Epic #89: built-in declarative CEL rules engine + skill-reference sweep

Cargo.toml

@@ -9,4 +9,5 @@ members = [
     "crates/schema-forge-cli",
     "crates/schema-forge-postgres",
     "crates/schema-forge-signing",
+    "crates/schema-forge-cel",
 ]

crates/schema-forge-acton/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "schema-forge-acton"
-version = "0.32.0"
+version = "0.34.0"
 edition = "2021"
 
 [dependencies]
@@ -44,6 +44,7 @@ aws-lc-rs = { version = "1", features = ["fips"], optional = true }
 rustls = { version = "0.23", default-features = false, features = ["std", "aws_lc_rs", "logging"] }
 schema-forge-signing = { version = "0.1.0", path = "../schema-forge-signing" }
 lettre = { version = "0.11.22", default-features = false, features = ["tokio1-rustls", "aws-lc-rs", "webpki-roots", "smtp-transport", "builder", "pool", "hostname"] }
+schema-forge-cel = { version = "0.9.0", path = "../schema-forge-cel" }
 
 
 [features]

crates/schema-forge-acton/src/conversions.rs

@@ -21,12 +21,20 @@ pub fn dynamic_value_to_json(value: &DynamicValue) -> serde_json::Value {
         DynamicValue::DateTime(dt) => {
             serde_json::Value::String(dt.to_rfc3339_opts(SecondsFormat::Millis, true))
         }
+        DynamicValue::Duration(d) => {
+            serde_json::Value::String(schema_forge_core::types::format_go_duration(d))
+        }
+        DynamicValue::Bytes(b) => {
+            serde_json::Value::String(schema_forge_core::types::encode_standard(b))
+        }
         DynamicValue::Enum(s) => serde_json::Value::String(s.clone()),
         DynamicValue::Json(v) => v.clone(),
         DynamicValue::Array(arr) => {
             serde_json::Value::Array(arr.iter().map(dynamic_value_to_json).collect())
         }
-        DynamicValue::Composite(map) => {
+        DynamicValue::Composite(map) | DynamicValue::Map(map) => {
+            // Both a fixed-field Composite and an open-key typed Map serialize
+            // to a JSON object on the wire.
             let obj: serde_json::Map<String, serde_json::Value> = map
                 .iter()
                 .map(|(k, v)| (k.clone(), dynamic_value_to_json(v)))

crates/schema-forge-acton/src/hooks/mod.rs

@@ -22,6 +22,11 @@
 //!    response before persisting. If `abort_reason` is set, the request
 //!    aborts with [`crate::error::ForgeError::HookAborted`]. If the
 //!    response carries modified fields, they replace the entity payload.
+//!    `before_*` hooks run *after* the in-transaction rule phases
+//!    (`@default` → `@compute` → `@require`; see [`crate::rules`]), so they
+//!    operate on the already-defaulted/computed/validated field set and a
+//!    `@require` rejection short-circuits the write before any hook
+//!    round-trip.
 //! 2. **Detached (`after_*`)**: the route handler queues a
 //!    [`dispatch_actor::DispatchHook`] message on the
 //!    [`dispatch_actor::HookDispatchActor`] and returns immediately to

crates/schema-forge-acton/src/lib.rs

@@ -15,6 +15,7 @@ pub mod hooks;
 pub mod messages;
 pub mod middleware;
 pub mod routes;
+pub mod rules;
 pub mod shared;
 pub mod shared_auth;
 pub mod state;