@cullet/erp-core 1.2.0 → 1.4.0

package/dist/rule.cjs

@@ -0,0 +1,327 @@
+const require_authorization_error = require("./authorization-error.cjs");
+const require_validation_code = require("./validation-code.cjs");
+const require_validation_field = require("./validation-field.cjs");
+const require_validation_exception = require("./validation-exception.cjs");
+const require_value_object = require("./value-object.cjs");
+const require_result = require("./result.cjs");
+const require_condition_evaluator = require("./condition-evaluator.cjs");
+//#region src/core/abac/attributes.ts
+/**
+* Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the
+* condition evaluator reads (it resolves dotted fields like `resource.status` by
+* walking nested objects). The actor lands as `subject.id`; the four attribute
+* bags nest under `subject` / `resource` / `action` / `env`; a `resource`
+* reference adds `resource.type` / `resource.id`. The actor id and the resource
+* reference win over any same-named keys in the attribute bags.
+*
+* Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,
+* or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so
+* rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.
+*/
+function abacContext(request) {
+	const attributes = request.attributes;
+	const subject = {
+		...attributes.subject,
+		id: request.actor.raw
+	};
+	const resource = { ...attributes.resource };
+	if (request.resource) {
+		resource.type = request.resource.type;
+		if (request.resource.id !== void 0) resource.id = request.resource.id;
+	}
+	return {
+		subject,
+		resource,
+		action: { ...attributes.action },
+		env: { ...attributes.environment }
+	};
+}
+//#endregion
+//#region src/core/abac/combining.ts
+function firstWithEffect(rules, effect) {
+	return rules.find((rule) => rule.effect === effect);
+}
+/**
+* Applies `algorithm` to the already-matched `applicable` rules, falling back to
+* `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and
+* total; the returned `decidingRule` is absent exactly when `defaultEffect` was
+* used.
+*/
+function combine(algorithm, applicable, defaultEffect) {
+	switch (algorithm) {
+		case "deny-overrides": {
+			const deny = firstWithEffect(applicable, "DENY");
+			if (deny) return {
+				effect: "DENY",
+				decidingRule: deny
+			};
+			const permit = firstWithEffect(applicable, "PERMIT");
+			if (permit) return {
+				effect: "PERMIT",
+				decidingRule: permit
+			};
+			return { effect: defaultEffect };
+		}
+		case "permit-overrides": {
+			const permit = firstWithEffect(applicable, "PERMIT");
+			if (permit) return {
+				effect: "PERMIT",
+				decidingRule: permit
+			};
+			const deny = firstWithEffect(applicable, "DENY");
+			if (deny) return {
+				effect: "DENY",
+				decidingRule: deny
+			};
+			return { effect: defaultEffect };
+		}
+		case "first-applicable": {
+			const first = applicable[0];
+			if (first) return {
+				effect: first.effect,
+				decidingRule: first
+			};
+			return { effect: defaultEffect };
+		}
+	}
+}
+//#endregion
+//#region src/core/abac/authorizer.ts
+const ENGINE_VERSION = 1;
+/**
+* The pure ABAC decisor. Given an {@link AbacRequest} and an
+* {@link AbacPolicySet}, it flattens the request's attributes into a context,
+* matches each rule's condition with the gate engine's pure condition evaluator
+* (reused, not reimplemented), resolves the effects through the set's combining
+* algorithm, and returns a {@link Result} — never throwing, mirroring the
+* "errors as values" contract of `RbacAuthorizer`/`GateEngineV1`.
+*
+* A denial maps to {@link AuthorizationError.policyDenied}, attributed to the
+* deciding rule's `id`/`version`; a condition-evaluation failure (a missing
+* attribute, a wrong-typed operand) fails closed as
+* {@link AuthorizationError.forbidden}. Loading the dynamic attributes is the
+* consumer's job (behind an `AbacAuthorizerPort` adapter); this class only decides.
+*/
+var AbacAuthorizer = class {
+	constructor(params = {}) {
+		this.coreConfig = params.coreConfig ?? require_condition_evaluator.coreConfig;
+	}
+	authorize(request, policies) {
+		const evaluator = new require_condition_evaluator.ConditionEvaluatorV1(abacContext(request), this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION));
+		const applicable = [];
+		for (const rule of policies.rules) {
+			const matched = evaluator.evaluate(rule.condition);
+			if (matched.isErr()) return require_result.Result.err(require_authorization_error.AuthorizationError.forbidden({
+				action: request.action,
+				resource: request.resource,
+				actor: { userId: request.actor.raw },
+				details: matched.errorOrNull() ?? void 0
+			}));
+			if (matched.getOrThrow()) applicable.push(rule);
+		}
+		const { effect, decidingRule } = combine(policies.algorithm, applicable, policies.defaultEffect);
+		if (effect === "PERMIT") return require_result.Result.ok({
+			action: request.action,
+			effect: "PERMIT",
+			matchedRule: decidingRule?.id ?? "<default>",
+			algorithm: policies.algorithm,
+			grantedAtIso: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		return require_result.Result.err(require_authorization_error.AuthorizationError.policyDenied({
+			policyId: decidingRule?.id ?? "<default-deny>",
+			policyVersion: decidingRule?.version ?? 0,
+			evaluatedAtIso: (/* @__PURE__ */ new Date()).toISOString(),
+			action: request.action,
+			resource: request.resource,
+			actor: { userId: request.actor.raw },
+			reasonCode: decidingRule?.id
+		}));
+	}
+};
+//#endregion
+//#region src/core/abac/composite-authorizer.ts
+/**
+* Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid
+* "does the actor hold the capability, *and* do the attributes allow it here?"
+* flow. Short-circuits with the RBAC denial when the actor is not even capable,
+* so the boundary sees the most specific 403.
+*
+* Only the two port interfaces are referenced (both erased at runtime), so this
+* pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the
+* consumer wires up.
+*/
+var CompositeAuthorizer = class {
+	constructor(rbac, abac) {
+		this.rbac = rbac;
+		this.abac = abac;
+	}
+	async authorize(request) {
+		const coarse = await this.rbac.authorize(request);
+		if (coarse.isErr()) return coarse;
+		return this.abac.authorize(request);
+	}
+};
+//#endregion
+//#region src/core/abac/domain/policy-set.ts
+/**
+* An ordered collection of {@link AbacRule}s plus how to combine them
+* ({@link CombiningAlgorithm}) and what to decide when no rule applies
+* ({@link defaultEffect}). This is where ABAC goes beyond a single gate
+* condition: several PERMIT/DENY rules resolved by an explicit algorithm.
