@cullet/erp-core 1.4.0 → 2.0.0

package/dist/rule.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"rule.cjs","names":["coreConfig","ConditionEvaluatorV1","Result","AuthorizationError","ValidationField","ValueObject","InvalidValueException","ValidationCode"],"sources":["../src/core/abac/attributes.ts","../src/core/abac/combining.ts","../src/core/abac/authorizer.ts","../src/core/abac/composite-authorizer.ts","../src/core/abac/domain/policy-set.ts","../src/core/abac/domain/rule.ts"],"sourcesContent":["import type { PolicyContext } from \"../policies/engines/gate-types.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\n\n/**\n * Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the\n * condition evaluator reads (it resolves dotted fields like `resource.status` by\n * walking nested objects). The actor lands as `subject.id`; the four attribute\n * bags nest under `subject` / `resource` / `action` / `env`; a `resource`\n * reference adds `resource.type` / `resource.id`. The actor id and the resource\n * reference win over any same-named keys in the attribute bags.\n *\n * Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,\n * or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so\n * rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.\n */\nexport function abacContext(request: AbacRequest): PolicyContext {\n    const attributes = request.attributes;\n\n    const subject: Record<string, unknown> = {\n        ...attributes.subject,\n        id: request.actor.raw,\n    };\n\n    const resource: Record<string, unknown> = { ...attributes.resource };\n    if (request.resource) {\n        resource.type = request.resource.type;\n        if (request.resource.id !== undefined) {\n            resource.id = request.resource.id;\n        }\n    }\n\n    return {\n        subject,\n        resource,\n        action: { ...attributes.action },\n        env: { ...attributes.environment },\n    };\n}\n","import type { AbacRule, RuleEffect } from \"./domain/rule.js\";\n\n/**\n * How an {@link AbacPolicySet} resolves several applicable rules into one effect.\n *\n * - `deny-overrides` (default, secure): any applicable DENY wins; otherwise the\n *   first PERMIT; otherwise the set's default effect.\n * - `permit-overrides`: any applicable PERMIT wins; otherwise the first DENY;\n *   otherwise the default effect.\n * - `first-applicable`: the effect of the first rule that matches; otherwise the\n *   default effect.\n */\nexport type CombiningAlgorithm =\n    | \"deny-overrides\"\n    | \"permit-overrides\"\n    | \"first-applicable\";\n\n/** The resolved decision plus the rule (if any) that produced it. */\nexport interface CombineResult {\n    readonly effect: RuleEffect;\n    readonly decidingRule?: AbacRule;\n}\n\nfunction firstWithEffect(\n    rules: readonly AbacRule[],\n    effect: RuleEffect,\n): AbacRule | undefined {\n    return rules.find((rule) => rule.effect === effect);\n}\n\n/**\n * Applies `algorithm` to the already-matched `applicable` rules, falling back to\n * `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and\n * total; the returned `decidingRule` is absent exactly when `defaultEffect` was\n * used.\n */\nexport function combine(\n    algorithm: CombiningAlgorithm,\n    applicable: readonly AbacRule[],\n    defaultEffect: RuleEffect,\n): CombineResult {\n    switch (algorithm) {\n        case \"deny-overrides\": {\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            return { effect: defaultEffect };\n        }\n        case \"permit-overrides\": {\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            return { effect: defaultEffect };\n        }\n        case \"first-applicable\": {\n            const first = applicable[0];\n            if (first) return { effect: first.effect, decidingRule: first };\n            return { effect: defaultEffect };\n        }\n    }\n}\n","import { type CoreConfig, coreConfig } from \"../config/index.js\";\nimport { AuthorizationError } from \"../errors/authorization-error.js\";\nimport { ConditionEvaluatorV1 } from \"../policies/engines/v1/condition-evaluator.js\";\nimport { Result } from \"../result/result.