@gate-forge/core 0.10.4 → 0.11.0

package/dist/policy/business-rules.d.ts

@@ -0,0 +1,143 @@
+import { type BusinessRule, type BusinessRuleCaseStatus, type BusinessRuleTestType, type BusinessRuleTypeRow } from '../schemas/business-rules.js';
+import { type CauseCode } from '../schemas/verdict.js';
+import type { EvidenceRecord } from '../schemas/evidence.js';
+/** One bound test, as the resolver produced it (a DECLARATION, not proof). */
+export interface BusinessRuleBinding {
+    /** Stable catalog logical key the declaration resolves to. */
+    logicalKey: string;
+    /** Declaration origin; only `native`/`sidecar` grade. */
+    origin: 'native' | 'sidecar' | 'inferred' | 'prior-run';
+    /** Declared kind, when the declaration named one. */
+    declaredKind: string | null;
+    /** Runner the bound instances execute under. */
+    runner: string;
+    /** True when discovery observed the spec mocking the system under test. */
+    mocked: boolean;
+    /** The sidecar declaration's review reason, when present. */
+    reason: string | null;
+    /** The test's source file (repo-relative), for starter-test rendering. */
+    file: string;
+}
+/** One test's SEALED facts of the run being graded. */
+export interface BusinessRuleTestFact {
+    /** Catalog logical key. */
+    logicalKey: string;
+    /** Runner the sealed run executed it under. */
+    runner: string;
+    /** Outcome the supervision observed (never the reporter's own summary). */
+    status: 'passed' | 'failed' | 'skipped' | 'fixme' | 'not-run';
+    /**
+     * Whether the sealed run's GRADED SLICE selected this test. False on a
+     * `--scope changed` run that did not select it: the case is reported as
+     * `unproven (outside this run's graded slice)`, never silently absent
+     * and never satisfied by a receipt that never covered it.
+     */
+    inGradedSlice: boolean;
+    /** Witness session ids the sealed run attributed to this test. */
+    sessionIds: readonly string[];
+}
+/**
+ * The sealed facts one run makes available to the evaluator. `null`
+ * (no sealed run) is the honest static-`check` input: everything mapped
+ * is `unproven` until a run exists.
+ */
+export interface BusinessRuleRunFacts {
+    /** The receipt's evaluation scope. */
+    scope: 'full' | 'changed';
+    /** True for the engine-owned docs-only slice (zero records by construction). */
+    docsOnly: boolean;
+    /** Per-test sealed facts keyed by catalog logicalKey. */
+    tests: ReadonlyMap<string, BusinessRuleTestFact>;
+    /** The sealed run's witness evidence records. */
+    records: readonly EvidenceRecord[];
+    /** Runners whose suite the owner declared WITNESSED for this run. */
+    witnessedRunners: ReadonlySet<string>;
+}
+/** Configuration error: a rule names a subject the inventory cannot see. */
+export interface BusinessRuleConfigError {
+    /** Always `BUSINESS_RULE_SUBJECT_UNKNOWN`. */
+    code: 'BUSINESS_RULE_SUBJECT_UNKNOWN';
+    /** The rule the error is scoped to. */
+    ruleId: string;
+    /** The unknown subject name. */
+    subject: string;
+    /** Single-cause explanation; callers turn this into exit 2. */
+    detail: string;
+}
+/** One typed rule finding (blocking or advisory, decided by the caller). */
+export interface BusinessRuleFinding {
+    /** Stable finding code; equal to `cause`. */
+    code: CauseCode;
+    /** The report cause code. */
+    cause: CauseCode;
+    /** Owning rule id. */
+    ruleId: string;
+    /** Owning case id. */
+    caseId: string;
+    /** The claim id the case is mapped by. */
+    claimId: string;
+    /** Single-cause explanation naming the rule, the case and the gap. */
+    detail: string;
+    /** The shared next action for this cause. */
+    nextAction: string;
+    /** The mapped test keys the finding is about (sorted, possibly empty). */
+    tests: readonly string[];
+}
+/** One graded rule case. */
+export interface BusinessRuleCaseResult {
+    /** Owning rule id. */
+    ruleId: string;
+    /** Owning case id. */
+    caseId: string;
+    /** The claim id this case is mapped by. */
+    claimId: string;
+    /** The graded status. */
+    status: BusinessRuleCaseStatus;