+*
+* Closed by default — the combining algorithm defaults to `"deny-overrides"` and
+* the default effect to `"DENY"`, so a request matching nothing is denied. A
+* plain holder (not a value object); build through {@link of}.
+*/
+var AbacPolicySet = class AbacPolicySet {
+	constructor(_rules, _algorithm, _defaultEffect) {
+		this._rules = _rules;
+		this._algorithm = _algorithm;
+		this._defaultEffect = _defaultEffect;
+		Object.freeze(this._rules);
+		Object.freeze(this);
+	}
+	static of(rules, options = {}) {
+		return new AbacPolicySet([...rules], options.algorithm ?? "deny-overrides", options.defaultEffect ?? "DENY");
+	}
+	get rules() {
+		return this._rules;
+	}
+	get algorithm() {
+		return this._algorithm;
+	}
+	get defaultEffect() {
+		return this._defaultEffect;
+	}
+};
+//#endregion
+//#region src/core/abac/domain/rule.ts
+const RULE_FIELD = require_validation_field.ValidationField.of("abacRule");
+const CONDITION_OPS = new Set([
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"in",
+	"notIn",
+	"isNull",
+	"isNotNull"
+]);
+const RULE_EFFECTS = new Set(["PERMIT", "DENY"]);
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* A single attribute-based rule: an {@link RuleEffect} that takes hold when its
+* {@link ConditionNode} matches the request's flattened attributes. The
+* condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves
+* combined with `and`/`or`/`not`), so a consumer learns one condition language
+* across the whole kit.
+*
+* A zod-free value object: it validates its own shape on construction (throwing
+* {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are
+* authored in TypeScript — trusted data, not untrusted JSON — the structural
+* check is a hand-rolled walk of the condition tree rather than a schema parse.
+* Build one through {@link of}; the constructor is private.
+*/
+var AbacRule = class AbacRule extends require_value_object.ValueObject {
+	constructor(props) {
+		super(props);
+		this.finalize();
+	}
+	/**
+	* Builds a rule, validating that `id` is non-blank, `version` is an integer
+	* ≥ 1, `effect` is `"PERMIT"`/`"DENY"`, and `condition` is a well-formed
+	* condition node. Throws {@link InvalidValueException} otherwise.
+	*/
+	static of(props) {
+		if (typeof props.id !== "string" || props.id.trim().length === 0) throw new require_validation_exception.InvalidValueException(RULE_FIELD.nested("id"), require_validation_code.ValidationCode.BLANK, `abac rule id must be a non-empty string, got "${props.id}"`);
+		if (!Number.isInteger(props.version) || props.version < 1) throw new require_validation_exception.InvalidValueException(RULE_FIELD.nested("version"), require_validation_code.ValidationCode.OUT_OF_RANGE, `abac rule version must be an integer >= 1, got "${props.version}"`);
+		if (!RULE_EFFECTS.has(props.effect)) throw new require_validation_exception.InvalidValueException(RULE_FIELD.nested("effect"), require_validation_code.ValidationCode.INVALID_FORMAT, `abac rule effect must be "PERMIT" or "DENY", got "${String(props.effect)}"`);
+		AbacRule.assertConditionShape(props.condition);
+		return new AbacRule(props);
+	}
+	static assertConditionShape(node) {
+		if (!isPlainObject(node)) AbacRule.rejectCondition("abac rule condition must be a leaf { field, op } or an { and | or | not } node");
+		if ("and" in node || "or" in node) {
+			const key = "and" in node ? "and" : "or";
+			const children = node[key];
+			if (!Array.isArray(children) || children.length === 0) AbacRule.rejectCondition(`abac rule "${key}" node must hold a non-empty array of child conditions`);
+			for (const child of children) AbacRule.assertConditionShape(child);
+			return;
+		}
+		if ("not" in node) {
+			AbacRule.assertConditionShape(node.not);
+			return;
+		}
+		if ("field" in node && "op" in node) {
+			if (typeof node.field !== "string" || node.field.trim().length === 0) AbacRule.rejectCondition(`abac rule condition leaf "field" must be a non-empty string, got "${String(node.field)}"`);
+			if (typeof node.op !== "string" || !CONDITION_OPS.has(node.op)) AbacRule.rejectCondition(`abac rule condition leaf "op" is not a supported operator, got "${String(node.op)}"`);
+			return;
+		}
+		AbacRule.rejectCondition("abac rule condition must be a leaf { field, op } or an { and | or | not } node");
+	}
+	static rejectCondition(message) {
+		throw new require_validation_exception.InvalidValueException(RULE_FIELD.nested("condition"), require_validation_code.ValidationCode.INVALID_FORMAT, message);
+	}
+	get id() {
+		return this.value.id;
+	}
+	get version() {
+		return this.value.version;
+	}
+	get effect() {
+		return this.value.effect;
+	}
+	/** The condition tree evaluated against a request's flattened attributes. */
+	get condition() {
+		return this.value.condition;
+	}
+	get description() {
+		return this.value.description;
+	}
+	toPrimitive() {
+		return {
+			id: this.value.id,
+			version: this.value.version,
+			effect: this.value.effect,
+			condition: this.value.condition,
+			...this.value.description !== void 0 ? { description: this.value.description } : {}
+		};
+	}
+};
+//#endregion
+Object.defineProperty(exports, "AbacAuthorizer", {
+	enumerable: true,
+	get: function() {
+		return AbacAuthorizer;
+	}
+});
+Object.defineProperty(exports, "AbacPolicySet", {
+	enumerable: true,
+	get: function() {
+		return AbacPolicySet;
+	}
+});
+Object.defineProperty(exports, "AbacRule", {
+	enumerable: true,
+	get: function() {
+		return AbacRule;
+	}
+});
+Object.defineProperty(exports, "CompositeAuthorizer", {
+	enumerable: true,
+	get: function() {
+		return CompositeAuthorizer;
+	}
+});
+Object.defineProperty(exports, "abacContext", {
+	enumerable: true,
+	get: function() {
+		return abacContext;
+	}
+});
+
+//# sourceMappingURL=rule.cjs.map

