer client interface that uses the low-level `OpaApiClient` (with `provenance: true`) will land in a future minor.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabric
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,180 @@
+# @fabricorg/policy-opa
+
+Open Policy Agent (OPA) adapter for [`@fabricorg/platform`](https://www.npmjs.com/package/@fabricorg/platform). Lets a Rego decision back a Fabric `code` policy while preserving Fabric's canonical audit identity (`policyId.vN`, `policyVersion`) and capturing OPA-side provenance (`decisionPath`, `inputHash`, optional `version`) under `PolicyDispatchEvidence.engine`.
+
+The platform stays zero-dependency and vendor-neutral; the OPA-specific glue lives here.
+
+## Install
+
+```bash
+pnpm add @fabricorg/platform @fabricorg/policy-opa
+# Bring your own OPA client. The high-level SDK works out of the box:
+pnpm add @open-policy-agent/opa
+```
+
+`@fabricorg/policy-opa` has **zero runtime dependencies**. The OPA client is structurally typed (`{ evaluate(path, input): Promise<unknown> }`) so the official `@open-policy-agent/opa` SDK works, and so do hand-rolled wrappers that capture more provenance from the low-level API.
+
+## Usage — the four pieces
+
+A complete OPA-backed evaluator has four pieces, three of which the vertical owns.
+
+### 1. The vertical policy manifest
+
+Keep Fabric policy IDs, versions, decision paths, and Rego package names in one place. Don't inline strings at call sites.
+
+```ts
+import type { OpaPolicyBinding } from "@fabricorg/policy-opa";
+
+export const LENDING_POLICY_BINDINGS = {
+  tcpaContactWindow: {
+    policyId: "lending.tcpa_contact_window.v1",
+    version: 1,
+    decisionPath: "fabric/lending/tcpa/contact_window/decision",
+    regoPackage: "fabric.lending.tcpa.contact_window",
+  },
+} satisfies Record<string, OpaPolicyBinding>;
+```
+
+### 2. The fact builder (TypeScript)
+
+Snapshot the facts OPA needs from your database. OPA never touches your DB directly — your TypeScript host owns reads, tenant scoping, and redaction.
+
+```ts
+import type { PolicyContext } from "@fabricorg/platform/policies";
+
+async function buildContactWindowInput(ctx: PolicyContext) {
+  const consent = await ctx.db.tcpaConsent.findUnique({
+    where: { partyId: ctx.parameters.partyId },
+  });
+  return {
+    tenantId: ctx.tenantId,
+    actionId: ctx.actionId,
+    now: (ctx.now ?? new Date()).toISOString(),
+    consent: consent
+      ? { active: consent.status === "active", scope: consent.scope }
+      : null,
+    contactWindow: { startHour: 8, endHour: 21, timezone: ctx.parameters.timezone },
+  };
+}
+```
+
+### 3. The Rego policy (house style)
+
+Have Rego return a structured decision object, not a bare boolean. The adapter validates against this shape.
+
+```rego
+package fabric.lending.tcpa.contact_window
+import rego.v1
+
+decision := {
+  "result": result,
+  "reason": reason,
+  "conditionResults": condition_results,
+  "factsUsed": facts_used,
+}
+
+result := "block" if not consent_active
+result := "block" if not within_window
+default result := "pass"
+
+# ...rules computing reason, condition_results, facts_used...
+```
+
+The validator accepts the following fields (TypeScript types: `OpaDecision`):
+
+```ts
+{
+  result: "pass" | "warn" | "block";  // required
+  reason?: string;
+  conditionResults?: Array<{
+    conditionId: string;
+    passed: boolean;
+    result: "pass" | "warn" | "block";
+    reason?: string;
+  }>;
+  factsUsed?: Record<string, unknown>;
+  obligations?: Record<string, unknown>;
+}
+```
+
+### 4. The evaluator factory (this package)
+
+```ts
+import { createOpaPolicyEvaluator } from "@fabricorg/policy-opa";
+import { registerPolicy } from "@fabricorg/platform/policies";
+
+import { LENDING_POLICY_BINDINGS } from "../policies/manifest";
+
+const tcpaPolicy = createOpaPolicyEvaluator({
+  binding: LENDING_POLICY_BINDINGS.tcpaContactWindow,
+  buildInput: buildContactWindowInput,
+  serviceKey: "opa",     // default; ctx.services.opa must hold an OpaPolicyClient
+  onError: "block",      // default; honors Fabric's default-deny posture
+});
+
+registerPolicy(tcpaPolicy);
+```
+
+### Host wiring
+
+The runtime host injects the OPA client into `PolicyContext.services` when it builds a policy context. With the high-level SDK:
+
+```ts
+import { OPAClient } from "@open-policy-agent/opa";
+
+const opa = new OPAClient(process.env.OPA_URL ?? "http://localhost:8181");
+
+// when constructing PolicyContext for evaluatePolicyDefinitions:
+const policyCtx = {
+  tenantId, spaceId, actionInvocationId, actionId, parameters,
+  db,
+  mode: "execute",
+  services: { opa },
+};
+```
+
+## What lands in audit evidence
+
+For a successful OPA evaluation, `PolicyDispatchEvidence.engine` looks like:
+
+```json
+{
+  "name": "opa",
+  "version": "0.65.0",
+  "metadata": {
+    "decisionPath": "fabric/lending/tcpa/contact_window/decision",
+    "regoPackage": "fabric.lending.tcpa.contact_window",
+    "inputHash": "sha256:8a3c…",
+    "conditionResults": [{ "conditionId": "consent_active", "passed": true, "result": "pass" }],
+    "factsUsed": { "consent": { "active": true } }
+  }
+}
+```
+
+Fabric's `policyId` / `policyVersion` remain canonical (`"what was evaluated"`). `engine.metadata` answers `"which artifact produced the answer"`. Both ride on the `PolicyEvaluation` row Fabric persists per outcome.
+
+## Failure modes
+
+| Situation | Result | `engine.metadata.error` |
+|---|---|---|
+| `ctx.services[serviceKey]` missing or not an `OpaPolicyClient` | `block` | `client_unavailable` |
+| `buildInput(ctx)` throws | `block` | `input_build_failed` |
+| OPA call throws (network, timeout, 5xx) | `block` | `evaluation_failed` |
+| OPA returns a shape that doesn't match `OpaDecision` | `block` | `invalid_response` |
+
+Default behavior is `onError: "block"` — Fabric's default-deny posture. Pass `onError: "throw"` to propagate the error and let Fabric surface it as a `failed` invocation instead.
+
+## Preview mode
+
+OPA evaluation is a network call, so the adapter defaults `previewSafe: false`. Fabric's runtime will skip the evaluator in `preview` mode and yield a `warn` outcome with structured skip evidence — you don't need to opt out of preview manually. Pass `previewSafe: true` only if your OPA topology guarantees deterministic, side-effect-free evaluation appropriate for preview.
+
+## What this package does NOT do
+
+- It doesn't talk to your database. `buildInput` is yours.
+- It doesn't run an OPA server. You bring an OPA sidecar (or remote service) and inject a client.
+- It doesn't ship Rego policies. You author and bundle those.
