@nexart/policy

Seal-bound, deterministic policy evaluation foundation for the NexArt verifiable-execution stack — the Light version.

The customer supplies a captured-execution schema and a policy. NexArt validates them at authoring time, canonicalizes and hashes both, and deterministically evaluates the policy against a captured execution payload, returning a structured policyEvaluation with a PASS / FAIL / ERROR verdict.

NexArt only validates, hashes, evaluates, and returns evidence. It does not author rules, score risk, recommend, authorize, or block. ERROR (evaluation could not complete) is always distinct from FAIL (evaluation completed but conditions were not satisfied).

This package is a zero-@nexart-dependency leaf so it can later be imported by @nexart/signals and @nexart/ai-execution without a circular dependency.

Usage

import { validateSchema, validatePolicy, evaluatePolicy } from '@nexart/policy';

const schema = {
  schemaId: 'order.execution',
  version: '1.0.0',
  fields: [
    { name: 'amount', type: 'number' },
    { name: 'status', type: 'enum', enumValues: ['created', 'approved', 'rejected'] },
    { name: 'approvedAt', type: 'timestamp' },
  ],
};

const policy = {
  policyId: 'order.approval',
  version: '1.0.0',
  combinator: 'all',
  rules: [
    { id: 'r1', field: 'amount', operator: 'lte', value: 10000 },
    { id: 'r2', field: 'status', operator: 'eq', value: 'approved' },
  ],
};

const evaluation = evaluatePolicy(schema, policy, {
  amount: 4200,
  status: 'approved',
  approvedAt: '2026-01-01T00:00:00.000Z',
});
// evaluation.verdict === 'PASS'

Closed v1 type system

number, boolean, string, timestamp, uuid, identifier, enum.

No arrays, objects, nested predicates, durations, scoring, weights, or customer-defined types in v1.

Closed operator matrix

| Field type | Allowed operators | | -------------------- | ---------------------------------------------------------- | | number | eq neq lt lte gt gte between exists | | boolean | eq exists | | string | eq neq in matches exists | | timestamp | before after between within-window exists | | uuid / identifier| eq neq in exists | | enum | eq neq in exists |

Any operator outside the valid set for a field type is rejected during policy validation.

Combinators

Only all and any. No weighted/threshold/risk-score/severity-scoring logic. severity may be recorded as rule metadata but is never used for scoring.

Operator semantics

• Equality is strict JSON-compatible value equality; timestamps compare by normalized UTC epoch milliseconds.
• Numeric comparisons are numeric-only; between is inclusive.
• exists means the field is present and not undefined.
• Timestamps must be ISO-8601 with an explicit UTC offset (Z or ±hh:mm).
• within-window is { anchor, windowMs } — relative to a declared anchor, never the current time.
• matches uses a constrained safe glob subset, not arbitrary regex: literals from [A-Za-z0-9 _-:./@] plus * (any run) and ? (one char). Any other pattern is rejected at validation time (ReDoS-safe by construction).

Verdicts

• PASS — conditions satisfied under the selected combinator.
• FAIL — evaluation completed but conditions were not satisfied.
• ERROR — evaluation could not complete (e.g. a declared field is absent from the payload, or a captured value does not conform to its declared type). ERROR is dominant: if any rule errors, the overall verdict is ERROR.

Structural invalidity of a schema, policy, or execution payload throws a PolicyValidationError (distinct from the runtime ERROR verdict).

Scope (Light)

This package contains only schema/policy validation, canonicalization/hashing, the closed type/operator system, and the deterministic evaluation engine. It does not create CERs, attest, gate, block, issue admissibility tokens, or provide any UI. Integration into @nexart/signals and @nexart/ai-execution CER hash scope is intentionally deferred.

License

MIT