package/dist/rule.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.cjs","names":["coreConfig","ConditionEvaluatorV1","Result","AuthorizationError","ValidationField","ValueObject","InvalidValueException","ValidationCode"],"sources":["../src/core/abac/attributes.ts","../src/core/abac/combining.ts","../src/core/abac/authorizer.ts","../src/core/abac/composite-authorizer.ts","../src/core/abac/domain/policy-set.ts","../src/core/abac/domain/rule.ts"],"sourcesContent":["import type { PolicyContext } from \"../policies/engines/gate-types.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\n\n/**\n * Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the\n * condition evaluator reads (it resolves dotted fields like `resource.status` by\n * walking nested objects). The actor lands as `subject.id`; the four attribute\n * bags nest under `subject` / `resource` / `action` / `env`; a `resource`\n * reference adds `resource.type` / `resource.id`. The actor id and the resource\n * reference win over any same-named keys in the attribute bags.\n *\n * Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,\n * or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so\n * rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.\n */\nexport function abacContext(request: AbacRequest): PolicyContext {\n    const attributes = request.attributes;\n\n    const subject: Record<string, unknown> = {\n        ...attributes.subject,\n        id: request.actor.raw,\n    };\n\n    const resource: Record<string, unknown> = { ...attributes.resource };\n    if (request.resource) {\n        resource.type = request.resource.type;\n        if (request.resource.id !== undefined) {\n            resource.id = request.resource.id;\n        }\n    }\n\n    return {\n        subject,\n        resource,\n        action: { ...attributes.action },\n        env: { ...attributes.environment },\n    };\n}\n","import type { AbacRule, RuleEffect } from \"./domain/rule.js\";\n\n/**\n * How an {@link AbacPolicySet} resolves several applicable rules into one effect.\n *\n * - `deny-overrides` (default, secure): any applicable DENY wins; otherwise the\n *   first PERMIT; otherwise the set's default effect.\n * - `permit-overrides`: any applicable PERMIT wins; otherwise the first DENY;\n *   otherwise the default effect.\n * - `first-applicable`: the effect of the first rule that matches; otherwise the\n *   default effect.\n */\nexport type CombiningAlgorithm =\n    | \"deny-overrides\"\n    | \"permit-overrides\"\n    | \"first-applicable\";\n\n/** The resolved decision plus the rule (if any) that produced it. */\nexport interface CombineResult {\n    readonly effect: RuleEffect;\n    readonly decidingRule?: AbacRule;\n}\n\nfunction firstWithEffect(\n    rules: readonly AbacRule[],\n    effect: RuleEffect,\n): AbacRule | undefined {\n    return rules.find((rule) => rule.effect === effect);\n}\n\n/**\n * Applies `algorithm` to the already-matched `applicable` rules, falling back to\n * `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and\n * total; the returned `decidingRule` is absent exactly when `defaultEffect` was\n * used.\n */\nexport function combine(\n    algorithm: CombiningAlgorithm,\n    applicable: readonly AbacRule[],\n    defaultEffect: RuleEffect,\n): CombineResult {\n    switch (algorithm) {\n        case \"deny-overrides\": {\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            return { effect: defaultEffect };\n        }\n        case \"permit-overrides\": {\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            return { effect: defaultEffect };\n        }\n        case \"first-applicable\": {\n            const first = applicable[0];\n            if (first) return { effect: first.effect, decidingRule: first };\n            return { effect: defaultEffect };\n        }\n    }\n}\n","import { type CoreConfig, coreConfig } from \"../config/index.js\";\nimport { AuthorizationError } from \"../errors/authorization-error.js\";\nimport { ConditionEvaluatorV1 } from \"../policies/engines/v1/condition-evaluator.js\";\nimport { Result } from \"../result/result.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\nimport { abacContext } from \"./attributes.js\";\nimport { combine, type CombiningAlgorithm } from \"./combining.js\";\nimport type { AbacPolicySet } from \"./domain/policy-set.js\";\nimport type { AbacRule } from \"./domain/rule.js\";\n\n// ABAC reuses the gate engine's v1 condition matcher; the version stamps the\n// evaluation reports the shared reporter emits.\nconst ENGINE_VERSION = 1;\n\n/** The successful decision returned by {@link AbacAuthorizer.authorize}. */\ninterface AbacDecision {\n    /** The audited business action that was allowed. */\n    readonly action: string;\n    readonly effect: \"PERMIT\";\n    /** The id of the rule that permitted, or `\"<default>\"` when the set's default did. */\n    readonly matchedRule: string;\n    readonly algorithm: CombiningAlgorithm;\n    /** When the decision was made, ISO-8601. */\n    readonly grantedAtIso: string;\n}\n\n/**\n * The pure ABAC decisor. Given an {@link AbacRequest} and an\n * {@link AbacPolicySet}, it flattens the request's attributes into a context,\n * matches each rule's condition with the gate engine's pure condition evaluator\n * (reused, not reimplemented), resolves the effects through the set's combining\n * algorithm, and returns a {@link Result} — never throwing, mirroring the\n * \"errors as values\" contract of `RbacAuthorizer`/`GateEngineV1`.\n *\n * A denial maps to {@link AuthorizationError.policyDenied}, attributed to the\n * deciding rule's `id`/`version`; a condition-evaluation failure (a missing\n * attribute, a wrong-typed operand) fails closed as\n * {@link AuthorizationError.forbidden}. Loading the dynamic attributes is the\n * consumer's job (behind an `AbacAuthorizerPort` adapter); this class only decides.