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\nimport { abacContext } from \"./attributes.js\";\nimport { combine, type CombiningAlgorithm } from \"./combining.js\";\nimport type { AbacPolicySet } from \"./domain/policy-set.js\";\nimport type { AbacRule } from \"./domain/rule.js\";\n\n// ABAC reuses the gate engine's v1 condition matcher; the version stamps the\n// evaluation reports the shared reporter emits.\nconst ENGINE_VERSION = 1;\n\n/** The successful decision returned by {@link AbacAuthorizer.authorize}. */\ninterface AbacDecision {\n    /** The audited business action that was allowed. */\n    readonly action: string;\n    readonly effect: \"PERMIT\";\n    /** The id of the rule that permitted, or `\"<default>\"` when the set's default did. */\n    readonly matchedRule: string;\n    readonly algorithm: CombiningAlgorithm;\n    /** When the decision was made, ISO-8601. */\n    readonly grantedAtIso: string;\n}\n\n/**\n * The pure ABAC decisor. Given an {@link AbacRequest} and an\n * {@link AbacPolicySet}, it flattens the request's attributes into a context,\n * matches each rule's condition with the gate engine's pure condition evaluator\n * (reused, not reimplemented), resolves the effects through the set's combining\n * algorithm, and returns a {@link Result} — never throwing, mirroring the\n * \"errors as values\" contract of `RbacAuthorizer`/`GateEngineV1`.\n *\n * A denial maps to {@link AuthorizationError.policyDenied}, attributed to the\n * deciding rule's `id`/`version`; a condition-evaluation failure (a missing\n * attribute, a wrong-typed operand) fails closed as\n * {@link AuthorizationError.forbidden}. Loading the dynamic attributes is the\n * consumer's job (behind an `AbacAuthorizerPort` adapter); this class only decides.\n */\nclass AbacAuthorizer {\n    private readonly coreConfig: CoreConfig;\n\n    constructor(params: { readonly coreConfig?: CoreConfig } = {}) {\n        this.coreConfig = params.coreConfig ?? coreConfig;\n    }\n\n    authorize(\n        request: AbacRequest,\n        policies: AbacPolicySet,\n    ): Result<AbacDecision, AuthorizationError> {\n        const context = abacContext(request);\n        const evaluator = new ConditionEvaluatorV1(\n            context,\n            this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION),\n        );\n\n        const applicable: AbacRule[] = [];\n        for (const rule of policies.rules) {\n            const matched = evaluator.evaluate(rule.condition);\n            if (matched.isErr()) {\n                // Fail closed: a technical evaluation error is never a silent PERMIT.\n                return Result.err(\n                    AuthorizationError.forbidden({\n                        action: request.action,\n                        resource: request.resource,\n                        actor: { userId: request.actor.raw },\n                        details: matched.errorOrNull() ?? undefined,\n                    }),\n                );\n            }\n            if (matched.getOrThrow()) {\n                applicable.push(rule);\n            }\n        }\n\n        const { effect, decidingRule } = combine(\n            policies.algorithm,\n            applicable,\n            policies.defaultEffect,\n        );\n\n        if (effect === \"PERMIT\") {\n            return Result.ok({\n                action: request.action,\n                effect: \"PERMIT\",\n                matchedRule: decidingRule?.id ?? \"<default>\",\n                algorithm: policies.algorithm,\n                grantedAtIso: new Date().toISOString(),\n            });\n        }\n\n        return Result.err(\n            AuthorizationError.policyDenied({\n                policyId: decidingRule?.id ?? \"<default-deny>\",\n                policyVersion: decidingRule?.version ?? 