+- It doesn't (yet) capture `bundleRevision` / `decisionId`. The high-level OPA SDK discards those fields; capturing them requires using the SDK's low-level `OpaApiClient` directly. A future minor release will add a richer client interface for hosts that want that provenance.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/index.cjs

@@ -0,0 +1,242 @@
+'use strict';
+
+var crypto = require('crypto');
+
+// src/decision-schema.ts
+var POLICY_RESULTS = ["pass", "warn", "block"];
+function parseOpaDecision(raw) {
+  if (raw === null || typeof raw !== "object") {
+    return { ok: false, error: "decision must be an object" };
+  }
+  const d = raw;
+  if (typeof d.result !== "string" || !POLICY_RESULTS.includes(d.result)) {
+    return {
+      ok: false,
+      error: `result must be "pass" | "warn" | "block" (got ${JSON.stringify(d.result)})`
+    };
+  }
+  if (d.reason !== void 0 && typeof d.reason !== "string") {
+    return { ok: false, error: "reason must be a string when present" };
+  }
+  if (d.conditionResults !== void 0) {
+    if (!Array.isArray(d.conditionResults)) {
+      return { ok: false, error: "conditionResults must be an array when present" };
+    }
+    for (let i = 0; i < d.conditionResults.length; i += 1) {
+      const err = validateConditionResult(d.conditionResults[i], i);
+      if (err) return { ok: false, error: err };
+    }
+  }
+  if (d.factsUsed !== void 0 && !isPlainObject(d.factsUsed)) {
+    return { ok: false, error: "factsUsed must be an object when present" };
+  }
+  if (d.obligations !== void 0 && !isPlainObject(d.obligations)) {
+    return { ok: false, error: "obligations must be an object when present" };
+  }
+  return { ok: true, decision: d };
+}
+function validateConditionResult(value, index) {
+  if (!isPlainObject(value)) {
+    return `conditionResults[${index}] must be an object`;
+  }
+  const c = value;
+  if (typeof c.conditionId !== "string" || c.conditionId.length === 0) {
+    return `conditionResults[${index}].conditionId must be a non-empty string`;
+  }
+  if (typeof c.passed !== "boolean") {
+    return `conditionResults[${index}].passed must be a boolean`;
+  }
+  if (typeof c.result !== "string" || !POLICY_RESULTS.includes(c.result)) {
+    return `conditionResults[${index}].result must be "pass" | "warn" | "block"`;
+  }
+  if (c.reason !== void 0 && typeof c.reason !== "string") {
+    return `conditionResults[${index}].reason must be a string when present`;
+  }
+  return null;
+}
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function stableStringify(value) {
+  if (value === void 0) return "null";
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+function defaultHashInput(input) {
+  const hex = crypto.createHash("sha256").update(stableStringify(input)).digest("hex");
+  return `sha256:${hex}`;
+}
+
+// src/factory.ts
+var DEFAULT_SERVICE_KEY = "opa";
+var ENGINE_NAME = "opa";
+function createOpaPolicyEvaluator(options) {
+  const {
+    binding,
+    buildInput,
+    serviceKey = DEFAULT_SERVICE_KEY,
+    onError = "block",
+    previewSafe = false,
+    engineVersion,
+    mapDecision,
+    hashInput = defaultHashInput
+  } = options;
+  return {
+    policyId: binding.policyId,
+    version: binding.version,
+    previewSafe,
+    evaluate: async (ctx) => {
+      const client = ctx.services?.[serviceKey];
+      if (!client || typeof client.evaluate !== "function") {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "client_unavailable",
+          `No OPA client at ctx.services["${serviceKey}"]`,
+          onError
+        );
+      }
+      let input;
+      try {
+        input = await buildInput(ctx);
+      } catch (err) {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "input_build_failed",
+          `buildInput threw: ${formatError(err)}`,
+          onError
+        );
+      }
+      let inputHash;
+      try {
+        inputHash = hashInput(input);
+      } catch {
+      }
+      let rawResult;
+      try {
+        rawResult = await client.evaluate(binding.decisionPath, input);
+      } catch (err) {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "evaluation_failed",
+          `OPA evaluation failed: ${formatError(err)}`,
+          onError,
+          inputHash
+        );
+      }
+      const parsed = parseOpaDecision(rawResult);
+      if (!parsed.ok) {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "invalid_response",
+          `OPA returned malformed decision: ${parsed.error}`,
+          onError,
+          inputHash
+        );
+      }
+      return buildSuccessOutcome(
+        binding,
+        engineVersion,
+        parsed.decision,
+        inputHash,
+        ctx,
+        mapDecision
+      );
+    }
+  };
+}
+function buildSuccessOutcome(binding, engineVersion, decision, inputHash, ctx, mapDecision) {
+  const mapped = mapDecision ? mapDecision(decision, ctx) : { result: decision.result, reason: decision.reason };
+  return {
+    policyId: binding.policyId,
+    policyVersion: binding.version,
+    result: mapped.result,
+    reason: mapped.reason,
+    metadata: {
+      ...mapped.metadata ?? {},
+      opaDecision: decision
+    },
+    dispatchEvidence: {
+      policyKind: "code",
+      policyId: binding.policyId,
+      policyVersion: binding.version,
+      dispatchPath: ["code"],
+      engine: {
+        name: ENGINE_NAME,
+        version: engineVersion,
+        metadata: stripUndefined({
+          decisionPath: binding.decisionPath,
+          regoPackage: binding.regoPackage,
+          inputHash,
+          conditionResults: decision.conditionResults,
+          factsUsed: decision.factsUsed,
+          obligations: decision.obligations
+        })
+      }
+    }
+  };
+}
+function makeFailureOutcome(binding, engineVersion, error, reason, onError, inputHash) {
+  if (onError === "throw") {
+    const err = new Error(reason);
+    err.kind = error;
+    throw err;
+  }
+  return {
+    policyId: binding.policyId,
+    policyVersion: binding.version,
+    result: "block",
+    reason,
+    metadata: {
+      opaError: error
+    },
+    dispatchEvidence: {
+      policyKind: "code",
+      policyId: binding.policyId,
+      policyVersion: binding.version,
+      dispatchPath: ["code"],
+      engine: {
+        name: ENGINE_NAME,
+        version: engineVersion,
+        metadata: stripUndefined({
+          decisionPath: binding.decisionPath,
+          regoPackage: binding.regoPackage,
+          inputHash,
+          error,
+          errorReason: reason
+        })
+      }
+    }
+  };
+}
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function formatError(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+
+exports.createOpaPolicyEvaluator = createOpaPolicyEvaluator;
+exports.defaultHashInput = defaultHashInput;
+exports.parseOpaDecision = parseOpaDecision;
+exports.stableStringify = stableStringify;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/decision-schema.ts","../src/hash.ts","../src/factory.ts"],"names":["createHash"],"mappings":";;;;;AAGA,IAAM,cAAA,GAAoD,CAAC,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA;AAe3E,SAAS,iBAAiB,GAAA,EAAsC;AACtE,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,GAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,cAAA,CAAe,QAAA,CAAS,CAAA,CAAE,MAAgC,CAAA,EAAG;AACjG,IAAA,OAAO;AAAA,MACN,EAAA,EAAI,KAAA;AAAA,MACJ,OAAO,CAAA,8CAAA,EAAiD,IAAA,CAAK,SAAA,CAAU,CAAA,CAAE,MAAM,CAAC,CAAA,CAAA;AAAA,KACjF;AAAA,EACD;AAEA,EAAA,IAAI,EAAE,MAAA,KAAW,MAAA,IAAa,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC3D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sCAAA,EAAuC;AAAA,EACnE;AAEA,EAAA,IAAI,CAAA,CAAE,qBAAqB,MAAA,EAAW;AACrC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,gBAAgB,CAAA,EAAG;AACvC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,gDAAA,EAAiD;AAAA,IAC7E;AACA,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,EAAE,gBAAA,CAAiB,MAAA,EAAQ,KAAK,CAAA,EAAG;AACtD,MAAA,MAAM,MAAM,uBAAA,CAAwB,CAAA,CAAE,gBAAA,CAAiB,CAAC,GAAG,CAAC,CAAA;AAC5D,MAAA,IAAI,KAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,GAAA,EAAI;AAAA,IACzC;AAAA,EACD;AAEA,EAAA,IAAI,EAAE,SAAA,KAAc,MAAA,IAAa,CAAC,aAAA,CAAc,CAAA,CAAE,SAAS,CAAA,EAAG;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,0CAAA,EAA2C;AAAA,EACvE;AAEA,EAAA,IAAI,EAAE,WAAA,KAAgB,MAAA,IAAa,CAAC,aAAA,CAAc,CAAA,CAAE,WAAW,CAAA,EAAG;AACjE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,4CAAA,EAA6C;AAAA,EACzE;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,CAAA,EAA4B;AAC1D;AAEA,SAAS,uBAAA,CAAwB,OAAgB,KAAA,EAA8B;AAC9E,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG;AAC1B,IAAA,OAAO,oBAAoB,KAAK,CAAA,mBAAA,CAAA;AAAA,EACjC;AACA,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,YAAY,CAAA,CAAE,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,IAAA,OAAO,oBAAoB,KAAK,CAAA,wCAAA,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,SAAA,EAAW;AAClC,IAAA,OAAO,oBAAoB,KAAK,CAAA,0BAAA,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,cAAA,CAAe,QAAA,CAAS,CAAA,CAAE,MAAgC,CAAA,EAAG;AACjG,IAAA,OAAO,oBAAoB,KAAK,CAAA,0CAAA,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,EAAE,MAAA,KAAW,MAAA,IAAa,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC3D,IAAA,OAAO,oBAAoB,KAAK,CAAA,sCAAA,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,IAAA;AACR;AAEA,SAAS,cAAc,KAAA,EAAkD;AACxE,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC3E;ACvEO,SAAS,gBAAgB,KAAA,EAAwB;AACvD,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAChC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC5E,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,IAAI,KAAA,CAAM,GAAA,CAAI,eAAe,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAChD;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,EAAA,OAAO,CAAA,CAAA,EAAI,KACT,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,UAAU,CAAC,CAAC,IAAI,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAC,CAAC,EAAE,CAAA,CAC5D,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AACZ;AAOO,SAAS,iBAAiB,KAAA,EAAwC;AACxE,EAAA,MAAM,GAAA,GAAMA,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,gBAAgB,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC5E,EAAA,OAAO,UAAU,GAAG,CAAA,CAAA;AACrB;;;ACdA,IAAM,mBAAA,GAAsB,KAAA;AAC5B,IAAM,WAAA,GAAc,KAAA;AAmBb,SAAS,yBACf,OAAA,EACuB;AACvB,EAAA,MAAM;AAAA,IACL,OAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA,GAAa,mBAAA;AAAA,IACb,OAAA,GAAU,OAAA;AAAA,IACV,WAAA,GAAc,KAAA;AAAA,IACd,aAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,GAAY;AAAA,GACb,GAAI,OAAA;AAEJ,EAAA,OAAO;AAAA,IACN,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,WAAA;AAAA,IACA,QAAA,EAAU,OAAO,GAAA,KAAQ;AACxB,MAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,GAAW,UAAU,CAAA;AACxC,MAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,CAAO,aAAa,UAAA,EAAY;AACrD,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,oBAAA;AAAA,UACA,kCAAkC,UAAU,CAAA,EAAA,CAAA;AAAA,UAC5C;AAAA,SACD;AAAA,MACD;AAEA,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACH,QAAA,KAAA,GAAQ,MAAM,WAAW,GAAG,CAAA;AAAA,MAC7B,SAAS,GAAA,EAAK;AACb,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,oBAAA;AAAA,UACA,CAAA,kBAAA,EAAqB,WAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AAAA,UACrC;AAAA,SACD;AAAA,MACD;AAEA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACH,QAAA,SAAA,GAAY,UAAU,KAAK,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AAAA,MAGR;AAEA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACH,QAAA,SAAA,GAAY,MAAM,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,cAAc,KAAK,CAAA;AAAA,MAC9D,SAAS,GAAA,EAAK;AACb,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,mBAAA;AAAA,UACA,CAAA,uBAAA,EAA0B,WAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AAAA,UAC1C,OAAA;AAAA,UACA;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,MAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACf,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,kBAAA;AAAA,UACA,CAAA,iCAAA,EAAoC,OAAO,KAAK,CAAA,CAAA;AAAA,UAChD,OAAA;AAAA,UACA;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAO,mBAAA;AAAA,QACN,OAAA;AAAA,QACA,aAAA;AAAA,QACA,MAAA,CAAO,QAAA;AAAA,QACP,SAAA;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACD;AAAA,IACD;AAAA,GACD;AACD;AAEA,SAAS,oBACR,OAAA,EACA,aAAA,EACA,QAAA,EACA,SAAA,EACA,KACA,WAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,WAAA,GACZ,WAAA,CAAY,QAAA,EAAU,GAAG,CAAA,GACzB,EAAE,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAO;AAEtD,EAAA,OAAO;AAAA,IACN,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,IACvB,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,QAAA,EAAU;AAAA,MACT,GAAI,MAAA,CAAO,QAAA,IAAY,EAAC;AAAA,MACxB,WAAA,EAAa;AAAA,KACd;AAAA,IACA,gBAAA,EAAkB;AAAA,MACjB,UAAA,EAAY,MAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,MACvB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,OAAA,EAAS,aAAA;AAAA,QACT,UAAU,cAAA,CAAe;AAAA,UACxB,cAAc,OAAA,CAAQ,YAAA;AAAA,UACtB,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,SAAA;AAAA,UACA,kBAAkB,QAAA,CAAS,gBAAA;AAAA,UAC3B,WAAW,QAAA,CAAS,SAAA;AAAA,UACpB,aAAa,QAAA,CAAS;AAAA,SACtB;AAAA;AACF;AACD,GACD;AACD;AAEA,SAAS,mBACR,OAAA,EACA,aAAA,EACA,KAAA,EACA,MAAA,EACA,SACA,SAAA,EACgB;AAChB,EAAA,IAAI,YAAY,OAAA,EAAS;AACxB,IAAA,MAAM,GAAA,GAAM,IAAI,KAAA,CAAM,MAAM,CAAA;AAC5B,IAAC,IAAgD,IAAA,GAAO,KAAA;AACxD,IAAA,MAAM,GAAA;AAAA,EACP;AAEA,EAAA,OAAO;AAAA,IACN,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,IACvB,MAAA,EAAQ,OAAA;AAAA,IACR,MAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACT,QAAA,EAAU;AAAA,KACX;AAAA,IACA,gBAAA,EAAkB;AAAA,MACjB,UAAA,EAAY,MAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,MACvB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,OAAA,EAAS,aAAA;AAAA,QACT,UAAU,cAAA,CAAe;AAAA,UACxB,cAAc,OAAA,CAAQ,YAAA;AAAA,UACtB,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,SAAA;AAAA,UACA,KAAA;AAAA,UACA,WAAA,EAAa;AAAA,SACb;AAAA;AACF;AACD,GACD;AACD;AAEA,SAAS,eAAe,GAAA,EAAuD;AAC9E,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,GAAA;AACR;AAEA,SAAS,YAAY,GAAA,EAAsB;AAC1C,EAAA,IAAI,GAAA,YAAe,KAAA,EAAO,OAAO,GAAA,CAAI,OAAA;AACrC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,GAAA;AACpC,EAAA,IAAI;AACH,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACP,IAAA,OAAO,OAAO,GAAG,CAAA;AAAA,EAClB;AACD","file":"index.cjs","sourcesContent":["import type { PolicyEvaluationResult } from \"@fabricorg/platform/policies\";\nimport type { OpaDecision } from \"./types\";\n\nconst POLICY_RESULTS: readonly PolicyEvaluationResult[] = [\"pass\", \"warn\", \"block\"];\n\nexport type OpaDecisionParseResult =\n\t| { ok: true; decision: OpaDecision }\n\t| { ok: false; error: string };\n\n/**\n * Hand-rolled validator for the Rego \"house style\" decision shape. Avoids a\n * runtime zod dependency to keep the adapter zero-dep.\n *\n * Accepts a raw OPA result and either returns the parsed `OpaDecision` or a\n * single human-readable error string describing the first violation. We don't\n * accumulate every error: when audit evidence has to record \"OPA returned\n * something invalid\", one precise reason is more useful than a list.\n */\nexport function parseOpaDecision(raw: unknown): OpaDecisionParseResult {\n\tif (raw === null || typeof raw !== \"object\") {\n\t\treturn { ok: false, error: \"decision must be an object\" };\n\t}\n\n\tconst d = raw as Record<string, unknown>;\n\n\tif (typeof d.result !== \"string\" || !POLICY_RESULTS.includes(d.result as PolicyEvaluationResult)) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: `result must be \"pass\" | \"warn\" | \"block\" (got ${JSON.stringify(d.result)})`,\n\t\t};\n\t}\n\n\tif (d.reason !== undefined && typeof d.reason !== \"string\") {\n\t\treturn { ok: false, error: \"reason must be a string when present\" };\n\t}\n\n\tif (d.conditionResults !== undefined) {\n\t\tif (!Array.isArray(d.conditionResults)) {\n\t\t\treturn { ok: false, error: \"conditionResults must be an array when present\" };\n\t\t}\n\t\tfor (let i = 0; i < d.conditionResults.length; i += 1) {\n\t\t\tconst err = validateConditionResult(d.conditionResults[i], i);\n\t\t\tif (err) return { ok: false, error: err };\n\t\t}\n\t}\n\n\tif (d.factsUsed !== undefined && !isPlainObject(d.factsUsed)) {\n\t\treturn { ok: false, error: \"factsUsed must be an object when present\" };\n\t}\n\n\tif (d.obligations !== undefined && !isPlainObject(d.obligations)) {\n\t\treturn { ok: false, error: \"obligations must be an object when present\" };\n\t}\n\n\treturn { ok: true, decision: d as unknown as OpaDecision };\n}\n\nfunction validateConditionResult(value: unknown, index: number): string | null {\n\tif (!isPlainObject(value)) {\n\t\treturn `conditionResults[${index}] must be an object`;\n\t}\n\tconst c = value as Record<string, unknown>;\n\tif (typeof c.conditionId !== \"string\" || c.conditionId.length === 0) {\n\t\treturn `conditionResults[${index}].conditionId must be a non-empty string`;\n\t}\n\tif (typeof c.passed !== \"boolean\") {\n\t\treturn `conditionResults[${index}].passed must be a boolean`;\n\t}\n\tif (typeof c.result !== \"string\" || !POLICY_RESULTS.includes(c.result as PolicyEvaluationResult)) {\n\t\treturn `conditionResults[${index}].result must be \"pass\" | \"warn\" | \"block\"`;\n\t}\n\tif (c.reason !== undefined && typeof c.reason !== \"string\") {\n\t\treturn `conditionResults[${index}].reason must be a string when present`;\n\t}\n\treturn null;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n","import { createHash } from \"node:crypto\";\n\n/**\n * Stable JSON stringify — sorts object keys recursively so two\n * structurally-equal inputs produce the same string regardless of property\n * insertion order. Required for hash determinism across builds of the same\n * `buildInput` function.\n */\nexport function stableStringify(value: unknown): string {\n\tif (value === undefined) return \"null\";\n\tif (value === null || typeof value !== \"object\") return JSON.stringify(value);\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map(stableStringify).join(\",\")}]`;\n\t}\n\tconst obj = value as Record<string, unknown>;\n\tconst keys = Object.keys(obj).sort();\n\treturn `{${keys\n\t\t.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)\n\t\t.join(\",\")}}`;\n}\n\n/**\n * Default input hasher: SHA-256 over a stable stringification.\n * Format: `sha256:<hex>` — namespaced so future migrations to a different\n * algorithm can be detected by a prefix check in evidence dashboards.\n */\nexport function defaultHashInput(input: Record<string, unknown>): string {\n\tconst hex = createHash(\"sha256\").update(stableStringify(input)).digest(\"hex\");\n\treturn `sha256:${hex}`;\n}\n","import type {\n\tPolicyContext,\n\tPolicyEvaluator,\n\tPolicyOutcome,\n} from \"@fabricorg/platform/policies\";\n\nimport { parseOpaDecision } from \"./decision-schema\";\nimport { defaultHashInput } from \"./hash\";\nimport type {\n\tCreateOpaPolicyEvaluatorOptions,\n\tOpaDecision,\n\tOpaPolicyClient,\n\tOpaPolicyFailureKind,\n} from \"./types\";\n\nconst DEFAULT_SERVICE_KEY = \"opa\";\nconst ENGINE_NAME = \"opa\";\n\n/**\n * Build a Fabric `PolicyEvaluator` that delegates decision-making to an OPA\n * (Open Policy Agent) deployment. The evaluator:\n *\n * 1. Reads the host-injected OPA client from `ctx.services[serviceKey]`.\n * 2. Builds a JSON input snapshot via `buildInput(ctx)` — domain code that\n *    snapshots facts the engine needs. Fabric platform never lets OPA reach\n *    into the database directly; all facts flow through this function.\n * 3. Evaluates the Rego decision at `binding.decisionPath`.\n * 4. Validates the response against the house-style shape (`OpaDecision`).\n * 5. Maps the decision to a `PolicyOutcome` and attaches engine provenance\n *    (`engine.name = \"opa\"`, `decisionPath`, `inputHash`) for audit.