\n */\nclass AbacAuthorizer {\n    private readonly coreConfig: CoreConfig;\n\n    constructor(params: { readonly coreConfig?: CoreConfig } = {}) {\n        this.coreConfig = params.coreConfig ?? coreConfig;\n    }\n\n    authorize(\n        request: AbacRequest,\n        policies: AbacPolicySet,\n    ): Result<AbacDecision, AuthorizationError> {\n        const context = abacContext(request);\n        const evaluator = new ConditionEvaluatorV1(\n            context,\n            this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION),\n        );\n\n        const applicable: AbacRule[] = [];\n        for (const rule of policies.rules) {\n            const matched = evaluator.evaluate(rule.condition);\n            if (matched.isErr()) {\n                // Fail closed: a technical evaluation error is never a silent PERMIT.\n                return Result.err(\n                    AuthorizationError.forbidden({\n                        action: request.action,\n                        resource: request.resource,\n                        actor: { userId: request.actor.raw },\n                        details: matched.errorOrNull() ?? undefined,\n                    }),\n                );\n            }\n            if (matched.getOrThrow()) {\n                applicable.push(rule);\n            }\n        }\n\n        const { effect, decidingRule } = combine(\n            policies.algorithm,\n            applicable,\n            policies.defaultEffect,\n        );\n\n        if (effect === \"PERMIT\") {\n            return Result.ok({\n                action: request.action,\n                effect: \"PERMIT\",\n                matchedRule: decidingRule?.id ?? \"<default>\",\n                algorithm: policies.algorithm,\n                grantedAtIso: new Date().toISOString(),\n            });\n        }\n\n        return Result.err(\n            AuthorizationError.policyDenied({\n                policyId: decidingRule?.id ?? \"<default-deny>\",\n                policyVersion: decidingRule?.version ?? 0,\n                evaluatedAtIso: new Date().toISOString(),\n                action: request.action,\n                resource: request.resource,\n                actor: { userId: request.actor.raw },\n                reasonCode: decidingRule?.id,\n            }),\n        );\n    }\n}\n\nexport { AbacAuthorizer, type AbacDecision };\n","import { Result } from \"../result/result.js\";\nimport type { AbacAuthorizerPort } from \"../application/ports/abac-authorizer.port.js\";\nimport type { AuthorizerPort } from \"../application/ports/authorizer.port.js\";\nimport type { AuthorizationError } from \"../errors/authorization-error.js\";\nimport type { AccessRequest } from \"../rbac/access-request.js\";\n\nimport type { AbacAttributes } from \"./abac-request.js\";\n\n/**\n * The request a {@link CompositeAuthorizer} accepts — one object that satisfies\n * both the RBAC {@link AccessRequest} (its `required`/`scope`) and the ABAC\n * request (its `attributes`).\n */\ntype CompositeAccessRequest = AccessRequest & {\n    readonly attributes: AbacAttributes;\n};\n\n/**\n * Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid\n * \"does the actor hold the capability, *and* do the attributes allow it here?\"\n * flow. Short-circuits with the RBAC denial when the actor is not even capable,\n * so the boundary sees the most specific 403.\n *\n * Only the two port interfaces are referenced (both erased at runtime), so this\n * pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the\n * consumer wires up.\n */\nclass CompositeAuthorizer {\n    constructor(\n        private readonly rbac: AuthorizerPort,\n        private readonly abac: AbacAuthorizerPort,\n    ) {}\n\n    async authorize(\n        request: CompositeAccessRequest,\n    ): Promise<Result<void, AuthorizationError>> {\n        const coarse = await this.rbac.authorize(request);\n        if (coarse.isErr()) {\n            return coarse;\n        }\n        return this.abac.authorize(request);\n    }\n}\n\nexport { CompositeAuthorizer, type CompositeAccessRequest };\n","import type { CombiningAlgorithm } from \"../combining.js\";\n\nimport type { AbacRule, RuleEffect } from \"./rule.js\";\n\n/**\n * An ordered collection of {@link AbacRule}s plus how to combine them\n * ({@link CombiningAlgorithm}) and what to decide when no rule applies\n * ({@link defaultEffect}). This is where ABAC goes beyond a single gate\n * condition: several PERMIT/DENY rules resolved by an explicit algorithm.\n *\n * Closed by default — the combining algorithm defaults to `\"deny-overrides\"` and\n * the default effect to `\"DENY\"`, so a request matching nothing is denied. A\n * plain holder (not a value object); build through {@link of}.\n */\nclass AbacPolicySet {\n    private constructor(\n        private readonly _rules: readonly AbacRule[],\n        private readonly _algorithm: CombiningAlgorithm,\n        private readonly _defaultEffect: RuleEffect,\n    ) {\n        Object.freeze(this._rules);\n        Object.freeze(this);\n    }\n\n    static of(\n        rules: readonly AbacRule[],\n        options: {\n            readonly algorithm?: CombiningAlgorithm;\n            readonly defaultEffect?: RuleEffect;\n        } = {},\n    ): AbacPolicySet {\n        return new AbacPolicySet(\n            [...rules],\n            options.algorithm ?? \"deny-overrides\",\n            options.defaultEffect ?? \"DENY\",\n        );\n    }\n\n    get rules(): readonly AbacRule[] {\n        return this._rules;\n    }\n\n    get algorithm(): CombiningAlgorithm {\n        return this._algorithm;\n    }\n\n    get defaultEffect(): RuleEffect {\n        return this._defaultEffect;\n    }\n}\n\nexport { AbacPolicySet };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\nimport type {\n    ConditionNode,\n    ConditionOp,\n} from \"../../policies/engines/v1/condition-types.js\";\n\n/** Whether a matching {@link AbacRule} permits or denies the action. */\ntype RuleEffect = \"PERMIT\" | \"DENY\";\n\n/**\n * The serializable shape of a rule: a stable `id`/`version` (surfaced on a\n * denial as `policyId`/`policyVersion`), the {@link RuleEffect}, and the\n * {@link ConditionNode} that decides whether the rule applies to a request's\n * flattened attributes.