0,\n                evaluatedAtIso: new Date().toISOString(),\n                action: request.action,\n                resource: request.resource,\n                actor: { userId: request.actor.raw },\n                reasonCode: decidingRule?.id,\n            }),\n        );\n    }\n}\n\nexport { AbacAuthorizer, type AbacDecision };\n","import { Result } from \"../result/result.js\";\nimport type { AbacAuthorizerPort } from \"../application/ports/abac-authorizer.port.js\";\nimport type { AuthorizerPort } from \"../application/ports/authorizer.port.js\";\nimport type { AuthorizationError } from \"../errors/authorization-error.js\";\nimport type { AccessRequest } from \"../rbac/access-request.js\";\n\nimport type { AbacAttributes } from \"./abac-request.js\";\n\n/**\n * The request a {@link CompositeAuthorizer} accepts — one object that satisfies\n * both the RBAC {@link AccessRequest} (its `required`/`scope`) and the ABAC\n * request (its `attributes`).\n */\ntype CompositeAccessRequest = AccessRequest & {\n    readonly attributes: AbacAttributes;\n};\n\n/**\n * Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid\n * \"does the actor hold the capability, *and* do the attributes allow it here?\"\n * flow. Short-circuits with the RBAC denial when the actor is not even capable,\n * so the boundary sees the most specific 403.\n *\n * Only the two port interfaces are referenced (both erased at runtime), so this\n * pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the\n * consumer wires up.\n */\nclass CompositeAuthorizer {\n    constructor(\n        private readonly rbac: AuthorizerPort,\n        private readonly abac: AbacAuthorizerPort,\n    ) {}\n\n    async authorize(\n        request: CompositeAccessRequest,\n    ): Promise<Result<void, AuthorizationError>> {\n        const coarse = await this.rbac.authorize(request);\n        if (coarse.isErr()) {\n            return coarse;\n        }\n        return this.abac.authorize(request);\n    }\n}\n\nexport { CompositeAuthorizer, type CompositeAccessRequest };\n","import type { CombiningAlgorithm } from \"../combining.js\";\n\nimport type { AbacRule, RuleEffect } from \"./rule.js\";\n\n/**\n * An ordered collection of {@link AbacRule}s plus how to combine them\n * ({@link CombiningAlgorithm}) and what to decide when no rule applies\n * ({@link defaultEffect}). This is where ABAC goes beyond a single gate\n * condition: several PERMIT/DENY rules resolved by an explicit algorithm.\n *\n * Closed by default — the combining algorithm defaults to `\"deny-overrides\"` and\n * the default effect to `\"DENY\"`, so a request matching nothing is denied. A\n * plain holder (not a value object); build through {@link of}.\n */\nclass AbacPolicySet {\n    private constructor(\n        private readonly _rules: readonly AbacRule[],\n        private readonly _algorithm: CombiningAlgorithm,\n        private readonly _defaultEffect: RuleEffect,\n    ) {\n        Object.freeze(this._rules);\n        Object.freeze(this);\n    }\n\n    static of(\n        rules: readonly AbacRule[],\n        options: {\n            readonly algorithm?: CombiningAlgorithm;\n            readonly defaultEffect?: RuleEffect;\n        } = {},\n    ): AbacPolicySet {\n        return new AbacPolicySet(\n            [...rules],\n            options.algorithm ?? \"deny-overrides\",\n            