\n *\n * Failures (missing client, build failure, network failure, malformed response)\n * are governed by `onError`. Default `\"block\"` honors Fabric's default-deny\n * posture and records the failure category under `engine.metadata.error`.\n */\nexport function createOpaPolicyEvaluator<TDb = unknown>(\n\toptions: CreateOpaPolicyEvaluatorOptions<TDb>,\n): PolicyEvaluator<TDb> {\n\tconst {\n\t\tbinding,\n\t\tbuildInput,\n\t\tserviceKey = DEFAULT_SERVICE_KEY,\n\t\tonError = \"block\",\n\t\tpreviewSafe = false,\n\t\tengineVersion,\n\t\tmapDecision,\n\t\thashInput = defaultHashInput,\n\t} = options;\n\n\treturn {\n\t\tpolicyId: binding.policyId,\n\t\tversion: binding.version,\n\t\tpreviewSafe,\n\t\tevaluate: async (ctx) => {\n\t\t\tconst client = ctx.services?.[serviceKey] as OpaPolicyClient | undefined;\n\t\t\tif (!client || typeof client.evaluate !== \"function\") {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"client_unavailable\",\n\t\t\t\t\t`No OPA client at ctx.services[\"${serviceKey}\"]`,\n\t\t\t\t\tonError,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tlet input: Record<string, unknown>;\n\t\t\ttry {\n\t\t\t\tinput = await buildInput(ctx);\n\t\t\t} catch (err) {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"input_build_failed\",\n\t\t\t\t\t`buildInput threw: ${formatError(err)}`,\n\t\t\t\t\tonError,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tlet inputHash: string | undefined;\n\t\t\ttry {\n\t\t\t\tinputHash = hashInput(input);\n\t\t\t} catch {\n\t\t\t\t// hashing is best-effort — if a custom hasher throws, omit the\n\t\t\t\t// field rather than fail the policy.\n\t\t\t}\n\n\t\t\tlet rawResult: unknown;\n\t\t\ttry {\n\t\t\t\trawResult = await client.evaluate(binding.decisionPath, input);\n\t\t\t} catch (err) {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"evaluation_failed\",\n\t\t\t\t\t`OPA evaluation failed: ${formatError(err)}`,\n\t\t\t\t\tonError,\n\t\t\t\t\tinputHash,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst parsed = parseOpaDecision(rawResult);\n\t\t\tif (!parsed.ok) {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"invalid_response\",\n\t\t\t\t\t`OPA returned malformed decision: ${parsed.error}`,\n\t\t\t\t\tonError,\n\t\t\t\t\tinputHash,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn buildSuccessOutcome(\n\t\t\t\tbinding,\n\t\t\t\tengineVersion,\n\t\t\t\tparsed.decision,\n\t\t\t\tinputHash,\n\t\t\t\tctx,\n\t\t\t\tmapDecision,\n\t\t\t);\n\t\t},\n\t};\n}\n\nfunction buildSuccessOutcome<TDb>(\n\tbinding: CreateOpaPolicyEvaluatorOptions<TDb>[\"binding\"],\n\tengineVersion: string | undefined,\n\tdecision: OpaDecision,\n\tinputHash: string | undefined,\n\tctx: PolicyContext<TDb>,\n\tmapDecision: CreateOpaPolicyEvaluatorOptions<TDb>[\"mapDecision\"],\n): PolicyOutcome {\n\tconst mapped = mapDecision\n\t\t? mapDecision(decision, ctx)\n\t\t: { result: decision.result, reason: decision.reason };\n\n\treturn {\n\t\tpolicyId: binding.policyId,\n\t\tpolicyVersion: binding.version,\n\t\tresult: mapped.result,\n\t\treason: mapped.reason,\n\t\tmetadata: {\n\t\t\t...(mapped.metadata ?? {}),\n\t\t\topaDecision: decision,\n\t\t},\n\t\tdispatchEvidence: {\n\t\t\tpolicyKind: \"code\",\n\t\t\tpolicyId: binding.policyId,\n\t\t\tpolicyVersion: binding.version,\n\t\t\tdispatchPath: [\"code\"],\n\t\t\tengine: {\n\t\t\t\tname: ENGINE_NAME,\n\t\t\t\tversion: engineVersion,\n\t\t\t\tmetadata: stripUndefined({\n\t\t\t\t\tdecisionPath: binding.decisionPath,\n\t\t\t\t\tregoPackage: binding.regoPackage,\n\t\t\t\t\tinputHash,\n\t\t\t\t\tconditionResults: decision.conditionResults,\n\t\t\t\t\tfactsUsed: decision.factsUsed,\n\t\t\t\t\tobligations: decision.obligations,\n\t\t\t\t}),\n\t\t\t},\n\t\t},\n\t};\n}\n\nfunction makeFailureOutcome(\n\tbinding: CreateOpaPolicyEvaluatorOptions[\"binding\"],\n\tengineVersion: string | undefined,\n\terror: OpaPolicyFailureKind,\n\treason: string,\n\tonError: \"block\" | \"throw\",\n\tinputHash?: string,\n): PolicyOutcome {\n\tif (onError === \"throw\") {\n\t\tconst err = new Error(reason);\n\t\t(err as Error & { kind?: OpaPolicyFailureKind }).kind = error;\n\t\tthrow err;\n\t}\n\n\treturn {\n\t\tpolicyId: binding.policyId,\n\t\tpolicyVersion: binding.version,\n\t\tresult: \"block\",\n\t\treason,\n\t\tmetadata: {\n\t\t\topaError: error,\n\t\t},\n\t\tdispatchEvidence: {\n\t\t\tpolicyKind: \"code\",\n\t\t\tpolicyId: binding.policyId,\n\t\t\tpolicyVersion: binding.version,\n\t\t\tdispatchPath: [\"code\"],\n\t\t\tengine: {\n\t\t\t\tname: ENGINE_NAME,\n\t\t\t\tversion: engineVersion,\n\t\t\t\tmetadata: stripUndefined({\n\t\t\t\t\tdecisionPath: binding.decisionPath,\n\t\t\t\t\tregoPackage: binding.regoPackage,\n\t\t\t\t\tinputHash,\n\t\t\t\t\terror,\n\t\t\t\t\terrorReason: reason,\n\t\t\t\t}),\n\t\t\t},\n\t\t},\n\t};\n}\n\nfunction stripUndefined(obj: Record<string, unknown>): Record<string, unknown> {\n\tconst out: Record<string, unknown> = {};\n\tfor (const [k, v] of Object.entries(obj)) {\n\t\tif (v !== undefined) out[k] = v;\n\t}\n\treturn out;\n}\n\nfunction formatError(err: unknown): string {\n\tif (err instanceof Error) return err.message;\n\tif (typeof err === \"string\") return err;\n\ttry {\n\t\treturn JSON.stringify(err);\n\t} catch {\n\t\treturn String(err);\n\t}\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,163 @@
+import { PolicyId, PolicyContext, PolicyEvaluationResult, PolicyOutcome, PolicyEvaluator } from '@fabricorg/platform/policies';
+
+/**
+ * Binding between a Fabric platform policy and an OPA decision. Verticals
+ * declare these in a manifest (e.g. `LENDING_POLICY_BINDINGS`) so the same
+ * IDs, version, and decision path are referenced consistently by the TypeScript
+ * registration, the Rego package, and audit evidence.
+ */
+interface OpaPolicyBinding {
+    policyId: PolicyId;
+    version: number;
+    /**
+     * Path to the Rego decision rule, without `/v1/data/` prefix.
+     *
+     * Example: `"fabric/lending/tcpa/contact_window/decision"`.
+     *
+     * Stored verbatim in `PolicyDispatchEvidence.engine.metadata.decisionPath`
+     * so auditors can trace a decision back to its Rego artifact.
+     */
+    decisionPath: string;
+    /**
+     * Documentation-only: the Rego package name, e.g.
+     * `"fabric.lending.tcpa.contact_window"`. The adapter does not consume this
+     * — it is part of the manifest contract to help Rego authors and reviewers
+     * keep the package name aligned with the decision path.
+     */
+    regoPackage?: string;
+}
+/**
+ * Structured Rego decision shape — the "house style" the adapter expects from
+ * any Rego policy. Wrap policy logic so it returns a typed object rather than
+ * a bare boolean: the per-condition shape preserves the same evidence
+ * granularity Fabric's built-in data policies provide.
+ */
+interface OpaDecision {
+    result: PolicyEvaluationResult;
+    reason?: string;
+    conditionResults?: Array<{
+        conditionId: string;
+        passed: boolean;
+        result: PolicyEvaluationResult;
+        reason?: string;
+    }>;
+    factsUsed?: Record<string, unknown>;
+    obligations?: Record<string, unknown>;
+}
+/**
+ * Minimal structurally-typed OPA client. Compatible with `OPAClient` from
+ * `@open-policy-agent/opa` (whose `evaluate(path, input, opts?)` signature
+ * widens to this interface); advanced users can supply their own wrapper that
+ * captures `decisionId` / `bundleRevision` from the low-level SDK.
+ */
+interface OpaPolicyClient {
+    evaluate<T = unknown>(path: string, input: unknown): Promise<T>;
+}
+type OpaPolicyErrorMode = "block" | "throw";
+/**
+ * Failure category surfaced in `engine.metadata.error` when `onError: "block"`
+ * is used. Lets dashboards distinguish "OPA is down" from "OPA returned
+ * something we couldn't parse" from "no client was injected at runtime".
+ */
+type OpaPolicyFailureKind = "client_unavailable" | "input_build_failed" | "evaluation_failed" | "invalid_response";
+type OpaPolicyDecisionMapper<TDb = unknown> = (decision: OpaDecision, ctx: PolicyContext<TDb>) => Pick<PolicyOutcome, "result" | "reason"> & {
+    metadata?: Record<string, unknown>;
+};
+interface CreateOpaPolicyEvaluatorOptions<TDb = unknown> {
+    binding: OpaPolicyBinding;
+    buildInput: (ctx: PolicyContext<TDb>) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    /**
+     * Key under `ctx.services` where the host has placed an `OpaPolicyClient`.
+     * Defaults to `"opa"`. The adapter reads it as
+     * `ctx.services?.[serviceKey]`; if absent, the configured `onError` policy
+     * applies.
+     */
+    serviceKey?: string;
+    /**
+     * What to do when the OPA call fails, the client is missing, or the
+     * response is malformed. Defaults to `"block"` — matches Fabric's
+     * default-deny posture. With `"throw"`, the error propagates and Fabric's
+     * runtime surfaces it as a `failed` invocation (not `blocked_by_policy`).
+     */
+    onError?: OpaPolicyErrorMode;
+    /**
+     * Whether this evaluator is safe to run in `preview` mode. Defaults to
+     * `false` because OPA evaluation is a network call and not preview-safe by
+     * default. Set `true` only if the host's OPA topology guarantees
+     * deterministic, side-effect-free evaluation suitable for preview.
+     */
+    previewSafe?: boolean;
+    /**
+     * Optional override for `engine.version` in dispatch evidence. The
+     * high-level OPA SDK does not surface OPA's server version; if the host
+     * knows it (e.g. from sidecar metadata), it can be passed here so audit
+     * evidence captures "which OPA server made this decision".
+     */
+    engineVersion?: string;
+    /**
+     * Custom mapper from a validated `OpaDecision` to a `PolicyOutcome`-shaped
+     * partial. Defaults to identity (`result` and `reason` copied through).
+     * Use this to translate Rego idioms into Fabric's tri-state or to enrich
+     * `metadata`.