\n */\ntype AbacRuleProps = {\n    readonly id: string;\n    readonly version: number;\n    readonly effect: RuleEffect;\n    readonly condition: ConditionNode;\n    readonly description?: string;\n};\n\nconst RULE_FIELD = ValidationField.of(\"abacRule\");\n\nconst CONDITION_OPS = new Set<ConditionOp>([\n    \"eq\",\n    \"neq\",\n    \"gt\",\n    \"gte\",\n    \"lt\",\n    \"lte\",\n    \"in\",\n    \"notIn\",\n    \"isNull\",\n    \"isNotNull\",\n]);\n\nconst RULE_EFFECTS = new Set<RuleEffect>([\"PERMIT\", \"DENY\"]);\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * A single attribute-based rule: an {@link RuleEffect} that takes hold when its\n * {@link ConditionNode} matches the request's flattened attributes. The\n * condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves\n * combined with `and`/`or`/`not`), so a consumer learns one condition language\n * across the whole kit.\n *\n * A zod-free value object: it validates its own shape on construction (throwing\n * {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are\n * authored in TypeScript — trusted data, not untrusted JSON — the structural\n * check is a hand-rolled walk of the condition tree rather than a schema parse.\n * Build one through {@link of}; the constructor is private.\n */\nclass AbacRule extends ValueObject<AbacRuleProps, AbacRuleProps> {\n    private constructor(props: AbacRuleProps) {\n        super(props);\n        this.finalize();\n    }\n\n    /**\n     * Builds a rule, validating that `id` is non-blank, `version` is an integer\n     * ≥ 1, `effect` is `\"PERMIT\"`/`\"DENY\"`, and `condition` is a well-formed\n     * condition node. Throws {@link InvalidValueException} otherwise.\n     */\n    static of(props: AbacRuleProps): AbacRule {\n        if (typeof props.id !== \"string\" || props.id.trim().length === 0) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"id\"),\n                ValidationCode.BLANK,\n                `abac rule id must be a non-empty string, got \"${props.id}\"`,\n            );\n        }\n\n        if (!Number.isInteger(props.version) || props.version < 1) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"version\"),\n                ValidationCode.OUT_OF_RANGE,\n                `abac rule version must be an integer >= 1, got \"${props.version}\"`,\n            );\n        }\n\n        if (!RULE_EFFECTS.has(props.effect)) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"effect\"),\n                ValidationCode.INVALID_FORMAT,\n                `abac rule effect must be \"PERMIT\" or \"DENY\", got \"${String(props.effect)}\"`,\n            );\n        }\n\n        AbacRule.assertConditionShape(props.condition);\n\n        return new AbacRule(props);\n    }\n\n    // Mirrors what the shared condition evaluator would reject at eval time\n    // (empty and/or nodes, malformed leaves) but fails fast at construction.\n    private static assertConditionShape(node: unknown): void {\n        if (!isPlainObject(node)) {\n            AbacRule.rejectCondition(\n                \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n            );\n        }\n\n        if (\"and\" in node || \"or\" in node) {\n            const key = \"and\" in node ? \"and\" : \"or\";\n            const children = node[key];\n            if (!Array.isArray(children) || children.length === 0) {\n                AbacRule.rejectCondition(\n                    `abac rule \"${key}\" node must hold a non-empty array of child conditions`,\n                );\n            }\n            for (const child of children) {\n                AbacRule.assertConditionShape(child);\n            }\n            return;\n        }\n\n        if (\"not\" in node) {\n            AbacRule.assertConditionShape(node.not);\n            return;\n        }\n\n        if (\"field\" in node && \"op\" in node) {\n            if (\n                typeof node.field !== \"string\" ||\n                node.field.trim().length === 0\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"field\" must be a non-empty string, got \"${String(node.field)}\"`,\n                );\n            }\n            if (\n                typeof node.op !== \"string\" ||\n                !CONDITION_OPS.has(node.op as ConditionOp)\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"op\" is not a supported operator, got \"${String(node.op)}\"`,\n                );\n            }\n            return;\n        }\n\n        AbacRule.rejectCondition(\n            \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n        );\n    }\n\n    private static rejectCondition(message: string): never {\n        throw new InvalidValueException(\n            RULE_FIELD.nested(\"condition\"),\n            ValidationCode.INVALID_FORMAT,\n            message,\n        );\n    }\n\n    get id(): string {\n        return this.value.id;\n    }\n\n    get version(): number {\n        return this.value.version;\n    }\n\n    get effect(): RuleEffect {\n        return this.value.effect;\n    }\n\n    /** The condition tree evaluated against a request's flattened attributes. */\n    get condition(): ConditionNode {\n        return this.value.condition as ConditionNode;\n    }\n\n    get description(): string | undefined {\n        return this.value.description;\n    }\n\n    toPrimitive(): AbacRuleProps {\n        return {\n            id: this.value.id,\n            version: this.value.version,\n            effect: this.value.effect,\n            condition: this.value.condition as ConditionNode,\n            ...