options.defaultEffect ?? \"DENY\",\n        );\n    }\n\n    get rules(): readonly AbacRule[] {\n        return this._rules;\n    }\n\n    get algorithm(): CombiningAlgorithm {\n        return this._algorithm;\n    }\n\n    get defaultEffect(): RuleEffect {\n        return this._defaultEffect;\n    }\n}\n\nexport { AbacPolicySet };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\nimport type {\n    ConditionNode,\n    ConditionOp,\n} from \"../../policies/engines/v1/condition-types.js\";\n\n/** Whether a matching {@link AbacRule} permits or denies the action. */\ntype RuleEffect = \"PERMIT\" | \"DENY\";\n\n/**\n * The serializable shape of a rule: a stable `id`/`version` (surfaced on a\n * denial as `policyId`/`policyVersion`), the {@link RuleEffect}, and the\n * {@link ConditionNode} that decides whether the rule applies to a request's\n * flattened attributes.\n */\ntype AbacRuleProps = {\n    readonly id: string;\n    readonly version: number;\n    readonly effect: RuleEffect;\n    readonly condition: ConditionNode;\n    readonly description?: string;\n};\n\nconst RULE_FIELD = ValidationField.of(\"abacRule\");\n\nconst CONDITION_OPS = new Set<ConditionOp>([\n    \"eq\",\n    \"neq\",\n    \"gt\",\n    \"gte\",\n    \"lt\",\n    \"lte\",\n    \"in\",\n    \"notIn\",\n    \"isNull\",\n    \"isNotNull\",\n]);\n\nconst RULE_EFFECTS = new Set<RuleEffect>([\"PERMIT\", \"DENY\"]);\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * A single attribute-based rule: an {@link RuleEffect} that takes hold when its\n * {@link ConditionNode} matches the request's flattened attributes. The\n * condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves\n * combined with `and`/`or`/`not`), so a consumer learns one condition language\n * across the whole kit.\n *\n * A zod-free value object: it validates its own shape on construction (throwing\n * {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are\n * authored in TypeScript — trusted data, not untrusted JSON — the structural\n * check is a hand-rolled walk of the condition tree rather than a schema parse.\n * Build one through {@link of}; the constructor is private.\n */\nclass AbacRule extends ValueObject<AbacRuleProps, AbacRuleProps> {\n    private constructor(props: AbacRuleProps) {\n        super(props);\n        this.finalize();\n    }\n\n    /**\n     * Builds a rule, validating that `id` is non-blank, `version` is an integer\n     * ≥ 1, `effect` is `\"PERMIT\"`/`\"DENY\"`, and `condition` is a well-formed\n     * condition node. Throws {@link InvalidValueException} otherwise.\n     */\n    static of(props: AbacRuleProps): AbacRule {\n        if (typeof props.id !== \"string\" || props.id.trim().length === 0) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"id\"),\n                ValidationCode.BLANK,\n                `abac rule id must be a non-empty string, got \"${props.id}\"`,\n            );\n        }\n\n        if (!Number.isInteger(props.version) || props.version < 1) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"version\"),\n                ValidationCode.OUT_OF_RANGE,\n                `abac rule version must be an integer >= 1, got \"${props.version}\"`,\n            );\n        }\n\n        if (!RULE_EFFECTS.has(props.effect)) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"effect\"),\n                ValidationCode.INVALID_FORMAT,\n                `abac rule effect must be \"PERMIT\" or \"DENY\", got \"${String(props.effect)}\"`,\n            );\n        }\n\n        AbacRule.assertConditionShape(props.condition);\n\n        return new AbacRule(props);\n    }\n\n    // Mirrors what the shared condition evaluator would reject at eval time\n    // (empty and/or nodes, malformed leaves) but fails fast at construction.