@sudobility/sider_lib 0.0.4 → 0.0.5

package/dist/gates.js

@@ -44,18 +44,19 @@ export function evaluateGates(req, ctx) {
         if (!b.ok)
             return b;
     }
-    // --- Gate C: mutations require confirmation -----------------------------
-    // Bind to the HTTP method, not just the server-declared (and therefore
-    // untrusted) safetyClass — a recipe labeled "read" with a POST/PUT/PATCH/
-    // DELETE still mutates and must not run unconfirmed.
+    // --- Gate C: mutations respect site policy; financial requires confirm ---
+    // Bind "is a mutation" to the HTTP method as well as the declared class (a
+    // recipe labeled "read" with a POST still mutates). Product decision
+    // 2026-07-22: only `financial` actions need user confirmation; ordinary
+    // writes (add-to-cart level) run automatically. `allowMutations` remains the
+    // per-site hard stop for ALL mutations.
     const idempotent = req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS";
-    if (req.safetyClass !== "read" || !idempotent) {
-        if (ctx.allowMutations === false) {
-            return { ok: false, gate: "safety", reason: `mutations disabled for ${ctx.siteOrigin}` };
-        }
-        if (!ctx.confirmed) {
-            return { ok: false, gate: "safety", reason: `mutating request requires confirmation` };
-        }
+    const mutating = req.safetyClass !== "read" || !idempotent;
+    if (mutating && ctx.allowMutations === false) {
+        return { ok: false, gate: "safety", reason: `mutations disabled for ${ctx.siteOrigin}` };
+    }
+    if (req.safetyClass === "financial" && !ctx.confirmed) {
+        return { ok: false, gate: "safety", reason: `financial request requires confirmation` };
     }
     return { ok: true };
 }

package/dist/gates.test.js

@@ -64,8 +64,31 @@ test("Gate B: refuses when the sentinel is absent from its declared location", (
     if (!out.ok)
         expect(out.gate).toBe("injection_location");
 });
-test("Gate C: a POST (method-bound) requires confirmation even if labeled read", () => {
-    const out = evaluateGates(req({ method: "POST", safetyClass: "read" }), ctx());
+test("Gate C: a POST labeled read runs unconfirmed (financial-only policy)", () => {
+    expect(evaluateGates(req({ method: "POST", safetyClass: "read" }), ctx())).toEqual({ ok: true });
+});
+test("Gate C: write POST runs unconfirmed (financial-only policy)", () => {
+    const out = evaluateGates(req({ method: "POST", safetyClass: "write" }), ctx());
+    expect(out).toEqual({ ok: true });
+});
+test("Gate C: financial request without confirmation is blocked", () => {
+    const out = evaluateGates(req({ method: "POST", safetyClass: "financial" }), ctx());
+    expect(out.ok).toBe(false);
+    if (!out.ok)
+        expect(out.gate).toBe("safety");
+});
+test("Gate C: financial request with confirmation passes", () => {
+    const out = evaluateGates(req({ method: "POST", safetyClass: "financial" }), ctx({ confirmed: true }));
+    expect(out).toEqual({ ok: true });
+});
+test("Gate C: GET declared financial still requires confirmation", () => {
+    const out = evaluateGates(req({ safetyClass: "financial" }), ctx());
+    expect(out.ok).toBe(false);
+    if (!out.ok)
+        expect(out.gate).toBe("safety");
+});
+test("Gate C: allowMutations=false still blocks an unconfirmed write", () => {
+    const out = evaluateGates(req({ method: "POST", safetyClass: "write" }), ctx({ allowMutations: false }));
     expect(out.ok).toBe(false);
     if (!out.ok)
         expect(out.gate).toBe("safety");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sudobility/sider_lib",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Sider business logic — recipe compiler, egress gates, tokenizer, clustering. Pure, no Chrome/DOM/server.",
   "license": "BUSL-1.1",
   "publishConfig": {

package/src/gates.test.ts

@@ -74,8 +74,34 @@ test("Gate B: refuses when the sentinel is absent from its declared location", (
   if (!out.ok) expect(out.gate).toBe("injection_location");
 });
 
-test("Gate C: a POST (method-bound) requires confirmation even if labeled read", () => {
-  const out = evaluateGates(req({ method: "POST", safetyClass: "read" }), ctx());
+test("Gate C: a POST labeled read runs unconfirmed (financial-only policy)", () => {
+  expect(evaluateGates(req({ method: "POST", safetyClass: "read" }), ctx())).toEqual({ ok: true });
+});
+
+test("Gate C: write POST runs unconfirmed (financial-only policy)", () => {
+  const out = evaluateGates(req({ method: "POST", safetyClass: "write" }), ctx());
+  expect(out).toEqual({ ok: true });
+});
+
+test("Gate C: financial request without confirmation is blocked", () => {
+  const out = evaluateGates(req({ method: "POST", safetyClass: "financial" }), ctx());
+  expect(out.ok).toBe(false);
+  if (!out.ok) expect(out.gate).toBe("safety");
+});
+
+test("Gate C: financial request with confirmation passes", () => {
+  const out = evaluateGates(req({ method: "POST", safetyClass: "financial" }), ctx({ confirmed: true }));
+  expect(out).toEqual({ ok: true });
+});
+
+test("Gate C: GET declared financial still requires confirmation", () => {
+  const out = evaluateGates(req({ safetyClass: "financial" }), ctx());
+  expect(out.ok).toBe(false);
+  if (!out.ok) expect(out.gate).toBe("safety");
+});
+
+test("Gate C: allowMutations=false still blocks an unconfirmed write", () => {
+  const out = evaluateGates(req({ method: "POST", safetyClass: "write" }), ctx({ allowMutations: false }));
   expect(out.ok).toBe(false);
   if (!out.ok) expect(out.gate).toBe("safety");
 });

package/src/gates.ts

@@ -59,18 +59,19 @@ export function evaluateGates(req: CompiledRequest, ctx: GateContext): GateOutco
     if (!b.ok) return b;
   }
 
-  // --- Gate C: mutations require confirmation -----------------------------
-  // Bind to the HTTP method, not just the server-declared (and therefore
-  // untrusted) safetyClass — a recipe labeled "read" with a POST/PUT/PATCH/
-  // DELETE still mutates and must not run unconfirmed.
+  // --- Gate C: mutations respect site policy; financial requires confirm ---
+  // Bind "is a mutation" to the HTTP method as well as the declared class (a
+  // recipe labeled "read" with a POST still mutates). Product decision
+  // 2026-07-22: only `financial` actions need user confirmation; ordinary
+  // writes (add-to-cart level) run automatically. `allowMutations` remains the
+  // per-site hard stop for ALL mutations.
   const idempotent = req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS";
-  if (req.safetyClass !== "read" || !idempotent) {
-    if (ctx.allowMutations === false) {
-      return { ok: false, gate: "safety", reason: `mutations disabled for ${ctx.siteOrigin}` };
-    }
-    if (!ctx.confirmed) {
-      return { ok: false, gate: "safety", reason: `mutating request requires confirmation` };
-    }
+  const mutating = req.safetyClass !== "read" || !idempotent;
+  if (mutating && ctx.allowMutations === false) {
+    return { ok: false, gate: "safety", reason: `mutations disabled for ${ctx.siteOrigin}` };
+  }
+  if (req.safetyClass === "financial" && !ctx.confirmed) {
+    return { ok: false, gate: "safety", reason: `financial request requires confirmation` };
   }
 
   return { ok: true };