(this.value.description !== undefined\n                ? { description: this.value.description }\n                : {}),\n        };\n    }\n}\n\nexport { AbacRule, type AbacRuleProps, type RuleEffect };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,YAAY,SAAqC;CAC7D,MAAM,aAAa,QAAQ;CAE3B,MAAM,UAAmC;EACrC,GAAG,WAAW;EACd,IAAI,QAAQ,MAAM;CACtB;CAEA,MAAM,WAAoC,EAAE,GAAG,WAAW,SAAS;CACnE,IAAI,QAAQ,UAAU;EAClB,SAAS,OAAO,QAAQ,SAAS;EACjC,IAAI,QAAQ,SAAS,OAAO,KAAA,GACxB,SAAS,KAAK,QAAQ,SAAS;CAEvC;CAEA,OAAO;EACH;EACA;EACA,QAAQ,EAAE,GAAG,WAAW,OAAO;EAC/B,KAAK,EAAE,GAAG,WAAW,YAAY;CACrC;AACJ;;;ACfA,SAAS,gBACL,OACA,QACoB;CACpB,OAAO,MAAM,MAAM,SAAS,KAAK,WAAW,MAAM;AACtD;;;;;;;AAQA,SAAgB,QACZ,WACA,YACA,eACa;CACb,QAAQ,WAAR;EACI,KAAK,kBAAkB;GACnB,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,QAAQ,WAAW;GACzB,IAAI,OAAO,OAAO;IAAE,QAAQ,MAAM;IAAQ,cAAc;GAAM;GAC9D,OAAO,EAAE,QAAQ,cAAc;EACnC;CACJ;AACJ;;;ACjDA,MAAM,iBAAiB;;;;;;;;;;;;;;;AA4BvB,IAAM,iBAAN,MAAqB;CAGjB,YAAY,SAA+C,CAAC,GAAG;EAC3D,KAAK,aAAa,OAAO,cAAcA,4BAAAA;CAC3C;CAEA,UACI,SACA,UACwC;EAExC,MAAM,YAAY,IAAIC,4BAAAA,qBADN,YAAY,OAElB,GACN,KAAK,WAAW,8BAA8B,cAAc,CAChE;EAEA,MAAM,aAAyB,CAAC;EAChC,KAAK,MAAM,QAAQ,SAAS,OAAO;GAC/B,MAAM,UAAU,UAAU,SAAS,KAAK,SAAS;GACjD,IAAI,QAAQ,MAAM,GAEd,OAAOC,eAAAA,OAAO,IACVC,4BAAAA,mBAAmB,UAAU;IACzB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI;IACnC,SAAS,QAAQ,YAAY,KAAK,KAAA;GACtC,CAAC,CACL;GAEJ,IAAI,QAAQ,WAAW,GACnB,WAAW,KAAK,IAAI;EAE5B;EAEA,MAAM,EAAE,QAAQ,iBAAiB,QAC7B,SAAS,WACT,YACA,SAAS,aACb;EAEA,IAAI,WAAW,UACX,OAAOD,eAAAA,OAAO,GAAG;GACb,QAAQ,QAAQ;GAChB,QAAQ;GACR,aAAa,cAAc,MAAM;GACjC,WAAW,SAAS;GACpB,+BAAc,IAAI,KAAK,GAAE,YAAY;EACzC,CAAC;EAGL,OAAOA,eAAAA,OAAO,IACVC,4BAAAA,mBAAmB,aAAa;GAC5B,UAAU,cAAc,MAAM;GAC9B,eAAe,cAAc,WAAW;GACxC,iCAAgB,IAAI,KAAK,GAAE,YAAY;GACvC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI;GACnC,YAAY,cAAc;EAC9B,CAAC,CACL;CACJ;AACJ;;;;;;;;;;;;;AC9EA,IAAM,sBAAN,MAA0B;CACtB,YACI,MACA,MACF;EAFmB,KAAA,OAAA;EACA,KAAA,OAAA;CAClB;CAEH,MAAM,UACF,SACyC;EACzC,MAAM,SAAS,MAAM,KAAK,KAAK,UAAU,OAAO;EAChD,IAAI,OAAO,MAAM,GACb,OAAO;EAEX,OAAO,KAAK,KAAK,UAAU,OAAO;CACtC;AACJ;;;;;;;;;;;;;AC5BA,IAAM,gBAAN,MAAM,cAAc;CAChB,YACI,QACA,YACA,gBACF;EAHmB,KAAA,SAAA;EACA,KAAA,aAAA;EACA,KAAA,iBAAA;EAEjB,OAAO,OAAO,KAAK,MAAM;EACzB,OAAO,OAAO,IAAI;CACtB;CAEA,OAAO,GACH,OACA,UAGI,CAAC,GACQ;EACb,OAAO,IAAI,cACP,CAAC,GAAG,KAAK,GACT,QAAQ,aAAa,kBACrB,QAAQ,iBAAiB,MAC7B;CACJ;CAEA,IAAI,QAA6B;EAC7B,OAAO,KAAK;CAChB;CAEA,IAAI,YAAgC;EAChC,OAAO,KAAK;CAChB;CAEA,IAAI,gBAA4B;EAC5B,OAAO,KAAK;CAChB;AACJ;;;ACvBA,MAAM,aAAaC,yBAAAA,gBAAgB,GAAG,UAAU;AAEhD,MAAM,gBAAgB,IAAI,IAAiB;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,MAAM,eAAe,IAAI,IAAgB,CAAC,UAAU,MAAM,CAAC;AAE3D,SAAS,cAAc,OAAkD;CACrE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;;;;;;;;;;;;AAeA,IAAM,WAAN,MAAM,iBAAiBC,qBAAAA,YAA0C;CAC7D,YAAoB,OAAsB;EACtC,MAAM,KAAK;EACX,KAAK,SAAS;CAClB;;;;;;CAOA,OAAO,GAAG,OAAgC;EACtC,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,KAAK,EAAE,WAAW,GAC3D,MAAM,IAAIC,6BAAAA,sBACN,WAAW,OAAO,IAAI,GACtBC,wBAAAA,eAAe,OACf,iDAAiD,MAAM,GAAG,EAC9D;EAGJ,IAAI,CAAC,OAAO,UAAU,MAAM,OAAO,KAAK,MAAM,UAAU,GACpD,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,SAAS,GAC3BC,wBAAAA,eAAe,cACf,mDAAmD,MAAM,QAAQ,EACrE;EAGJ,IAAI,CAAC,aAAa,IAAI,MAAM,MAAM,GAC9B,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,QAAQ,GAC1BC,wBAAAA,eAAe,gBACf,qDAAqD,OAAO,MAAM,MAAM,EAAE,EAC9E;EAGJ,SAAS,qBAAqB,MAAM,SAAS;EAE7C,OAAO,IAAI,SAAS,KAAK;CAC7B;CAIA,OAAe,qBAAqB,MAAqB;EACrD,IAAI,CAAC,cAAc,IAAI,GACnB,SAAS,gBACL,gFACJ;EAGJ,IAAI,SAAS,QAAQ,QAAQ,MAAM;GAC/B,MAAM,MAAM,SAAS,OAAO,QAAQ;GACpC,MAAM,WAAW,KAAK;GACtB,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,GAChD,SAAS,gBACL,cAAc,IAAI,uDACtB;GAEJ,KAAK,MAAM,SAAS,UAChB,SAAS,qBAAqB,KAAK;GAEvC;EACJ;EAEA,IAAI,SAAS,MAAM;GACf,SAAS,qBAAqB,KAAK,GAAG;GACtC;EACJ;EAEA,IAAI,WAAW,QAAQ,QAAQ,MAAM;GACjC,IACI,OAAO,KAAK,UAAU,YACtB,KAAK,MAAM,KAAK,EAAE,WAAW,GAE7B,SAAS,gBACL,qEAAqE,OAAO,KAAK,KAAK,EAAE,EAC5F;GAEJ,IACI,OAAO,KAAK,OAAO,YACnB,CAAC,cAAc,IAAI,KAAK,EAAiB,GAEzC,SAAS,gBACL,mEAAmE,OAAO,KAAK,EAAE,EAAE,EACvF;GAEJ;EACJ;EAEA,SAAS,gBACL,gFACJ;CACJ;CAEA,OAAe,gBAAgB,SAAwB;EACnD,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,WAAW,GAC7BC,wBAAAA,eAAe,gBACf,OACJ;CACJ;CAEA,IAAI,KAAa;EACb,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,UAAkB;EAClB,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,SAAqB;EACrB,OAAO,KAAK,MAAM;CACtB;;CAGA,IAAI,YAA2B;EAC3B,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,cAAkC;EAClC,OAAO,KAAK,MAAM;CACtB;CAEA,cAA6B;EACzB,OAAO;GACH,IAAI,KAAK,MAAM;GACf,SAAS,KAAK,MAAM;GACpB,QAAQ,KAAK,MAAM;GACnB,WAAW,KAAK,MAAM;GACtB,GAAI,KAAK,MAAM,gBAAgB,KAAA,IACzB,EAAE,aAAa,KAAK,MAAM,YAAY,IACtC,CAAC;EACX;CACJ;AACJ"}

package/dist/rule.js

@@ -0,0 +1,298 @@
+import { t as AuthorizationError } from "./authorization-error.js";
+import { t as ValidationCode } from "./validation-code.js";
+import { t as ValidationField } from "./validation-field.js";
+import { t as InvalidValueException } from "./validation-exception.js";
+import { t as ValueObject } from "./value-object.js";
+import { r as Result } from "./result.js";
+import { r as coreConfig, t as ConditionEvaluatorV1 } from "./condition-evaluator.js";
+//#region src/core/abac/attributes.ts
+/**
+* Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the
+* condition evaluator reads (it resolves dotted fields like `resource.status` by
+* walking nested objects). The actor lands as `subject.id`; the four attribute
+* bags nest under `subject` / `resource` / `action` / `env`; a `resource`
+* reference adds `resource.type` / `resource.id`. The actor id and the resource
+* reference win over any same-named keys in the attribute bags.