\n    private static assertConditionShape(node: unknown): void {\n        if (!isPlainObject(node)) {\n            AbacRule.rejectCondition(\n                \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n            );\n        }\n\n        if (\"and\" in node || \"or\" in node) {\n            const key = \"and\" in node ? \"and\" : \"or\";\n            const children = node[key];\n            if (!Array.isArray(children) || children.length === 0) {\n                AbacRule.rejectCondition(\n                    `abac rule \"${key}\" node must hold a non-empty array of child conditions`,\n                );\n            }\n            for (const child of children) {\n                AbacRule.assertConditionShape(child);\n            }\n            return;\n        }\n\n        if (\"not\" in node) {\n            AbacRule.assertConditionShape(node.not);\n            return;\n        }\n\n        if (\"field\" in node && \"op\" in node) {\n            if (\n                typeof node.field !== \"string\" ||\n                node.field.trim().length === 0\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"field\" must be a non-empty string, got \"${String(node.field)}\"`,\n                );\n            }\n            if (\n                typeof node.op !== \"string\" ||\n                !CONDITION_OPS.has(node.op as ConditionOp)\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"op\" is not a supported operator, got \"${String(node.op)}\"`,\n                );\n            }\n            return;\n        }\n\n        AbacRule.rejectCondition(\n            \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n        );\n    }\n\n    private static rejectCondition(message: string): never {\n        throw new InvalidValueException(\n            RULE_FIELD.nested(\"condition\"),\n            ValidationCode.INVALID_FORMAT,\n            message,\n        );\n    }\n\n    get id(): string {\n        return this.value.id;\n    }\n\n    get version(): number {\n        return this.value.version;\n    }\n\n    get effect(): RuleEffect {\n        return this.value.effect;\n    }\n\n    /** The condition tree evaluated against a request's flattened attributes. */\n    get condition(): ConditionNode {\n        return this.value.condition as ConditionNode;\n    }\n\n    get description(): string | undefined {\n        return this.value.description;\n    }\n\n    toPrimitive(): AbacRuleProps {\n        return {\n            id: this.value.id,\n            version: this.value.version,\n            effect: this.value.effect,\n            condition: this.value.condition as ConditionNode,\n            ...(this.value.description !== undefined\n                ? { description: this.value.description }\n                : {}),\n        };\n    }\n}\n\nexport { AbacRule, type AbacRuleProps, type RuleEffect };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,YAAY,SAAqC;CAC7D,MAAM,aAAa,QAAQ;CAE3B,MAAM,UAAmC;EACrC,GAAG,WAAW;EACd,IAAI,QAAQ,MAAM;CACtB;CAEA,MAAM,WAAoC,EAAE,GAAG,WAAW,SAAS;CACnE,IAAI,QAAQ,UAAU;EAClB,SAAS,OAAO,QAAQ,SAAS;EACjC,IAAI,QAAQ,SAAS,OAAO,KAAA,GACxB,SAAS,KAAK,QAAQ,SAAS;CAEvC;CAEA,OAAO;EACH;EACA;EACA,QAAQ,EAAE,GAAG,WAAW,OAAO;EAC/B,KAAK,EAAE,GAAG,WAAW,YAAY;CACrC;AACJ;;;ACfA,SAAS,gBACL,OACA,QACoB;CACpB,OAAO,MAAM,MAAM,SAAS,KAAK,WAAW,MAAM;AACtD;;;;;;;AAQA,SAAgB,QACZ,WACA,YACA,eACa;CACb,QAAQ,WAAR;EACI,KAAK,kBAAkB;GACnB,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,QAAQ,WAAW;GACzB,IAAI,OAAO,OAAO;IAAE,QAAQ,MAAM;IAAQ,cAAc;GAAM;GAC9D,OAAO,EAAE,QAAQ,cAAc;EACnC;CACJ;AACJ;;;ACjDA,MAAM,iBAAiB;;;;;;;;;;;;;;;AA4BvB,IAAM,iBAAN,MAAqB;CAGjB,YAAY,SAA+C,CAAC,GAAG;EAC3D,KAAK,aAAa,OAAO,cAAcA,4BAAAA;CAC3C;CAEA,UACI,SACA,UACwC;EAExC,MAAM,YAAY,IAAIC,4BAAAA,qBADN,YAAY,OAElB,GACN,KAAK,WAAW,8BAA8B,cAAc,CAChE;EAEA,MAAM,aAAyB,CAAC;EAChC,KAAK,MAAM,QAAQ,SAAS,OAAO;GAC/B,MAAM,UAAU,UAAU,SAAS,KAAK,SAAS;GACjD,IAAI,QAAQ,MAAM,GAEd,OAAOC,eAAAA,OAAO,IACVC,4BAAAA,mBAAmB,UAAU;IACzB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI;IACnC,SAAS,QAAQ,YAAY,KAAK,KAAA;GACtC,CAAC,CACL;GAEJ,IAAI,QAAQ,WAAW,GACnB,WAAW,KAAK,IAAI;EAE5B;EAEA,MAAM,EAAE,QAAQ,iBAAiB,QAC7B,SAAS,WACT,YACA,SAAS,aACb;EAEA,IAAI,WAAW,UACX,OAAOD,eAAAA,OAAO,GAAG;GACb,QAAQ,QAAQ;GAChB,QAAQ;GACR,aAAa,cAAc,MAAM;GACjC,WAAW,SAAS;GACpB,+BAAc,IAAI,KAAK,GAAE,YAAY;EACzC,CAAC;EAGL,OAAOA,eAAAA,OAAO,IACVC,4BAAAA,mBAAmB,aAAa;GAC5B,UAAU,cAAc,MAAM;GAC9B,eAAe,cAAc,WAAW;GACxC,iCAAgB,IAAI,KAAK,GAAE,YAAY;GACvC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI;GACnC,YAAY,cAAc;EAC9B,CAAC,CACL;CACJ;AACJ;;;;;;;;;;;;;AC9EA,IAAM,sBAAN,MAA0B;CACtB,YACI,MACA,MACF;EAFmB,KAAA,OAAA;EACA,KAAA,OAAA;CAClB;CAEH,MAAM,UACF,SACyC;EACzC,MAAM,SAAS,MAAM,KAAK,KAAK,UAAU,OAAO;EAChD,IAAI,OAAO,MAAM,GACb,OAAO;EAEX,OAAO,KAAK,KAAK,UAAU,OAAO;CACtC;AACJ;;;;;;;;;;;;;AC5BA,IAAM,gBAAN,MAAM,cAAc;CAChB,YACI,QACA,YACA,gBACF;EAHmB,KAAA,SAAA;EACA,KAAA,aAAA;EACA,KAAA,iBAAA;EAEjB,OAAO,OAAO,KAAK,MAAM;EACzB,OAAO,OAAO,IAAI;CACtB;CAEA,OAAO,GACH,OACA,UAGI,CAAC,GACQ;EACb,OAAO,IAAI,cACP,CAAC,GAAG,KAAK,GACT,QAAQ,aAAa,kBACrB,QAAQ,iBAAiB,MAC7B;CACJ;CAEA,IAAI,QAA6B;EAC7B,OAAO,KAAK;CAChB;CAEA,IAAI,YAAgC;EAChC,OAAO,KAAK;CAChB;CAEA,IAAI,gBAA4B;EAC5B,OAAO,KAAK;CAChB;AACJ;;;ACvBA,MAAM,aAAaC,yBAAAA,gBAAgB,GAAG,UAAU;AAEhD,MAAM,gBAAgB,IAAI,IAAiB;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,MAAM,eAAe,IAAI,IAAgB,CAAC,UAAU,MAAM,CAAC;AAE3D,SAAS,cAAc,OAAkD;CACrE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;;;;;;;;;;;;AAeA,IAAM,WAAN,MAAM,iBAAiBC,qBAAAA,YAA0C;CAC7D,YAAoB,OAAsB;EACtC,MAAM,KAAK;EACX,KAAK,SAAS;CAClB;;;;;;CAOA,OAAO,GAAG,OAAgC;EACtC,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,KAAK,EAAE,WAAW,GAC3D,MAAM,IAAIC,6BAAAA,sBACN,WAAW,OAAO,IAAI,GACtBC,wBAAAA,eAAe,OACf,iDAAiD,MAAM,GAAG,EAC9D;EAGJ,IAAI,CAAC,OAAO,UAAU,MAAM,OAAO,KAAK,MAAM,UAAU,GACpD,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,SAAS,GAC3BC,wBAAAA,eAAe,cACf,mDAAmD,MAAM,QAAQ,EACrE;EAGJ,IAAI,CAAC,aAAa,IAAI,MAAM,MAAM,GAC9B,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,QAAQ,GAC1BC,wBAAAA,eAAe,gBACf,qDAAqD,OAAO,MAAM,MAAM,EAAE,EAC9E;EAGJ,SAAS,qBAAqB,MAAM,SAAS;EAE7C,OAAO,IAAI,SAAS,KAAK;CAC7B;CAIA,OAAe,qBAAqB,MAAqB;EACrD,IAAI,CAAC,cAAc,IAAI,GACnB,SAAS,gBACL,gFACJ;EAGJ,IAAI,SAAS,QAAQ,QAAQ,MAAM;GAC/B,MAAM,MAAM,SAAS,OAAO,QAAQ;GACpC,MAAM,WAAW,KAAK;GACtB,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,GAChD,SAAS,gBACL,cAAc,IAAI,uDACtB;GAEJ,KAAK,MAAM,SAAS,UAChB,SAAS,qBAAqB,KAAK;GAEvC;EACJ;EAEA,IAAI,SAAS,MAAM;GACf,SAAS,qBAAqB,KAAK,GAAG;GACtC;EACJ;EAEA,IAAI,WAAW,QAAQ,QAAQ,MAAM;GACjC,IACI,OAAO,KAAK,UAAU,YACtB,KAAK,MAAM,KAAK,EAAE,WAAW,GAE7B,SAAS,gBACL,qEAAqE,OAAO,KAAK,KAAK,EAAE,EAC5F;GAEJ,IACI,OAAO,KAAK,OAAO,YACnB,CAAC,cAAc,IAAI,KAAK,EAAiB,GAEzC,SAAS,gBACL,mEAAmE,OAAO,KAAK,EAAE,EAAE,EACvF;GAEJ;EACJ;EAEA,SAAS,gBACL,gFACJ;CACJ;CAEA,OAAe,gBAAgB,SAAwB;EACnD,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,WAAW,GAC7BC,wBAAAA,eAAe,gBACf,OACJ;CACJ;CAEA,IAAI,KAAa;EACb,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,UAAkB;EAClB,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,SAAqB;EACrB,OAAO,KAAK,MAAM;CACtB;;CAGA,IAAI,YAA2B;EAC3B,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,cAAkC;EAClC,OAAO,KAAK,MAAM;CACtB;CAEA,cAA6B;EACzB,OAAO;GACH,IAAI,KAAK,MAAM;GACf,SAAS,KAAK,MAAM;GACpB,QAAQ,KAAK,MAAM;GACnB,WAAW,KAAK,MAAM;GACtB,GAAI,KAAK,MAAM,gBAAgB,KAAA,IACzB,EAAE,aAAa,KAAK,MAAM,YAAY,IACtC,CAAC;EACX;CACJ;AACJ"}