+    /** The proof channel when satisfied (e.g. `observe`), else null. */
+    channel: string | null;
+    /** Sorted logical keys of the gradeable mapped tests. */
+    mappedTests: readonly string[];
+    /** The typed finding when the case is not satisfied; null when satisfied. */
+    finding: BusinessRuleFinding | null;
+}
+/** The complete evaluator result. */
+export interface BusinessRuleEvaluation {
+    configErrors: BusinessRuleConfigError[];
+    /** Every case of every rule, sorted by rule id then case id. */
+    cases: BusinessRuleCaseResult[];
+}
+/** Inputs of {@link evaluateBusinessRules}. */
+export interface EvaluateBusinessRulesInput {
+    /** The owner rules, already validated. */
+    rules: readonly BusinessRule[];
+    /** Resolved rule bindings keyed by claim id. */
+    bindings: ReadonlyMap<string, readonly BusinessRuleBinding[]>;
+    /** The resource names this run discovered (validates `subject`). */
+    inventory: readonly string[];
+    /** The sealed run's facts, or null when no sealed run exists. */
+    runFacts: BusinessRuleRunFacts | null;
+    /** Type table override (tests); defaults to the shipped table. */
+    typeTable?: Readonly<Record<BusinessRuleTestType, BusinessRuleTypeRow>>;
+}
+/**
+ * Grades every case of every rule. A rule with no `subject` is graded
+ * regardless of the inventory; a rule naming a subject the inventory
+ * cannot see is a CONFIGURATION ERROR (the caller exits 2) because a name
+ * the inventory cannot see is silently uncheckable.
+ *
+ * Args:
+ *   input: rules, resolved bindings, the run's resource inventory, and the
+ *     sealed run's facts (`null` when no sealed run exists).
+ *
+ * Returns:
+ *   BusinessRuleEvaluation: config errors plus every case, sorted by rule
+ *   id then case id.
+ */
+export declare function evaluateBusinessRules(input: EvaluateBusinessRulesInput): BusinessRuleEvaluation;
+/** Whether a case result is one of the four findings the gate reports. */
+export declare function isBusinessRuleFinding(result: BusinessRuleCaseResult): result is BusinessRuleCaseResult & {
+    finding: BusinessRuleFinding;
+};
+/** Worst status among a rule's cases (`satisfied` when it has none). */
+export declare function worstBusinessRuleStatus(results: readonly BusinessRuleCaseResult[]): BusinessRuleCaseStatus;
+//# sourceMappingURL=business-rules.d.ts.map

package/dist/policy/business-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-rules.d.ts","sourceRoot":"","sources":["../../src/policy/business-rules.ts"],"names":[],"mappings":"AAmCA,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAQ7D,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IACxD,qDAAqD;IACrD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAC9D;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,EAAE,OAAO,CAAC;IAClB,yDAAyD;IACzD,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACjD,iDAAiD;IACjD,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,qEAAqE;IACrE,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,8CAA8C;IAC9C,IAAI,EAAE,+BAA+B,CAAC;IACtC,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,IAAI,EAAE,SAAS,CAAC;IAChB,6BAA6B;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,4BAA4B;AAC5B,MAAM,WAAW,sBAAsB;IACrC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,oEAAoE;IACpE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,yDAAyD;IACzD,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACrC;AAuBD,qCAAqC;AACrC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,uBAAuB,EAAE,CAAC;IACxC,gEAAgE;IAChE,KAAK,EAAE,sBAAsB,EAAE,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IAC/B,gDAAgD;IAChD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAC9D,oEAAoE;IACpE,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,kEAAkE;IAClE,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC,CAAC;CACzE;AA4PD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,sBAAsB,CA8B/F;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,IAAI,sBAAsB,GAAG;IAAE,OAAO,EAAE,mBAAmB,CAAA;CAAE,CAErE;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,GAAG,sBAAsB,CAM1G"}

package/dist/policy/business-rules.js

@@ -0,0 +1,314 @@
+/**
+ * Owner-declared BUSINESS RULES evaluator (plan 2026-10-05 §4/D4).