+*
+* Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,
+* or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so
+* rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.
+*/
+function abacContext(request) {
+	const attributes = request.attributes;
+	const subject = {
+		...attributes.subject,
+		id: request.actor.raw
+	};
+	const resource = { ...attributes.resource };
+	if (request.resource) {
+		resource.type = request.resource.type;
+		if (request.resource.id !== void 0) resource.id = request.resource.id;
+	}
+	return {
+		subject,
+		resource,
+		action: { ...attributes.action },
+		env: { ...attributes.environment }
+	};
+}
+//#endregion
+//#region src/core/abac/combining.ts
+function firstWithEffect(rules, effect) {
+	return rules.find((rule) => rule.effect === effect);
+}
+/**
+* Applies `algorithm` to the already-matched `applicable` rules, falling back to
+* `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and
+* total; the returned `decidingRule` is absent exactly when `defaultEffect` was
+* used.
+*/
+function combine(algorithm, applicable, defaultEffect) {
+	switch (algorithm) {
+		case "deny-overrides": {
+			const deny = firstWithEffect(applicable, "DENY");
+			if (deny) return {
+				effect: "DENY",
+				decidingRule: deny
+			};
+			const permit = firstWithEffect(applicable, "PERMIT");
+			if (permit) return {
+				effect: "PERMIT",
+				decidingRule: permit
+			};
+			return { effect: defaultEffect };
+		}
+		case "permit-overrides": {
+			const permit = firstWithEffect(applicable, "PERMIT");
+			if (permit) return {
+				effect: "PERMIT",
+				decidingRule: permit
+			};
+			const deny = firstWithEffect(applicable, "DENY");
+			if (deny) return {
+				effect: "DENY",
+				decidingRule: deny
+			};
+			return { effect: defaultEffect };
+		}
+		case "first-applicable": {
+			const first = applicable[0];
+			if (first) return {
+				effect: first.effect,
+				decidingRule: first
+			};
+			return { effect: defaultEffect };
+		}
+	}
+}
+//#endregion
+//#region src/core/abac/authorizer.ts
+const ENGINE_VERSION = 1;
+/**
+* The pure ABAC decisor. Given an {@link AbacRequest} and an
+* {@link AbacPolicySet}, it flattens the request's attributes into a context,
+* matches each rule's condition with the gate engine's pure condition evaluator
+* (reused, not reimplemented), resolves the effects through the set's combining
+* algorithm, and returns a {@link Result} — never throwing, mirroring the
+* "errors as values" contract of `RbacAuthorizer`/`GateEngineV1`.
+*
+* A denial maps to {@link AuthorizationError.policyDenied}, attributed to the
+* deciding rule's `id`/`version`; a condition-evaluation failure (a missing
+* attribute, a wrong-typed operand) fails closed as
+* {@link AuthorizationError.forbidden}. Loading the dynamic attributes is the
+* consumer's job (behind an `AbacAuthorizerPort` adapter); this class only decides.
+*/
+var AbacAuthorizer = class {
+	constructor(params = {}) {
+		this.coreConfig = params.coreConfig ?? coreConfig;
+	}
+	authorize(request, policies) {
+		const evaluator = new ConditionEvaluatorV1(abacContext(request), this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION));
+		const applicable = [];
+		for (const rule of policies.rules) {
+			const matched = evaluator.evaluate(rule.condition);
+			if (matched.isErr()) return Result.err(AuthorizationError.forbidden({
+				action: request.action,
+				resource: request.resource,
+				actor: { userId: request.actor.raw },
+				details: matched.errorOrNull() ?? void 0
+			}));
+			if (matched.getOrThrow()) applicable.push(rule);
+		}
+		const { effect, decidingRule } = combine(policies.algorithm, applicable, policies.defaultEffect);
+		if (effect === "PERMIT") return Result.ok({
+			action: request.action,
+			effect: "PERMIT",
+			matchedRule: decidingRule?.id ?? "<default>",
+			algorithm: policies.algorithm,
+			grantedAtIso: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		return Result.err(AuthorizationError.policyDenied({
+			policyId: decidingRule?.id ?? "<default-deny>",
+			policyVersion: decidingRule?.version ?? 0,
+			evaluatedAtIso: (/* @__PURE__ */ new Date()).toISOString(),
+			action: request.action,
+			resource: request.resource,
+			actor: { userId: request.actor.raw },
+			reasonCode: decidingRule?.id
+		}));
+	}
+};
+//#endregion
+//#region src/core/abac/composite-authorizer.ts
+/**
+* Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid
+* "does the actor hold the capability, *and* do the attributes allow it here?"