+{"version":3,"file":"rule.cjs","names":["coreConfig","ConditionEvaluatorV1","Result","AuthorizationError","ValidationField","InvalidValueException","ValidationCode","ValidationField","ValueObject","InvalidValueException","ValidationCode"],"sources":["../src/core/abac/attributes.ts","../src/core/abac/combining.ts","../src/core/abac/authorizer.ts","../src/core/abac/composite-authorizer.ts","../src/core/abac/domain/policy-set.ts","../src/core/policies/engines/v1/condition-types.ts","../src/core/abac/domain/rule.ts"],"sourcesContent":["import type { PolicyContext } from \"../policies/engines/gate-types.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\n\n/**\n * Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the\n * condition evaluator reads (it resolves dotted fields like `resource.status` by\n * walking nested objects). The actor lands as `subject.id`; the four attribute\n * bags nest under `subject` / `resource` / `action` / `env`; a `resource`\n * reference adds `resource.type` / `resource.id`. The actor id and the resource\n * reference win over any same-named keys in the attribute bags.\n *\n * Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,\n * or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so\n * rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.\n */\nexport function abacContext(request: AbacRequest): PolicyContext {\n    const attributes = request.attributes;\n\n    const subject: Record<string, unknown> = {\n        ...attributes.subject,\n        id: request.actor.raw,\n    };\n\n    const resource: Record<string, unknown> = { ...attributes.resource };\n    if (request.resource) {\n        resource.type = request.resource.type;\n        if (request.resource.id !== undefined) {\n            resource.id = request.resource.id;\n        }\n    }\n\n    return {\n        subject,\n        resource,\n        action: { ...attributes.action },\n        env: { ...attributes.environment },\n    };\n}\n","import type { AbacRule, RuleEffect } from \"./domain/rule.js\";\n\n/**\n * How an {@link AbacPolicySet} resolves several applicable rules into one effect.\n *\n * - `deny-overrides` (default, secure): any applicable DENY wins; otherwise the\n *   first PERMIT; otherwise the set's default effect.\n * - `permit-overrides`: any applicable PERMIT wins; otherwise the first DENY;\n *   otherwise the default effect.\n * - `first-applicable`: the effect of the first rule that matches; otherwise the\n *   default effect.\n */\nexport type CombiningAlgorithm =\n    | \"deny-overrides\"\n    | \"permit-overrides\"\n    | \"first-applicable\";\n\n/** The resolved decision plus the rule (if any) that produced it. */\nexport interface CombineResult {\n    readonly effect: RuleEffect;\n    readonly decidingRule?: AbacRule;\n}\n\nfunction firstWithEffect(\n    rules: readonly AbacRule[],\n    effect: RuleEffect,\n): AbacRule | undefined {\n    return rules.find((rule) => rule.effect === effect);\n}\n\n/**\n * Applies `algorithm` to the already-matched `applicable` rules, falling back to\n * `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and\n * total; the returned `decidingRule` is absent exactly when `defaultEffect` was\n * used.\n */\nexport function combine(\n    algorithm: CombiningAlgorithm,\n    applicable: readonly AbacRule[],\n    defaultEffect: RuleEffect,\n): CombineResult {\n    switch (algorithm) {\n        case \"deny-overrides\": {\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            return { effect: defaultEffect };\n        }\n        case \"permit-overrides\": {\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            return { effect: defaultEffect };\n        }\n        case \"first-applicable\": {\n            const first = applicable[0];\n            if (first) return { effect: first.effect, decidingRule: first };\n            return { effect: defaultEffect };\n        }\n    }\n}\n","import { type CoreConfig, coreConfig } from \"../config/index.js\";\nimport { AuthorizationError } from \"../errors/authorization-error.js\";\nimport { ConditionEvaluatorV1 } from \"../policies/engines/v1/condition-evaluator.js\";\nimport { Result } from \"../result/result.