Module command_policy 

Visibility and access-policy evaluation for commands. Runtime command visibility and access policy evaluation.

This module exists to answer two related questions consistently: should a command be shown, and may the current caller run it? Command metadata can carry coarse auth requirements, but this module owns the normalized runtime evaluation rules.

In broad terms:

• crate::core::command_policy::CommandPolicy describes one command’s visibility and prerequisites
• crate::core::command_policy::CommandPolicyContext captures the runtime facts used during evaluation
• crate::core::command_policy::evaluate_policy turns the two into a concrete access decision
• crate::core::command_policy::CommandPolicyRegistry stores policies and applies per-path overrides

Contract:

• this module owns normalized policy evaluation, not command metadata shape
• visibility and runnability are distinct outcomes and should stay distinct
• callers should rely on the returned crate::core::command_policy::CommandAccess instead of re-deriving access rules ad hoc

Public API shape:

• crate::core::command_policy::CommandPolicy remains a fluent semantic policy DSL
• crate::core::command_policy::CommandPolicyOverride uses an explicit constructor plus with_* normalization helpers so overrides follow the same normalization rules as base policies

Structs

CommandAccess

Effective access decision for a command under a specific context.

CommandPath

Normalized command path used as the lookup key for policy evaluation.

CommandPolicy

Declarative policy used to decide whether a command is visible and runnable.

CommandPolicyContext

Runtime facts used to evaluate a command policy.

CommandPolicyOverride

Partial override applied on top of a registered CommandPolicy.

CommandPolicyRegistry

Registry of command policies and per-path overrides.

Enums

AccessReason

Reason codes attached to denied or hidden command access.

CommandAvailability

Product-level availability state for a command.

CommandRunnable

Runnable outcome produced by policy evaluation.

CommandVisibility

Visibility outcome produced by policy evaluation.

VisibilityMode

Visibility contract applied before runtime capability checks.

Functions

evaluate_policy

Evaluates a single policy against the supplied runtime context.