+ *
+ * Pure and deterministic, exactly like the closed-world coverage
+ * evaluator it is modelled on: given the owner rules, the type table,
+ * the resolver's rule bindings, the derived test catalog and (optionally)
+ * the SEALED facts of one run, it returns one status per rule case plus
+ * typed findings. It never reads a file, never reads an environment
+ * variable and never mutates its inputs.
+ *
+ * The four statuses, and the honesty each one carries:
+ *
+ * | status       | meaning                                                          |
+ * |--------------|------------------------------------------------------------------|
+ * | `unmapped`   | no gradeable binding of an accepted kind exists                   |
+ * | `wrong-type` | bindings exist, but none of an accepted kind/runner              |
+ * | `unproven`   | mapped, but no sealed run / not executed / outside the graded     |
+ * |              | slice / missing the type's proof                                  |
+ * | `failing`    | a mapped test of an accepted kind failed                          |
+ * | `satisfied`  | EVERY mapped test of an accepted kind passed with the type's      |
+ * |              | proof; the report names the channel (`satisfied (observe)`)       |
+ *
+ * Invariants this function is built to hold:
+ * - a DECLARATION is never proof — a mapping alone is at best `unmapped`
+ *   resolved into `unproven` until a sealed run says otherwise;
+ * - no WEAKER kind satisfies a stronger type (the type table is
+ *   closed-world; a row never inherits another row's kinds);
+ * - a mocked spec, a quarantined test (dropped by the resolver before
+ *   this call) and an inferred-only binding never satisfy;
+ * - a GREEN sibling never forgives a RED one — one failing mapped test
+ *   makes the whole case `failing`;
+ * - findings sort by rule id then case id, so the same inputs always
+ *   produce the same output.
+ */
+import { compareStrings } from '../graph/util.js';
+import { BUSINESS_RULE_TYPE_TABLE, businessRuleClaimId, casesOf, } from '../schemas/business-rules.js';
+import { CAUSE_NEXT_ACTIONS } from '../schemas/verdict.js';
+/** The record kind a `browser-e2e` binding must have produced. */
+const BROWSER_ANCHOR_KIND = 'ui.action';
+/** The record kind an `observed-e2e` binding must have produced. */
+const OBSERVED_EXCHANGE_KIND = 'http.request';
+/**
+ * Whether the sealed run holds a record of `kind` attributable to one of
+ * the test's own witness sessions. This is the WP3 attribution: the run's
+ * session trace joins a test to its session ids, and a record carrying
+ * `payload.sessionId` joins the session back to the test — no obligation
+ * claim is involved anywhere in that join.
