fix(policy): validate time window inputs

[blackmore-technology-group]

Summary

• validate each match.windows entry as an object before treating it as a time window
• reject non-integer or out-of-range utcOffsetMinutes values outside -840..840
• report malformed windows with the full path such as policies[0].match.windows[0]
• add focused regression coverage in policy-validator.test.ts and time-window.test.ts
• add a patch changeset for @memnox/core

Validation

Passed locally:

• targeted policy/time-window Vitest suites
• build
• typecheck
• deadcode
• Prettier check on the changed TypeScript files
• git diff --check

On this Windows environment, the repository-wide test suite has unrelated nondeterministic failures. Repeated differential checks against the untouched base commit on the same machine used 3 isolated A/B rounds for the suspect tests and 2 fresh full-suite A/B rounds; they showed no reproducible failure unique to this change. The repository's Ubuntu/macOS Node 22/24 CI remains the authoritative full-suite validation.

Closes #46

[moise10r]

Hey @blackmore-technology-group, thanks for jumping on this one! 🙌

I opened #46 because a deny rule that quietly stops matching is the kind of bug that keeps me up at night, so it's great to see it handled this carefully.

What I checked

I checked out your branch and threw the nasty inputs at it:

• windows: [null]
• utcOffsetMinutes: "abc" and 99999
• days: "mon", which I hadn't even thought of

Every one of them now fails loudly with policies[0].match.windows[0] in the message, and the suites are all green on my machine. I also liked that you went through the entries one by one so every bad window gets reported, not just the first. I'd have missed that.

Before I merge

• Could you please bump all four packages in the changeset? @memnox/cli, @memnox/proxy and @memnox/interceptors should sit at patch next to @memnox/core, since they always ship together.

The comment about the error message is only a thought, so no pressure there.

Really appreciate you taking the time on this. Hope to see you around the repo again!

[moise10r]

Small one: our four packages always release together, so could you add @memnox/cli, @memnox/proxy and @memnox/interceptors as a patch alongside @memnox/core? Thanks!

[moise10r]

Totally optional: right now this message lists every constraint, even when only one field is off. If it named the field that failed (something like utcOffsetMinutes must be an integer from -840 to 840), it would point people straight at the fix. Happy to merge either way.

[blackmore-technology-group]

Thanks for the review and for checking those edge cases. I’ve pushed the requested changeset update in a26ad7c1ed76eb01326f85cd37e75f7257d48979 — @memnox/core, @memnox/cli, @memnox/proxy, and @memnox/interceptors are now all listed as patch. That follow-up commit only changes the changeset; the policy implementation and tests are unchanged. Appreciate the careful review.