+     */
+    mapDecision?: OpaPolicyDecisionMapper<TDb>;
+    /**
+     * Custom input hasher. Defaults to SHA-256 over a stable JSON
+     * stringification (sorted keys). Override for FIPS environments or to use
+     * Web Crypto on runtimes without `node:crypto`.
+     */
+    hashInput?: (input: Record<string, unknown>) => string;
+}
+
+/**
+ * Build a Fabric `PolicyEvaluator` that delegates decision-making to an OPA
+ * (Open Policy Agent) deployment. The evaluator:
+ *
+ * 1. Reads the host-injected OPA client from `ctx.services[serviceKey]`.
+ * 2. Builds a JSON input snapshot via `buildInput(ctx)` — domain code that
+ *    snapshots facts the engine needs. Fabric platform never lets OPA reach
+ *    into the database directly; all facts flow through this function.
+ * 3. Evaluates the Rego decision at `binding.decisionPath`.
+ * 4. Validates the response against the house-style shape (`OpaDecision`).
+ * 5. Maps the decision to a `PolicyOutcome` and attaches engine provenance
+ *    (`engine.name = "opa"`, `decisionPath`, `inputHash`) for audit.
+ *
+ * Failures (missing client, build failure, network failure, malformed response)
+ * are governed by `onError`. Default `"block"` honors Fabric's default-deny
+ * posture and records the failure category under `engine.metadata.error`.
+ */
+declare function createOpaPolicyEvaluator<TDb = unknown>(options: CreateOpaPolicyEvaluatorOptions<TDb>): PolicyEvaluator<TDb>;
+
+type OpaDecisionParseResult = {
+    ok: true;
+    decision: OpaDecision;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Hand-rolled validator for the Rego "house style" decision shape. Avoids a
+ * runtime zod dependency to keep the adapter zero-dep.
+ *
+ * Accepts a raw OPA result and either returns the parsed `OpaDecision` or a
+ * single human-readable error string describing the first violation. We don't
+ * accumulate every error: when audit evidence has to record "OPA returned
+ * something invalid", one precise reason is more useful than a list.
+ */
+declare function parseOpaDecision(raw: unknown): OpaDecisionParseResult;
+
+/**
+ * Stable JSON stringify — sorts object keys recursively so two
+ * structurally-equal inputs produce the same string regardless of property
+ * insertion order. Required for hash determinism across builds of the same
+ * `buildInput` function.
+ */
+declare function stableStringify(value: unknown): string;
+/**
+ * Default input hasher: SHA-256 over a stable stringification.
+ * Format: `sha256:<hex>` — namespaced so future migrations to a different
+ * algorithm can be detected by a prefix check in evidence dashboards.
+ */
+declare function defaultHashInput(input: Record<string, unknown>): string;
+
+export { type CreateOpaPolicyEvaluatorOptions, type OpaDecision, type OpaDecisionParseResult, type OpaPolicyBinding, type OpaPolicyClient, type OpaPolicyDecisionMapper, type OpaPolicyErrorMode, type OpaPolicyFailureKind, createOpaPolicyEvaluator, defaultHashInput, parseOpaDecision, stableStringify };

package/dist/index.d.ts

@@ -0,0 +1,163 @@
+import { PolicyId, PolicyContext, PolicyEvaluationResult, PolicyOutcome, PolicyEvaluator } from '@fabricorg/platform/policies';
+
+/**
+ * Binding between a Fabric platform policy and an OPA decision. Verticals
+ * declare these in a manifest (e.g. `LENDING_POLICY_BINDINGS`) so the same
+ * IDs, version, and decision path are referenced consistently by the TypeScript
+ * registration, the Rego package, and audit evidence.
+ */
+interface OpaPolicyBinding {
+    policyId: PolicyId;
+    version: number;
+    /**
+     * Path to the Rego decision rule, without `/v1/data/` prefix.
+     *
+     * Example: `"fabric/lending/tcpa/contact_window/decision"`.
+     *
+     * Stored verbatim in `PolicyDispatchEvidence.engine.metadata.decisionPath`
+     * so auditors can trace a decision back to its Rego artifact.
+     */
+    decisionPath: string;
+    /**
+     * Documentation-only: the Rego package name, e.g.
+     * `"fabric.lending.tcpa.contact_window"`. The adapter does not consume this
+     * — it is part of the manifest contract to help Rego authors and reviewers
+     * keep the package name aligned with the decision path.
+     */
+    regoPackage?: string;
+}
+/**
+ * Structured Rego decision shape — the "house style" the adapter expects from
+ * any Rego policy. Wrap policy logic so it returns a typed object rather than
+ * a bare boolean: the per-condition shape preserves the same evidence
+ * granularity Fabric's built-in data policies provide.
+ */
+interface OpaDecision {
+    result: PolicyEvaluationResult;
+    reason?: string;
+    conditionResults?: Array<{
+        conditionId: string;
+        passed: boolean;
+        result: PolicyEvaluationResult;
+        reason?: string;
+    }>;
+    factsUsed?: Record<string, unknown>;
+    obligations?: Record<string, unknown>;
+}
+/**
+ * Minimal structurally-typed OPA client. Compatible with `OPAClient` from
+ * `@open-policy-agent/opa` (whose `evaluate(path, input, opts?)` signature
+ * widens to this interface); advanced users can supply their own wrapper that
+ * captures `decisionId` / `bundleRevision` from the low-level SDK.
+ */
+interface OpaPolicyClient {
+    evaluate<T = unknown>(path: string, input: unknown): Promise<T>;
+}
+type OpaPolicyErrorMode = "block" | "throw";
+/**
+ * Failure category surfaced in `engine.metadata.error` when `onError: "block"`
+ * is used. Lets dashboards distinguish "OPA is down" from "OPA returned
+ * something we couldn't parse" from "no client was injected at runtime".
+ */
+type OpaPolicyFailureKind = "client_unavailable" | "input_build_failed" | "evaluation_failed" | "invalid_response";
+type OpaPolicyDecisionMapper<TDb = unknown> = (decision: OpaDecision, ctx: PolicyContext<TDb>) => Pick<PolicyOutcome, "result" | "reason"> & {
+    metadata?: Record<string, unknown>;
+};
+interface CreateOpaPolicyEvaluatorOptions<TDb = unknown> {
+    binding: OpaPolicyBinding;
+    buildInput: (ctx: PolicyContext<TDb>) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    /**
+     * Key under `ctx.services` where the host has placed an `OpaPolicyClient`.
+     * Defaults to `"opa"`. The adapter reads it as
+     * `ctx.services?.[serviceKey]`; if absent, the configured `onError` policy
+     * applies.
+     */
+    serviceKey?: string;
+    /**
+     * What to do when the OPA call fails, the client is missing, or the
+     * response is malformed. Defaults to `"block"` — matches Fabric's
+     * default-deny posture. With `"throw"`, the error propagates and Fabric's
+     * runtime surfaces it as a `failed` invocation (not `blocked_by_policy`).
+     */
+    onError?: OpaPolicyErrorMode;
+    /**
+     * Whether this evaluator is safe to run in `preview` mode. Defaults to
+     * `false` because OPA evaluation is a network call and not preview-safe by
+     * default. Set `true` only if the host's OPA topology guarantees
+     * deterministic, side-effect-free evaluation suitable for preview.
+     */
+    previewSafe?: boolean;
+    /**
+     * Optional override for `engine.version` in dispatch evidence. The
+     * high-level OPA SDK does not surface OPA's server version; if the host
+     * knows it (e.g. from sidecar metadata), it can be passed here so audit
+     * evidence captures "which OPA server made this decision".
+     */
+    engineVersion?: string;
+    /**
+     * Custom mapper from a validated `OpaDecision` to a `PolicyOutcome`-shaped
+     * partial. Defaults to identity (`result` and `reason` copied through).
+     * Use this to translate Rego idioms into Fabric's tri-state or to enrich
+     * `metadata`.
+     */
+    mapDecision?: OpaPolicyDecisionMapper<TDb>;
+    /**
+     * Custom input hasher. Defaults to SHA-256 over a stable JSON
+     * stringification (sorted keys). Override for FIPS environments or to use
+     * Web Crypto on runtimes without `node:crypto`.
+     */
+    hashInput?: (input: Record<string, unknown>) => string;
+}
+
+/**
+ * Build a Fabric `PolicyEvaluator` that delegates decision-making to an OPA
+ * (Open Policy Agent) deployment. The evaluator:
+ *
+ * 1. Reads the host-injected OPA client from `ctx.services[serviceKey]`.
+ * 2. Builds a JSON input snapshot via `buildInput(ctx)` — domain code that
+ *    snapshots facts the engine needs. Fabric platform never lets OPA reach
+ *    into the database directly; all facts flow through this function.
+ * 3. Evaluates the Rego decision at `binding.decisionPath`.
+ * 4. Validates the response against the house-style shape (`OpaDecision`).
+ * 5. Maps the decision to a `PolicyOutcome` and attaches engine provenance
+ *    (`engine.name = "opa"`, `decisionPath`, `inputHash`) for audit.
+ *
+ * Failures (missing client, build failure, network failure, malformed response)
+ * are governed by `onError`. Default `"block"` honors Fabric's default-deny
+ * posture and records the failure category under `engine.metadata.error`.
+ */
+declare function createOpaPolicyEvaluator<TDb = unknown>(options: CreateOpaPolicyEvaluatorOptions<TDb>): PolicyEvaluator<TDb>;
+
+type OpaDecisionParseResult = {
+    ok: true;
+    decision: OpaDecision;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Hand-rolled validator for the Rego "house style" decision shape. Avoids a
+ * runtime zod dependency to keep the adapter zero-dep.
+ *
+ * Accepts a raw OPA result and either returns the parsed `OpaDecision` or a
+ * single human-readable error string describing the first violation. We don't
+ * accumulate every error: when audit evidence has to record "OPA returned
+ * something invalid", one precise reason is more useful than a list.
+ */
+declare function parseOpaDecision(raw: unknown): OpaDecisionParseResult;
+
+/**
+ * Stable JSON stringify — sorts object keys recursively so two
+ * structurally-equal inputs produce the same string regardless of property
+ * insertion order. Required for hash determinism across builds of the same
+ * `buildInput` function.