+ */
+function sessionProves(facts, sessionIds, kind) {
+    if (sessionIds.length === 0)
+        return false;
+    const sessions = new Set(sessionIds);
+    return facts.records.some((record) => {
+        if (record.kind !== kind)
+            return false;
+        const session = sessionIdOf(record);
+        return session !== null && sessions.has(session);
+    });
+}
+/** Statuses ordered by how badly a case is doing (worst first). */
+const STATUS_SEVERITY = Object.freeze({
+    unmapped: 0,
+    'wrong-type': 1,
+    failing: 2,
+    unproven: 3,
+    satisfied: 4,
+});
+/** The session id a record was stamped under, when it carries one. */
+function sessionIdOf(record) {
+    const payload = record.payload;
+    if (payload === null || typeof payload !== 'object' || Array.isArray(payload))
+        return null;
+    const value = payload['sessionId'];
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+/** The record kind a binding's accepted test kind must have produced. */
+function anchorKindFor(kind) {
+    if (kind === 'browser-e2e')
+        return BROWSER_ANCHOR_KIND;
+    if (kind === 'observed-e2e')
+        return OBSERVED_EXCHANGE_KIND;
+    return null;
+}
+/** Grades one accepted binding against the sealed facts. */
+function gradeBinding(binding, kind, row, facts) {
+    if (facts === null) {
+        return {
+            failing: null,
+            unproven: {
+                logicalKey: binding.logicalKey,
+                detail: `test '${binding.logicalKey}' is mapped but no sealed supervised run exists yet — ` +
+                    'a mapping is a declaration, never a proof (`gateforge test-gates`)',
+            },
+        };
+    }
+    const fact = facts.tests.get(binding.logicalKey);
+    if (fact === undefined) {
+        return {
+            failing: null,
+            unproven: {
+                logicalKey: binding.logicalKey,
+                detail: `test '${binding.logicalKey}' is mapped but the sealed run did not execute it — ` +
+                    'a test that did not run proves nothing',
+            },
+        };
+    }
+    if (!fact.inGradedSlice) {
+        return {
+            failing: null,
+            unproven: {
+                logicalKey: binding.logicalKey,
+                detail: `test '${binding.logicalKey}' is mapped but sits outside this run's graded slice ` +
+                    `(scope '${facts.scope}') — re-run without the narrowed scope, or let the slice select it`,
+            },
+        };
+    }
+    if (fact.status === 'failed') {
+        return { failing: binding.logicalKey, unproven: null };
+    }
+    if (fact.status !== 'passed') {
+        return {
+            failing: null,
+            unproven: {
+                logicalKey: binding.logicalKey,
+                detail: `test '${binding.logicalKey}' is mapped but the sealed run recorded it as ` +
+                    `'${fact.status}' — only a passing run proves the rule`,
+            },
+        };
+    }
+    if (row.requiresWitnessedSuite && !facts.witnessedRunners.has(row.runner)) {
+        return {
+            failing: null,
+            unproven: {
+                logicalKey: binding.logicalKey,
+                detail: `test '${binding.logicalKey}' passed, but no WITNESSED ${row.runner} suite ran in the ` +
+                    `sealed run — mark the suite witnessed (\`diagnostics.suites[].witnessed\` in .gateforge.yml); ` +
+                    'an unwitnessed suite is not proof',
+            },
+        };
+    }
+    const anchor = anchorKindFor(kind);
+    if (anchor !== null && !sessionProves(facts, fact.sessionIds, anchor)) {
+        return {
+            failing: null,
+            unproven: {
+                logicalKey: binding.logicalKey,
+                detail: `test '${binding.logicalKey}' passed but produced no '${anchor}' witness record ` +
+                    'attributable to its own session — a ' + kind + ' test must run on the Gateforge fixture ' +
+                    "(`@gate-forge/pack-playwright/fixture`) so the witness sees the journey",
+            },
+        };
+    }
+    return { failing: null, unproven: null };
+}
+/**
+ * Grades one rule case. Pure; `bindings` are the case's gradeable
+ * bindings (the resolver has already dropped quarantined and stale
+ * ones).
