# METADATA
# title: Transformation policy for per-diem compute
# description: |
#   Only agent-per-diem-calculator may run expense.compute_per_diem.
#   Output must consist exclusively of items whose type is PER_DIEM_*,
#   each with a computed_from.transform_attestation_ref back-reference
#   and a positive amount. Enforces separation between LLM agents (free-form)
#   and deterministic compute agents (strict shape, no free-form fields).
# authors:
#   - CTO Agent <cto@basicstack.de>
# related_resources:
#   - ref: docs/architecture/v1.1.md#user-content-62-deterministische-regelwerke-am-beispiel-spesensätze-verpflegungsmehraufwand
#   - ref: schemas/expense/canonical/v1.2.0.json
package proofedmesh.transformations.per_diem

import rego.v1

default allow := false

allow if {
	input.agent_id == "agent-per-diem-calculator"
	input.operation == "expense.compute_per_diem"
	input.output_schema.name == "expense.canonical"
	input.output_schema.version == "1.2.0"
	all_items_are_per_diem
	all_items_have_computed_from
	all_amounts_positive
}

per_diem_types := {"PER_DIEM_FULL", "PER_DIEM_PARTIAL", "PER_DIEM_ARRIVAL", "PER_DIEM_DEPARTURE"}

all_items_are_per_diem if {
	every item in input.output_payload.expense_items {
		item.type in per_diem_types
	}
}

all_items_have_computed_from if {
	every item in input.output_payload.expense_items {
		item.computed_from.transform_attestation_ref != ""
	}
}

to_cents(s) := n if {
	n := round(to_number(s) * 100)
}

all_amounts_positive if {
	every item in input.output_payload.expense_items {
		to_cents(item.amount) > 0
	}
}

deny_reason contains msg if {
	input.agent_id != "agent-per-diem-calculator"
	msg := sprintf("agent %s not allowed to compute per_diem", [input.agent_id])
}

deny_reason contains msg if {
	input.operation != "expense.compute_per_diem"
	msg := sprintf("operation %s not allowed", [input.operation])
}

deny_reason contains msg if {
	input.agent_id == "agent-per-diem-calculator"
	input.operation == "expense.compute_per_diem"
	not all_items_are_per_diem
	msg := "compute output must contain only PER_DIEM_* typed items"
}

deny_reason contains msg if {
	input.agent_id == "agent-per-diem-calculator"
	input.operation == "expense.compute_per_diem"
	not all_items_have_computed_from
	msg := "every computed item must carry computed_from.transform_attestation_ref"
}

deny_reason contains msg if {
	input.agent_id == "agent-per-diem-calculator"
	input.operation == "expense.compute_per_diem"
	not all_amounts_positive
	msg := "all computed per-diem amounts must be strictly positive"
}