+ */
+declare function stableStringify(value: unknown): string;
+/**
+ * Default input hasher: SHA-256 over a stable stringification.
+ * Format: `sha256:<hex>` — namespaced so future migrations to a different
+ * algorithm can be detected by a prefix check in evidence dashboards.
+ */
+declare function defaultHashInput(input: Record<string, unknown>): string;
+
+export { type CreateOpaPolicyEvaluatorOptions, type OpaDecision, type OpaDecisionParseResult, type OpaPolicyBinding, type OpaPolicyClient, type OpaPolicyDecisionMapper, type OpaPolicyErrorMode, type OpaPolicyFailureKind, createOpaPolicyEvaluator, defaultHashInput, parseOpaDecision, stableStringify };

package/dist/index.js

@@ -0,0 +1,237 @@
+import { createHash } from 'crypto';
+
+// src/decision-schema.ts
+var POLICY_RESULTS = ["pass", "warn", "block"];
+function parseOpaDecision(raw) {
+  if (raw === null || typeof raw !== "object") {
+    return { ok: false, error: "decision must be an object" };
+  }
+  const d = raw;
+  if (typeof d.result !== "string" || !POLICY_RESULTS.includes(d.result)) {
+    return {
+      ok: false,
+      error: `result must be "pass" | "warn" | "block" (got ${JSON.stringify(d.result)})`
+    };
+  }
+  if (d.reason !== void 0 && typeof d.reason !== "string") {
+    return { ok: false, error: "reason must be a string when present" };
+  }
+  if (d.conditionResults !== void 0) {
+    if (!Array.isArray(d.conditionResults)) {
+      return { ok: false, error: "conditionResults must be an array when present" };
+    }
+    for (let i = 0; i < d.conditionResults.length; i += 1) {
+      const err = validateConditionResult(d.conditionResults[i], i);
+      if (err) return { ok: false, error: err };
+    }
+  }
+  if (d.factsUsed !== void 0 && !isPlainObject(d.factsUsed)) {
+    return { ok: false, error: "factsUsed must be an object when present" };
+  }
+  if (d.obligations !== void 0 && !isPlainObject(d.obligations)) {
+    return { ok: false, error: "obligations must be an object when present" };
+  }
+  return { ok: true, decision: d };
+}
+function validateConditionResult(value, index) {
+  if (!isPlainObject(value)) {
+    return `conditionResults[${index}] must be an object`;
+  }
+  const c = value;
+  if (typeof c.conditionId !== "string" || c.conditionId.length === 0) {
+    return `conditionResults[${index}].conditionId must be a non-empty string`;
+  }
+  if (typeof c.passed !== "boolean") {
+    return `conditionResults[${index}].passed must be a boolean`;
+  }
+  if (typeof c.result !== "string" || !POLICY_RESULTS.includes(c.result)) {
+    return `conditionResults[${index}].result must be "pass" | "warn" | "block"`;
+  }
+  if (c.reason !== void 0 && typeof c.reason !== "string") {
+    return `conditionResults[${index}].reason must be a string when present`;
+  }
+  return null;
+}
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function stableStringify(value) {
+  if (value === void 0) return "null";
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+function defaultHashInput(input) {
+  const hex = createHash("sha256").update(stableStringify(input)).digest("hex");
+  return `sha256:${hex}`;
+}
+
+// src/factory.ts
+var DEFAULT_SERVICE_KEY = "opa";
+var ENGINE_NAME = "opa";
+function createOpaPolicyEvaluator(options) {
+  const {
+    binding,
+    buildInput,
+    serviceKey = DEFAULT_SERVICE_KEY,
+    onError = "block",
+    previewSafe = false,
+    engineVersion,
+    mapDecision,
+    hashInput = defaultHashInput
+  } = options;
+  return {
+    policyId: binding.policyId,
+    version: binding.version,
+    previewSafe,
+    evaluate: async (ctx) => {
+      const client = ctx.services?.[serviceKey];
+      if (!client || typeof client.evaluate !== "function") {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "client_unavailable",
+          `No OPA client at ctx.services["${serviceKey}"]`,
+          onError
+        );
+      }
+      let input;
+      try {
+        input = await buildInput(ctx);
+      } catch (err) {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "input_build_failed",
+          `buildInput threw: ${formatError(err)}`,
+          onError
+        );
+      }
+      let inputHash;
+      try {
+        inputHash = hashInput(input);
+      } catch {
+      }
+      let rawResult;
+      try {
+        rawResult = await client.evaluate(binding.decisionPath, input);
+      } catch (err) {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "evaluation_failed",
+          `OPA evaluation failed: ${formatError(err)}`,
+          onError,
+          inputHash
+        );
+      }
+      const parsed = parseOpaDecision(rawResult);
+      if (!parsed.ok) {
+        return makeFailureOutcome(
+          binding,
+          engineVersion,
+          "invalid_response",
+          `OPA returned malformed decision: ${parsed.error}`,
+          onError,
+          inputHash
+        );
+      }
+      return buildSuccessOutcome(
+        binding,
+        engineVersion,
+        parsed.decision,
+        inputHash,
+        ctx,
+        mapDecision
+      );
+    }
+  };
+}
+function buildSuccessOutcome(binding, engineVersion, decision, inputHash, ctx, mapDecision) {
+  const mapped = mapDecision ? mapDecision(decision, ctx) : { result: decision.result, reason: decision.reason };
+  return {
+    policyId: binding.policyId,
+    policyVersion: binding.version,
+    result: mapped.result,
+    reason: mapped.reason,
+    metadata: {
+      ...mapped.metadata ?? {},
+      opaDecision: decision
+    },
+    dispatchEvidence: {
+      policyKind: "code",
+      policyId: binding.policyId,
+      policyVersion: binding.version,
+      dispatchPath: ["code"],
+      engine: {
+        name: ENGINE_NAME,
+        version: engineVersion,
+        metadata: stripUndefined({
+          decisionPath: binding.decisionPath,
+          regoPackage: binding.regoPackage,
+          inputHash,
+          conditionResults: decision.conditionResults,
+          factsUsed: decision.factsUsed,
+          obligations: decision.obligations
+        })
+      }
+    }
+  };
+}
+function makeFailureOutcome(binding, engineVersion, error, reason, onError, inputHash) {
+  if (onError === "throw") {
+    const err = new Error(reason);
+    err.kind = error;
+    throw err;
+  }
+  return {
+    policyId: binding.policyId,
+    policyVersion: binding.version,
+    result: "block",
+    reason,
+    metadata: {
+      opaError: error
+    },
+    dispatchEvidence: {
+      policyKind: "code",
+      policyId: binding.policyId,
+      policyVersion: binding.version,
+      dispatchPath: ["code"],
+      engine: {
+        name: ENGINE_NAME,
+        version: engineVersion,
+        metadata: stripUndefined({
+          decisionPath: binding.decisionPath,
+          regoPackage: binding.regoPackage,
+          inputHash,
+          error,
+          errorReason: reason
+        })
+      }
+    }
+  };
+}
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function formatError(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+
+export { createOpaPolicyEvaluator, defaultHashInput, parseOpaDecision, stableStringify };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/decision-schema.ts","../src/hash.ts","../src/factory.ts"],"names":[],"mappings":";;;AAGA,IAAM,cAAA,GAAoD,CAAC,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA;AAe3E,SAAS,iBAAiB,GAAA,EAAsC;AACtE,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,GAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,cAAA,CAAe,QAAA,CAAS,CAAA,CAAE,MAAgC,CAAA,EAAG;AACjG,IAAA,OAAO;AAAA,MACN,EAAA,EAAI,KAAA;AAAA,MACJ,OAAO,CAAA,8CAAA,EAAiD,IAAA,CAAK,SAAA,CAAU,CAAA,CAAE,MAAM,CAAC,CAAA,CAAA;AAAA,KACjF;AAAA,EACD;AAEA,EAAA,IAAI,EAAE,MAAA,KAAW,MAAA,IAAa,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC3D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sCAAA,EAAuC;AAAA,EACnE;AAEA,EAAA,IAAI,CAAA,CAAE,qBAAqB,MAAA,EAAW;AACrC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,gBAAgB,CAAA,EAAG;AACvC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,gDAAA,EAAiD;AAAA,IAC7E;AACA,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,EAAE,gBAAA,CAAiB,MAAA,EAAQ,KAAK,CAAA,EAAG;AACtD,MAAA,MAAM,MAAM,uBAAA,CAAwB,CAAA,CAAE,gBAAA,CAAiB,CAAC,GAAG,CAAC,CAAA;AAC5D,MAAA,IAAI,KAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,GAAA,EAAI;AAAA,IACzC;AAAA,EACD;AAEA,EAAA,IAAI,EAAE,SAAA,KAAc,MAAA,IAAa,CAAC,aAAA,CAAc,CAAA,CAAE,SAAS,CAAA,EAAG;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,0CAAA,EAA2C;AAAA,EACvE;AAEA,EAAA,IAAI,EAAE,WAAA,KAAgB,MAAA,IAAa,CAAC,aAAA,CAAc,CAAA,CAAE,WAAW,CAAA,EAAG;AACjE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,4CAAA,EAA6C;AAAA,EACzE;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,CAAA,EAA4B;AAC1D;AAEA,SAAS,uBAAA,CAAwB,OAAgB,KAAA,EAA8B;AAC9E,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG;AAC1B,IAAA,OAAO,oBAAoB,KAAK,CAAA,mBAAA,CAAA;AAAA,EACjC;AACA,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,YAAY,CAAA,CAAE,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,IAAA,OAAO,oBAAoB,KAAK,CAAA,wCAAA,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,SAAA,EAAW;AAClC,IAAA,OAAO,oBAAoB,KAAK,CAAA,0BAAA,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,cAAA,CAAe,QAAA,CAAS,CAAA,CAAE,MAAgC,CAAA,EAAG;AACjG,IAAA,OAAO,oBAAoB,KAAK,CAAA,0CAAA,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,EAAE,MAAA,KAAW,MAAA,IAAa,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC3D,IAAA,OAAO,oBAAoB,KAAK,CAAA,sCAAA,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,IAAA;AACR;AAEA,SAAS,cAAc,KAAA,EAAkD;AACxE,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC3E;ACvEO,SAAS,gBAAgB,KAAA,EAAwB;AACvD,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAChC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC5E,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,IAAI,KAAA,CAAM,GAAA,CAAI,eAAe,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAChD;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,EAAA,OAAO,CAAA,CAAA,EAAI,KACT,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,UAAU,CAAC,CAAC,IAAI,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAC,CAAC,EAAE,CAAA,CAC5D,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AACZ;AAOO,SAAS,iBAAiB,KAAA,EAAwC;AACxE,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,gBAAgB,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC5E,EAAA,OAAO,UAAU,GAAG,CAAA,CAAA;AACrB;;;ACdA,IAAM,mBAAA,GAAsB,KAAA;AAC5B,IAAM,WAAA,GAAc,KAAA;AAmBb,SAAS,yBACf,OAAA,EACuB;AACvB,EAAA,MAAM;AAAA,IACL,OAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA,GAAa,mBAAA;AAAA,IACb,OAAA,GAAU,OAAA;AAAA,IACV,WAAA,GAAc,KAAA;AAAA,IACd,aAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,GAAY;AAAA,GACb,GAAI,OAAA;AAEJ,EAAA,OAAO;AAAA,IACN,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,WAAA;AAAA,IACA,QAAA,EAAU,OAAO,GAAA,KAAQ;AACxB,MAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,GAAW,UAAU,CAAA;AACxC,MAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,CAAO,aAAa,UAAA,EAAY;AACrD,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,oBAAA;AAAA,UACA,kCAAkC,UAAU,CAAA,EAAA,CAAA;AAAA,UAC5C;AAAA,SACD;AAAA,MACD;AAEA,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACH,QAAA,KAAA,GAAQ,MAAM,WAAW,GAAG,CAAA;AAAA,MAC7B,SAAS,GAAA,EAAK;AACb,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,oBAAA;AAAA,UACA,CAAA,kBAAA,EAAqB,WAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AAAA,UACrC;AAAA,SACD;AAAA,MACD;AAEA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACH,QAAA,SAAA,GAAY,UAAU,KAAK,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AAAA,MAGR;AAEA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACH,QAAA,SAAA,GAAY,MAAM,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,cAAc,KAAK,CAAA;AAAA,MAC9D,SAAS,GAAA,EAAK;AACb,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,mBAAA;AAAA,UACA,CAAA,uBAAA,EAA0B,WAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AAAA,UAC1C,OAAA;AAAA,UACA;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,MAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACf,QAAA,OAAO,kBAAA;AAAA,UACN,OAAA;AAAA,UACA,aAAA;AAAA,UACA,kBAAA;AAAA,UACA,CAAA,iCAAA,EAAoC,OAAO,KAAK,CAAA,CAAA;AAAA,UAChD,OAAA;AAAA,UACA;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAO,mBAAA;AAAA,QACN,OAAA;AAAA,QACA,aAAA;AAAA,QACA,MAAA,CAAO,QAAA;AAAA,QACP,SAAA;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACD;AAAA,IACD;AAAA,GACD;AACD;AAEA,SAAS,oBACR,OAAA,EACA,aAAA,EACA,QAAA,EACA,SAAA,EACA,KACA,WAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,WAAA,GACZ,WAAA,CAAY,QAAA,EAAU,GAAG,CAAA,GACzB,EAAE,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAO;AAEtD,EAAA,OAAO;AAAA,IACN,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,IACvB,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,QAAA,EAAU;AAAA,MACT,GAAI,MAAA,CAAO,QAAA,IAAY,EAAC;AAAA,MACxB,WAAA,EAAa;AAAA,KACd;AAAA,IACA,gBAAA,EAAkB;AAAA,MACjB,UAAA,EAAY,MAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,MACvB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,OAAA,EAAS,aAAA;AAAA,QACT,UAAU,cAAA,CAAe;AAAA,UACxB,cAAc,OAAA,CAAQ,YAAA;AAAA,UACtB,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,SAAA;AAAA,UACA,kBAAkB,QAAA,CAAS,gBAAA;AAAA,UAC3B,WAAW,QAAA,CAAS,SAAA;AAAA,UACpB,aAAa,QAAA,CAAS;AAAA,SACtB;AAAA;AACF;AACD,GACD;AACD;AAEA,SAAS,mBACR,OAAA,EACA,aAAA,EACA,KAAA,EACA,MAAA,EACA,SACA,SAAA,EACgB;AAChB,EAAA,IAAI,YAAY,OAAA,EAAS;AACxB,IAAA,MAAM,GAAA,GAAM,IAAI,KAAA,CAAM,MAAM,CAAA;AAC5B,IAAC,IAAgD,IAAA,GAAO,KAAA;AACxD,IAAA,MAAM,GAAA;AAAA,EACP;AAEA,EAAA,OAAO;AAAA,IACN,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,IACvB,MAAA,EAAQ,OAAA;AAAA,IACR,MAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACT,QAAA,EAAU;AAAA,KACX;AAAA,IACA,gBAAA,EAAkB;AAAA,MACjB,UAAA,EAAY,MAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,OAAA;AAAA,MACvB,YAAA,EAAc,CAAC,MAAM,CAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,OAAA,EAAS,aAAA;AAAA,QACT,UAAU,cAAA,CAAe;AAAA,UACxB,cAAc,OAAA,CAAQ,YAAA;AAAA,UACtB,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,SAAA;AAAA,UACA,KAAA;AAAA,UACA,WAAA,EAAa;AAAA,SACb;AAAA;AACF;AACD,GACD;AACD;AAEA,SAAS,eAAe,GAAA,EAAuD;AAC9E,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,GAAA;AACR;AAEA,SAAS,YAAY,GAAA,EAAsB;AAC1C,EAAA,IAAI,GAAA,YAAe,KAAA,EAAO,OAAO,GAAA,CAAI,OAAA;AACrC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,GAAA;AACpC,EAAA,IAAI;AACH,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACP,IAAA,OAAO,OAAO,GAAG,CAAA;AAAA,EAClB;AACD","file":"index.js","sourcesContent":["import type { PolicyEvaluationResult } from \"@fabricorg/platform/policies\";\nimport type { OpaDecision } from \"./types\";\n\nconst POLICY_RESULTS: readonly PolicyEvaluationResult[] = [\"pass\", \"warn\", \"block\"];\n\nexport type OpaDecisionParseResult =\n\t| { ok: true; decision: OpaDecision }\n\t| { ok: false; error: string };\n\n/**\n * Hand-rolled validator for the Rego \"house style\" decision shape. Avoids a\n * runtime zod dependency to keep the adapter zero-dep.\n *\n * Accepts a raw OPA result and either returns the parsed `OpaDecision` or a\n * single human-readable error string describing the first violation. We don't\n * accumulate every error: when audit evidence has to record \"OPA returned\n * something invalid\", one precise reason is more useful than a list.\n */\nexport function parseOpaDecision(raw: unknown): OpaDecisionParseResult {\n\tif (raw === null || typeof raw !== \"object\") {\n\t\treturn { ok: false, error: \"decision must be an object\" };\n\t}\n\n\tconst d = raw as Record<string, unknown>;\n\n\tif (typeof d.result !== \"string\" || !POLICY_RESULTS.includes(d.result as PolicyEvaluationResult)) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: `result must be \"pass\" | \"warn\" | \"block\" (got ${JSON.stringify(d.result)})`,\n\t\t};\n\t}\n\n\tif (d.reason !== undefined && typeof d.reason !== \"string\") {\n\t\treturn { ok: false, error: \"reason must be a string when present\" };\n\t}\n\n\tif (d.conditionResults !== undefined) {\n\t\tif (!Array.isArray(d.conditionResults)) {\n\t\t\treturn { ok: false, error: \"conditionResults must be an array when present\" };\n\t\t}\n\t\tfor (let i = 0; i < d.conditionResults.length; i += 1) {\n\t\t\tconst err = validateConditionResult(d.conditionResults[i], i);\n\t\t\tif (err) return { ok: false, error: err };\n\t\t}\n\t}\n\n\tif (d.factsUsed !== undefined && !isPlainObject(d.factsUsed)) {\n\t\treturn { ok: false, error: \"factsUsed must be an object when present\" };\n\t}\n\n\tif (d.obligations !== undefined && !isPlainObject(d.obligations)) {\n\t\treturn { ok: false, error: \"obligations must be an object when present\" };\n\t}\n\n\treturn { ok: true, decision: d as unknown as OpaDecision };\n}\n\nfunction validateConditionResult(value: unknown, index: number): string | null {\n\tif (!isPlainObject(value)) {\n\t\treturn `conditionResults[${index}] must be an object`;\n\t}\n\tconst c = value as Record<string, unknown>;\n\tif (typeof c.conditionId !== \"string\" || c.conditionId.length === 0) {\n\t\treturn `conditionResults[${index}].conditionId must be a non-empty string`;\n\t}\n\tif (typeof c.passed !== \"boolean\") {\n\t\treturn `conditionResults[${index}].passed must be a boolean`;\n\t}\n\tif (typeof c.result !== \"string\" || !POLICY_RESULTS.includes(c.result as PolicyEvaluationResult)) {\n\t\treturn `conditionResults[${index}].result must be \"pass\" | \"warn\" | \"block\"`;\n\t}\n\tif (c.reason !== undefined && typeof c.reason !