+ */
+function gradeCase(rule, caseId, describe, bindings, typeTable, facts) {
+    const claimId = businessRuleClaimId(rule.id, caseId);
+    const row = typeTable[rule.test];
+    const gradeable = bindings.filter((binding) => binding.origin === 'native' || binding.origin === 'sidecar');
+    const mappedTests = [...new Set(gradeable.map((binding) => binding.logicalKey))].sort(compareStrings);
+    const finding = (code, detail, tests) => ({
+        code,
+        cause: code,
+        ruleId: rule.id,
+        caseId,
+        claimId,
+        detail: `business rule '${rule.id}' case '${caseId}' (${describe}): ${detail}`,
+        nextAction: CAUSE_NEXT_ACTIONS[code],
+        tests,
+    });
+    if (gradeable.length === 0) {
+        return {
+            ruleId: rule.id,
+            caseId,
+            claimId,
+            status: 'unmapped',
+            channel: null,
+            mappedTests: [],
+            finding: finding('BUSINESS_RULE_TEST_MISSING', `no test is mapped for this case; the rule needs a '${row.label}' test ` +
+                `(${row.acceptedKinds.join(' or ')}) — \`gateforge next\` prints a starter and the exact mark command`, []),
+        };
+    }
+    const accepted = gradeable.filter((binding) => row.acceptedKinds.includes(binding.declaredKind ?? '') && binding.runner === row.runner);
+    if (accepted.length === 0) {
+        const kinds = [...new Set(gradeable.map((binding) => binding.declaredKind ?? 'undeclared'))].sort(compareStrings);
+        return {
+            ruleId: rule.id,
+            caseId,
+            claimId,
+            status: 'wrong-type',
+            channel: null,
+            mappedTests,
+            finding: finding('BUSINESS_RULE_TEST_TYPE_MISMATCH', `the ${kinds.join('/')} test(s) mapped to this case cannot prove a '${row.label}' rule: ` +
+                `this type accepts ${row.acceptedKinds.join(' or ')} under runner '${row.runner}' ` +
+                '(a weaker kind never satisfies a stronger type)', mappedTests),
+        };
+    }
+    const unmocked = accepted.filter((binding) => !binding.mocked);
+    const failing = [];
+    const unproven = [];
+    const channels = new Set();
+    for (const binding of unmocked) {
+        const kind = binding.declaredKind;
+        const graded = gradeBinding(binding, kind, row, facts);
+        if (graded.failing !== null)
+            failing.push(graded.failing);
+        if (graded.unproven !== null)
+            unproven.push(graded.unproven);
+        if (graded.failing === null && graded.unproven === null) {
+            channels.add(row.kindChannels[kind] ?? row.defaultChannel);
+        }
+    }
+    const acceptedTests = [...new Set(accepted.map((binding) => binding.logicalKey))].sort(compareStrings);
+    if (unmocked.length < accepted.length) {
+        const mockedKeys = accepted.filter((binding) => binding.mocked).map((binding) => binding.logicalKey);
+        unproven.push({
+            logicalKey: mockedKeys.sort(compareStrings)[0] ?? '',
+            detail: `test(s) ${mockedKeys.sort(compareStrings).join(', ')} mock the system under test — ` +
+                "a mocked spec never proves an end-to-end rule (the catalog observed an interception in the file)",
+        });
+    }
+    if (failing.length > 0) {
+        const failed = [...new Set(failing)].sort(compareStrings);
+        return {
+            ruleId: rule.id,
+            caseId,
+            claimId,
+            status: 'failing',
+            channel: null,
+            mappedTests,
+            finding: finding('BUSINESS_RULE_TEST_FAILING', `mapped test(s) ${failed.join(', ')} failed in the sealed run; every mapped test of a case ` +
+                'must pass (a green sibling never forgives a red one)', failed),
+        };
+    }
+    if (unproven.length > 0) {
+        const sorted = [...unproven].sort((a, b) => compareStrings(a.logicalKey, b.logicalKey));
+        return {
+            ruleId: rule.id,
+            caseId,
+            claimId,
+            status: 'unproven',
+            channel: null,
+            mappedTests,
+            finding: finding('BUSINESS_RULE_TEST_UNPROVEN', sorted.map((entry) => entry.detail).join('; '), sorted.map((entry) => entry.logicalKey).filter((key) => key.length > 0)),
+        };
+    }
+    return {
+        ruleId: rule.id,
+        caseId,
+        claimId,
+        status: 'satisfied',
+        channel: [...channels].sort(compareStrings).join('+') || row.defaultChannel,
+        mappedTests,
+        finding: null,
+    };
+}
+/**
+ * Grades every case of every rule. A rule with no `subject` is graded
+ * regardless of the inventory; a rule naming a subject the inventory
+ * cannot see is a CONFIGURATION ERROR (the caller exits 2) because a name
+ * the inventory cannot see is silently uncheckable.