+* flow. Short-circuits with the RBAC denial when the actor is not even capable,
+* so the boundary sees the most specific 403.
+*
+* Only the two port interfaces are referenced (both erased at runtime), so this
+* pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the
+* consumer wires up.
+*/
+var CompositeAuthorizer = class {
+	constructor(rbac, abac) {
+		this.rbac = rbac;
+		this.abac = abac;
+	}
+	async authorize(request) {
+		const coarse = await this.rbac.authorize(request);
+		if (coarse.isErr()) return coarse;
+		return this.abac.authorize(request);
+	}
+};
+//#endregion
+//#region src/core/abac/domain/policy-set.ts
+/**
+* An ordered collection of {@link AbacRule}s plus how to combine them
+* ({@link CombiningAlgorithm}) and what to decide when no rule applies
+* ({@link defaultEffect}). This is where ABAC goes beyond a single gate
+* condition: several PERMIT/DENY rules resolved by an explicit algorithm.
+*
+* Closed by default — the combining algorithm defaults to `"deny-overrides"` and
+* the default effect to `"DENY"`, so a request matching nothing is denied. A
+* plain holder (not a value object); build through {@link of}.
+*/
+var AbacPolicySet = class AbacPolicySet {
+	constructor(_rules, _algorithm, _defaultEffect) {
+		this._rules = _rules;
+		this._algorithm = _algorithm;
+		this._defaultEffect = _defaultEffect;
+		Object.freeze(this._rules);
+		Object.freeze(this);
+	}
+	static of(rules, options = {}) {
+		return new AbacPolicySet([...rules], options.algorithm ?? "deny-overrides", options.defaultEffect ?? "DENY");
+	}
+	get rules() {
+		return this._rules;
+	}
+	get algorithm() {
+		return this._algorithm;
+	}
+	get defaultEffect() {
+		return this._defaultEffect;
+	}
+};
+//#endregion
+//#region src/core/abac/domain/rule.ts
+const RULE_FIELD = ValidationField.of("abacRule");
+const CONDITION_OPS = new Set([
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"in",
+	"notIn",
+	"isNull",
+	"isNotNull"
+]);
+const RULE_EFFECTS = new Set(["PERMIT", "DENY"]);
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* A single attribute-based rule: an {@link RuleEffect} that takes hold when its
+* {@link ConditionNode} matches the request's flattened attributes. The
+* condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves
+* combined with `and`/`or`/`not`), so a consumer learns one condition language
+* across the whole kit.
+*
+* A zod-free value object: it validates its own shape on construction (throwing
+* {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are
+* authored in TypeScript — trusted data, not untrusted JSON — the structural
+* check is a hand-rolled walk of the condition tree rather than a schema parse.
+* Build one through {@link of}; the constructor is private.
+*/
+var AbacRule = class AbacRule extends ValueObject {
+	constructor(props) {
+		super(props);
+		this.finalize();
+	}
+	/**
+	* Builds a rule, validating that `id` is non-blank, `version` is an integer
+	* ≥ 1, `effect` is `"PERMIT"`/`"DENY"`, and `condition` is a well-formed
+	* condition node. Throws {@link InvalidValueException} otherwise.
+	*/
+	static of(props) {
+		if (typeof props.id !== "string" || props.id.trim().length === 0) throw new InvalidValueException(RULE_FIELD.nested("id"), ValidationCode.BLANK, `abac rule id must be a non-empty string, got "${props.id}"`);
+		if (!Number.isInteger(props.version) || props.version < 1) throw new InvalidValueException(RULE_FIELD.nested("version"), ValidationCode.OUT_OF_RANGE, `abac rule version must be an integer >= 1, got "${props.version}"`);
+		if (!RULE_EFFECTS.has(props.effect)) throw new InvalidValueException(RULE_FIELD.nested("effect"), ValidationCode.INVALID_FORMAT, `abac rule effect must be "PERMIT" or "DENY", got "${String(props.effect)}"`);
+		AbacRule.assertConditionShape(props.condition);
+		return new AbacRule(props);
+	}
+	static assertConditionShape(node) {
+		if (!isPlainObject(node)) AbacRule.rejectCondition("abac rule condition must be a leaf { field, op } or an { and | or | not } node");
+		if ("and" in node || "or" in node) {
+			const key = "and" in node ? "and" : "or";
+			const children = node[key];
+			if (!Array.isArray(children) || children.length === 0) AbacRule.rejectCondition(`abac rule "${key}" node must hold a non-empty array of child conditions`);
+			for (const child of children) AbacRule.assertConditionShape(child);
+			return;
+		}
+		if ("not" in node) {
+			AbacRule.assertConditionShape(node.not);
+			return;
+		}
+		if ("field" in node && "op" in node) {
+			if (typeof node.field !== "string" || node.field.trim().length === 0) AbacRule.rejectCondition(`abac rule condition leaf "field" must be a non-empty string, got "${String(node.field)}"`);
+			if (typeof node.op !== "string" || !CONDITION_OPS.has(node.op)) AbacRule.rejectCondition(`abac rule condition leaf "op" is not a supported operator, got "${String(node.op)}"`);
+			return;
+		}
+		AbacRule.rejectCondition("abac rule condition must be a leaf { field, op } or an { and | or | not } node");
+	}
+	static rejectCondition(message) {
+		throw new InvalidValueException(RULE_FIELD.nested("condition"), ValidationCode.INVALID_FORMAT, message);
+	}
+	get id() {
+		return this.value.id;
+	}
+	get version() {
+		return this.value.version;
+	}
+	get effect() {
+		return this.value.effect;
+	}
+	/** The condition tree evaluated against a request's flattened attributes. */
+	get condition() {
+		return this.value.condition;
+	}
+	get description() {
+		return this.value.description;
+	}
+	toPrimitive() {
+		return {
+			id: this.value.id,
+			version: this.value.version,
+			effect: this.value.effect,
+			condition: this.value.condition,
+			...this.value.description !== void 0 ? { description: this.value.description } : {}
+		};
+	}
+};
+//#endregion
+export { abacContext as a, AbacAuthorizer as i, AbacPolicySet as n, CompositeAuthorizer as r, AbacRule as t };
+
+//# sourceMappingURL=rule.js.map