== \"string\") {\n\t\treturn `conditionResults[${index}].reason must be a string when present`;\n\t}\n\treturn null;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n","import { createHash } from \"node:crypto\";\n\n/**\n * Stable JSON stringify — sorts object keys recursively so two\n * structurally-equal inputs produce the same string regardless of property\n * insertion order. Required for hash determinism across builds of the same\n * `buildInput` function.\n */\nexport function stableStringify(value: unknown): string {\n\tif (value === undefined) return \"null\";\n\tif (value === null || typeof value !== \"object\") return JSON.stringify(value);\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map(stableStringify).join(\",\")}]`;\n\t}\n\tconst obj = value as Record<string, unknown>;\n\tconst keys = Object.keys(obj).sort();\n\treturn `{${keys\n\t\t.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)\n\t\t.join(\",\")}}`;\n}\n\n/**\n * Default input hasher: SHA-256 over a stable stringification.\n * Format: `sha256:<hex>` — namespaced so future migrations to a different\n * algorithm can be detected by a prefix check in evidence dashboards.\n */\nexport function defaultHashInput(input: Record<string, unknown>): string {\n\tconst hex = createHash(\"sha256\").update(stableStringify(input)).digest(\"hex\");\n\treturn `sha256:${hex}`;\n}\n","import type {\n\tPolicyContext,\n\tPolicyEvaluator,\n\tPolicyOutcome,\n} from \"@fabricorg/platform/policies\";\n\nimport { parseOpaDecision } from \"./decision-schema\";\nimport { defaultHashInput } from \"./hash\";\nimport type {\n\tCreateOpaPolicyEvaluatorOptions,\n\tOpaDecision,\n\tOpaPolicyClient,\n\tOpaPolicyFailureKind,\n} from \"./types\";\n\nconst DEFAULT_SERVICE_KEY = \"opa\";\nconst ENGINE_NAME = \"opa\";\n\n/**\n * Build a Fabric `PolicyEvaluator` that delegates decision-making to an OPA\n * (Open Policy Agent) deployment. The evaluator:\n *\n * 1. Reads the host-injected OPA client from `ctx.services[serviceKey]`.\n * 2. Builds a JSON input snapshot via `buildInput(ctx)` — domain code that\n *    snapshots facts the engine needs. Fabric platform never lets OPA reach\n *    into the database directly; all facts flow through this function.\n * 3. Evaluates the Rego decision at `binding.decisionPath`.\n * 4. Validates the response against the house-style shape (`OpaDecision`).\n * 5. Maps the decision to a `PolicyOutcome` and attaches engine provenance\n *    (`engine.name = \"opa\"`, `decisionPath`, `inputHash`) for audit.\n *\n * Failures (missing client, build failure, network failure, malformed response)\n * are governed by `onError`. Default `\"block\"` honors Fabric's default-deny\n * posture and records the failure category under `engine.metadata.error`.\n */\nexport function createOpaPolicyEvaluator<TDb = unknown>(\n\toptions: CreateOpaPolicyEvaluatorOptions<TDb>,\n): PolicyEvaluator<TDb> {\n\tconst {\n\t\tbinding,\n\t\tbuildInput,\n\t\tserviceKey = DEFAULT_SERVICE_KEY,\n\t\tonError = \"block\",\n\t\tpreviewSafe = false,\n\t\tengineVersion,\n\t\tmapDecision,\n\t\thashInput = defaultHashInput,\n\t} = options;\n\n\treturn {\n\t\tpolicyId: binding.policyId,\n\t\tversion: binding.version,\n\t\tpreviewSafe,\n\t\tevaluate: async (ctx) => {\n\t\t\tconst client = ctx.services?.[serviceKey] as OpaPolicyClient | undefined;\n\t\t\tif (!client || typeof client.evaluate !== \"function\") {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"client_unavailable\",\n\t\t\t\t\t`No OPA client at ctx.services[\"${serviceKey}\"]`,\n\t\t\t\t\tonError,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tlet input: Record<string, unknown>;\n\t\t\ttry {\n\t\t\t\tinput = await buildInput(ctx);\n\t\t\t} catch (err) {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"input_build_failed\",\n\t\t\t\t\t`buildInput threw: ${formatError(err)}`,\n\t\t\t\t\tonError,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tlet inputHash: string | undefined;\n\t\t\ttry {\n\t\t\t\tinputHash = hashInput(input);\n\t\t\t} catch {\n\t\t\t\t// hashing is best-effort — if a custom hasher throws, omit the\n\t\t\t\t// field rather than fail the policy.\n\t\t\t}\n\n\t\t\tlet rawResult: unknown;\n\t\t\ttry {\n\t\t\t\trawResult = await client.evaluate(binding.decisionPath, input);\n\t\t\t} catch (err) {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"evaluation_failed\",\n\t\t\t\t\t`OPA evaluation failed: ${formatError(err)}`,\n\t\t\t\t\tonError,\n\t\t\t\t\tinputHash,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst parsed = parseOpaDecision(rawResult);\n\t\t\tif (!parsed.ok) {\n\t\t\t\treturn makeFailureOutcome(\n\t\t\t\t\tbinding,\n\t\t\t\t\tengineVersion,\n\t\t\t\t\t\"invalid_response\",\n\t\t\t\t\t`OPA returned malformed decision: ${parsed.error}`,\n\t\t\t\t\tonError,\n\t\t\t\t\tinputHash,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn buildSuccessOutcome(\n\t\t\t\tbinding,\n\t\t\t\tengineVersion,\n\t\t\t\tparsed.decision,\n\t\t\t\tinputHash,\n\t\t\t\tctx,\n\t\t\t\tmapDecision,\n\t\t\t);\n\t\t},\n\t};\n}\n\nfunction buildSuccessOutcome<TDb>(\n\tbinding: CreateOpaPolicyEvaluatorOptions<TDb>[\"binding\"],\n\tengineVersion: string | undefined,\n\tdecision: OpaDecision,\n\tinputHash: string | undefined,\n\tctx: PolicyContext<TDb>,\n\tmapDecision: CreateOpaPolicyEvaluatorOptions<TDb>[\"mapDecision\"],\n): PolicyOutcome {\n\tconst mapped = mapDecision\n\t\t? mapDecision(decision, ctx)\n\t\t: { result: decision.result, reason: decision.reason };\n\n\treturn {\n\t\tpolicyId: binding.policyId,\n\t\tpolicyVersion: binding.version,\n\t\tresult: mapped.result,\n\t\treason: mapped.reason,\n\t\tmetadata: {\n\t\t\t...(mapped.metadata ?? {}),\n\t\t\topaDecision: decision,\n\t\t},\n\t\tdispatchEvidence: {\n\t\t\tpolicyKind: \"code\",\n\t\t\tpolicyId: binding.policyId,\n\t\t\tpolicyVersion: binding.version,\n\t\t\tdispatchPath: [\"code\"],\n\t\t\tengine: {\n\t\t\t\tname: ENGINE_NAME,\n\t\t\t\tversion: engineVersion,\n\t\t\t\tmetadata: stripUndefined({\n\t\t\t\t\tdecisionPath: binding.decisionPath,\n\t\t\t\t\tregoPackage: binding.regoPackage,\n\t\t\t\t\tinputHash,\n\t\t\t\t\tconditionResults: decision.conditionResults,\n\t\t\t\t\tfactsUsed: decision.factsUsed,\n\t\t\t\t\tobligations: decision.obligations,\n\t\t\t\t}),\n\t\t\t},\n\t\t},\n\t};\n}\n\nfunction makeFailureOutcome(\n\tbinding: CreateOpaPolicyEvaluatorOptions[\"binding\"],\n\tengineVersion: string | undefined,\n\terror: OpaPolicyFailureKind,\n\treason: string,\n\tonError: \"block\" | \"throw\",\n\tinputHash?: string,\n): PolicyOutcome {\n\tif (onError === \"throw\") {\n\t\tconst err = new Error(reason);\n\t\t(err as Error & { kind?: OpaPolicyFailureKind }).kind = error;\n\t\tthrow err;\n\t}\n\n\treturn {\n\t\tpolicyId: binding.policyId,\n\t\tpolicyVersion: binding.version,\n\t\tresult: \"block\",\n\t\treason,\n\t\tmetadata: {\n\t\t\topaError: error,\n\t\t},\n\t\tdispatchEvidence: {\n\t\t\tpolicyKind: \"code\",\n\t\t\tpolicyId: binding.policyId,\n\t\t\tpolicyVersion: binding.version,\n\t\t\tdispatchPath: [\"code\"],\n\t\t\tengine: {\n\t\t\t\tname: ENGINE_NAME,\n\t\t\t\tversion: engineVersion,\n\t\t\t\tmetadata: stripUndefined({\n\t\t\t\t\tdecisionPath: binding.decisionPath,\n\t\t\t\t\tregoPackage: binding.regoPackage,\n\t\t\t\t\tinputHash,\n\t\t\t\t\terror,\n\t\t\t\t\terrorReason: reason,\n\t\t\t\t}),\n\t\t\t},\n\t\t},\n\t};\n}\n\nfunction stripUndefined(obj: Record<string, unknown>): Record<string, unknown> {\n\tconst out: Record<string, unknown> = {};\n\tfor (const [k, v] of Object.entries(obj)) {\n\t\tif (v !== undefined) out[k] = v;\n\t}\n\treturn out;\n}\n\nfunction formatError(err: unknown): string {\n\tif (err instanceof Error) return err.message;\n\tif (typeof err === \"string\") return err;\n\ttry {\n\t\treturn JSON.stringify(err);\n\t} catch {\n\t\treturn String(err);\n\t}\n}\n"]}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@fabricorg/policy-opa",
+  "version": "0.1.0",
+  "description": "Open Policy Agent (OPA) adapter for @fabricorg/platform. Wraps a Rego decision behind Fabric's PolicyEvaluator contract — Fabric keeps policyId.vN canonical for audit; engine evidence carries OPA provenance (decision path, input hash, bundle revision). Zero coupling to a specific OPA SDK; structurally typed client.",
+  "keywords": [
+    "fabric",
+    "fabricorg",
+    "policy",
+    "opa",
+    "open-policy-agent",
+    "rego",
+    "authorization",
+    "policy-engine"
+  ],
+  "license": "MIT",
+  "author": "Fabric",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Fabric-Pro/fabric-platform.git",
+    "directory": "packages/policy-opa"
+  },
+  "homepage": "https://github.com/Fabric-Pro/fabric-platform#readme",
+  "bugs": {
+    "url": "https://github.com/Fabric-Pro/fabric-platform/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "peerDependencies": {
+    "@fabricorg/platform": "^0.3.2"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.5",
+    "@fabricorg/platform": "0.3.2"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "build": "tsup",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}