+ *
+ * Args:
+ *   input: rules, resolved bindings, the run's resource inventory, and the
+ *     sealed run's facts (`null` when no sealed run exists).
+ *
+ * Returns:
+ *   BusinessRuleEvaluation: config errors plus every case, sorted by rule
+ *   id then case id.
+ */
+export function evaluateBusinessRules(input) {
+    const typeTable = input.typeTable ?? BUSINESS_RULE_TYPE_TABLE;
+    const inventory = new Set(input.inventory);
+    const configErrors = [];
+    const cases = [];
+    const rules = [...input.rules].sort((a, b) => compareStrings(a.id, b.id));
+    for (const rule of rules) {
+        if (rule.subject !== undefined && !inventory.has(rule.subject)) {
+            configErrors.push({
+                code: 'BUSINESS_RULE_SUBJECT_UNKNOWN',
+                ruleId: rule.id,
+                subject: rule.subject,
+                detail: `business rule '${rule.id}' names subject '${rule.subject}', which is not present in the ` +
+                    'current resource inventory; a subject the inventory cannot see is silently uncheckable, so ' +
+                    'the run fails as a configuration error (ranking and display only — a subject is never proof)',
+            });
+            continue;
+        }
+        for (const businessCase of casesOf(rule)) {
+            const claimId = businessRuleClaimId(rule.id, businessCase.id);
+            cases.push(gradeCase(rule, businessCase.id, businessCase.describe, input.bindings.get(claimId) ?? [], typeTable, input.runFacts));
+        }
+    }
+    cases.sort((a, b) => compareStrings(a.ruleId, b.ruleId) || compareStrings(a.caseId, b.caseId));
+    return { configErrors, cases };
+}
+/** Whether a case result is one of the four findings the gate reports. */
+export function isBusinessRuleFinding(result) {
+    return result.finding !== null;
+}
+/** Worst status among a rule's cases (`satisfied` when it has none). */
+export function worstBusinessRuleStatus(results) {
+    let worst = 'satisfied';
+    for (const result of results) {
+        if (STATUS_SEVERITY[result.status] < STATUS_SEVERITY[worst])
+            worst = result.status;
+    }
+    return worst;
+}
+//# sourceMappingURL=business-rules.js.map

package/dist/policy/business-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-rules.js","sourceRoot":"","sources":["../../src/policy/business-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,OAAO,GAKR,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAkB,MAAM,uBAAuB,CAAC;AAG3E,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAExC,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,cAAc,CAAC;AA2G9C;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,KAA2B,EAC3B,UAA6B,EAC7B,IAAY;IAEZ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAuBD,mEAAmE;AACnE,MAAM,eAAe,GAAqD,MAAM,CAAC,MAAM,CAAC;IACtF,QAAQ,EAAE,CAAC;IACX,YAAY,EAAE,CAAC;IACf,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,SAAS,EAAE,CAAC;CACb,CAAC,CAAC;AAEH,sEAAsE;AACtE,SAAS,WAAW,CAAC,MAAsB;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,KAAK,GAAI,OAAmC,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAGD,yEAAyE;AACzE,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,mBAAmB,CAAC;IACvD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,sBAAsB,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,4DAA4D;AAC5D,SAAS,YAAY,CACnB,OAA4B,EAC5B,IAAY,EACZ,GAAwB,EACxB,KAAkC;IAElC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EACJ,SAAS,OAAO,CAAC,UAAU,wDAAwD;oBACnF,oEAAoE;aACvE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EACJ,SAAS,OAAO,CAAC,UAAU,sDAAsD;oBACjF,wCAAwC;aAC3C;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EACJ,SAAS,OAAO,CAAC,UAAU,uDAAuD;oBAClF,WAAW,KAAK,CAAC,KAAK,oEAAoE;aAC7F;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EACJ,SAAS,OAAO,CAAC,UAAU,gDAAgD;oBAC3E,IAAI,IAAI,CAAC,MAAM,wCAAwC;aAC1D;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,sBAAsB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EACJ,SAAS,OAAO,CAAC,UAAU,8BAA8B,GAAG,CAAC,MAAM,oBAAoB;oBACvF,gGAAgG;oBAChG,mCAAmC;aACtC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EACJ,SAAS,OAAO,CAAC,UAAU,6BAA6B,MAAM,mBAAmB;oBACjF,sCAAsC,GAAG,IAAI,GAAG,0CAA0C;oBAC1F,yEAAyE;aAC5E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,IAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,QAAwC,EACxC,SAAsE,EACtE,KAAkC;IAElC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC5G,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,IAAe,EAAE,MAAc,EAAE,KAAwB,EAAuB,EAAE,CAAC,CAAC;QACnG,IAAI;QACJ,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;QACN,OAAO;QACP,MAAM,EAAE,kBAAkB,IAAI,CAAC,EAAE,WAAW,MAAM,MAAM,QAAQ,MAAM,MAAM,EAAE;QAC9E,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC;QACpC,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM;YACN,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,OAAO,CACd,4BAA4B,EAC5B,sDAAsD,GAAG,CAAC,KAAK,SAAS;gBACtE,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,oEAAoE,EACxG,EAAE,CACH;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CACrG,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM;YACN,OAAO;YACP,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,IAAI;YACb,WAAW;YACX,OAAO,EAAE,OAAO,CACd,kCAAkC,EAClC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gDAAgD,GAAG,CAAC,KAAK,UAAU;gBACvF,qBAAqB,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,GAAG,CAAC,MAAM,IAAI;gBACnF,iDAAiD,EACnD,WAAW,CACZ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,YAAsB,CAAC;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvG,IAAI,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrG,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACpD,MAAM,EACJ,WAAW,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;gBACrF,kGAAkG;SACrG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM;YACN,OAAO;YACP,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;YACb,WAAW;YACX,OAAO,EAAE,OAAO,CACd,4BAA4B,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD;gBAC1F,sDAAsD,EACxD,MAAM,CACP;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACxF,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM;YACN,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,WAAW;YACX,OAAO,EAAE,OAAO,CACd,6BAA6B,EAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CACxE;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;QACN,OAAO;QACP,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,cAAc;QAC3E,WAAW;QACX,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,YAAY,GAA8B,EAAE,CAAC;IACnD,MAAM,KAAK,GAA6B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,+BAA+B;gBACrC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EACJ,kBAAkB,IAAI,CAAC,EAAE,oBAAoB,IAAI,CAAC,OAAO,iCAAiC;oBAC1F,6FAA6F;oBAC7F,8FAA8F;aACjG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9D,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CACnF,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CACnC,MAA8B;IAE9B,OAAO,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,OAA0C;IAChF,IAAI,KAAK,GAA2B,WAAW,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy/evaluate.d.ts

@@ -112,6 +112,10 @@ export declare const BlockingEntrySchema: z.ZodObject<{
         RESOURCE_SINGLETON_PER_TENANT: "RESOURCE_SINGLETON_PER_TENANT";
         RESPONSE_FIELD_MISSING_FROM_MODEL: "RESPONSE_FIELD_MISSING_FROM_MODEL";
         TWIN_PATH_DIVERGENT: "TWIN_PATH_DIVERGENT";
+        BUSINESS_RULE_TEST_MISSING: "BUSINESS_RULE_TEST_MISSING";
+        BUSINESS_RULE_TEST_TYPE_MISMATCH: "BUSINESS_RULE_TEST_TYPE_MISMATCH";
+        BUSINESS_RULE_TEST_UNPROVEN: "BUSINESS_RULE_TEST_UNPROVEN";
+        BUSINESS_RULE_TEST_FAILING: "BUSINESS_RULE_TEST_FAILING";
     }>>>;
     nextAction: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strict>;
@@ -249,6 +253,10 @@ export declare const PolicyEvaluationResultSchema: z.ZodObject<{
             RESOURCE_SINGLETON_PER_TENANT: "RESOURCE_SINGLETON_PER_TENANT";
             RESPONSE_FIELD_MISSING_FROM_MODEL: "RESPONSE_FIELD_MISSING_FROM_MODEL";
             TWIN_PATH_DIVERGENT: "TWIN_PATH_DIVERGENT";
+            BUSINESS_RULE_TEST_MISSING: "BUSINESS_RULE_TEST_MISSING";
+            BUSINESS_RULE_TEST_TYPE_MISMATCH: "BUSINESS_RULE_TEST_TYPE_MISMATCH";
+            BUSINESS_RULE_TEST_UNPROVEN: "BUSINESS_RULE_TEST_UNPROVEN";
+            BUSINESS_RULE_TEST_FAILING: "BUSINESS_RULE_TEST_FAILING";
         }>>>;
         nextAction: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strict>>;

package/dist/policy/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAG5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGzG,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAK1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC5B,CAAC;AAEL,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;kBAM9B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAcrC,CAAC;AAEL,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC3D,GACA,OAAO,CAaT;AAED,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAwErF"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAG5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGzG,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAK1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC5B,CAAC;AAEL,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;kBAM9B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAcrC,CAAC;AAEL,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC3D,GACA,OAAO,CAaT;AAED,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAwErF"}

package/dist/policy/index.d.ts

@@ -11,6 +11,7 @@
 export { CRUD_CONTRACT_PREFIX, PERSISTENCE_CONTRACT_PREFIX, BlockingEntrySchema, ClaimAssessmentSchema, PolicyEvaluationError, PolicyEvaluationResultSchema, classificationBlockedIdentity, evaluatePolicies, lifecycleAllowsContract, } from './evaluate.js';
 export type { BlockingEntry, ClaimAssessment, PolicyEvaluationInput, PolicyEvaluationResult, } from './evaluate.js';
 export { evaluateCoveragePolicy, type CoverageInventoryTable, type MappedCoverage, type CoverageConfigError, type CoverageBlockingFinding, type CoveragePolicyResult, } from './coverage.js';
+export { evaluateBusinessRules, isBusinessRuleFinding, worstBusinessRuleStatus, type BusinessRuleBinding, type BusinessRuleRunFacts, type BusinessRuleTestFact, type BusinessRuleConfigError, type BusinessRuleFinding, type BusinessRuleCaseResult, type BusinessRuleEvaluation, type EvaluateBusinessRulesInput, } from './business-rules.js';
 export { TRUSTED_POLICY_DOMAIN, trustedPolicyDigest, policyWeakenedCandidate, type TrustedPolicyInput, type PolicyWeakeningCheck, } from './trusted.js';
 export { BEHAVIOR_POLICY_ID, EMPTY_BEHAVIOR_CATALOG_DIGEST, compileBehaviorPolicy, parseBehaviorPolicy, type CompileBehaviorPolicyInput, type CompileBehaviorPolicyResult, } from './behavior.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,eAAe,CAAC"}

package/dist/policy/index.js

@@ -10,6 +10,7 @@
  */
 export { CRUD_CONTRACT_PREFIX, PERSISTENCE_CONTRACT_PREFIX, BlockingEntrySchema, ClaimAssessmentSchema, PolicyEvaluationError, PolicyEvaluationResultSchema, classificationBlockedIdentity, evaluatePolicies, lifecycleAllowsContract, } from './evaluate.js';
 export { evaluateCoveragePolicy, } from './coverage.js';
+export { evaluateBusinessRules, isBusinessRuleFinding, worstBusinessRuleStatus, } from './business-rules.js';
 export { TRUSTED_POLICY_DOMAIN, trustedPolicyDigest, policyWeakenedCandidate, } from './trusted.js';
 export { BEHAVIOR_POLICY_ID, EMPTY_BEHAVIOR_CATALOG_DIGEST, compileBehaviorPolicy, parseBehaviorPolicy, } from './behavior.js';
 //# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,GAGxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GASxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,GAGxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,eAAe,CAAC"}