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\nimport { abacContext } from \"./attributes.js\";\nimport { combine, type CombiningAlgorithm } from \"./combining.js\";\nimport type { AbacPolicySet } from \"./domain/policy-set.js\";\nimport type { AbacRule, RuleEffect } from \"./domain/rule.js\";\n\n// ABAC reuses the gate engine's v1 condition matcher; the version stamps the\n// evaluation reports the shared reporter emits.\nconst ENGINE_VERSION = 1;\n\n/** The successful decision returned by {@link AbacAuthorizer.authorize}. */\ninterface AbacDecision {\n    /** The audited business action that was allowed. */\n    readonly action: string;\n    readonly effect: \"PERMIT\";\n    /** The id of the rule that permitted, or `\"<default>\"` when the set's default did. */\n    readonly matchedRule: string;\n    readonly algorithm: CombiningAlgorithm;\n    /** When the decision was made, ISO-8601. */\n    readonly grantedAtIso: string;\n}\n\n/**\n * The pure ABAC decisor. Given an {@link AbacRequest} and an\n * {@link AbacPolicySet}, it flattens the request's attributes into a context,\n * matches each rule's condition with the gate engine's pure condition evaluator\n * (reused, not reimplemented), resolves the effects through the set's combining\n * algorithm, and returns a {@link Result} — never throwing, mirroring the\n * \"errors as values\" contract of `RbacAuthorizer`/`GateEngineV1`.\n *\n * A denial maps to {@link AuthorizationError.policyDenied}, attributed to the\n * deciding rule's `id`/`version`. A condition-evaluation failure (a missing\n * attribute, a wrong-typed operand) fails closed as\n * {@link AuthorizationError.forbidden} — also attributed to the culprit rule's\n * `id`/`version` — unless the set opts into `onEvaluationError: \"skip-rule\"`, in\n * which case the unevaluable rule is skipped and the rest decide. Every resolved\n * decision (PERMIT and DENY) is emitted best-effort through the configured\n * reporter as an `abac-decision` event (silent by default). Timestamps come from\n * an injectable `clock` (default `() => new Date()`), so the decisor is pure\n * given one. Loading the dynamic attributes is the consumer's job (behind an\n * `AbacAuthorizerPort` adapter); this class only decides.\n */\nclass AbacAuthorizer {\n    private readonly coreConfig: CoreConfig;\n    private readonly clock: () => Date;\n\n    constructor(\n        params: {\n            readonly coreConfig?: CoreConfig;\n            /** Injectable clock for deterministic timestamps; defaults to `() => new Date()`. */\n            readonly clock?: () => Date;\n        } = {},\n    ) {\n        this.coreConfig = params.coreConfig ?? coreConfig;\n        this.clock = params.clock ?? (() => new Date());\n    }\n\n    authorize(\n        request: AbacRequest,\n        policies: AbacPolicySet,\n    ): Result<AbacDecision, AuthorizationError> {\n        const context = abacContext(request);\n        const evaluator = new ConditionEvaluatorV1(\n            context,\n            this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION),\n        );\n\n        const applicable: AbacRule[] = [];\n        for (const rule of policies.rules) {\n            const matched = evaluator.evaluate(rule.condition);\n            if (matched.isErr()) {\n                if (policies.onEvaluationError === \"skip-rule\") {\n                    // Escape valve for evolving rules: drop the unevaluable rule\n                    // (the evaluator already reported the anomaly) and let the\n                    // rest decide, instead of failing the whole set closed.\n                    continue;\n                }\n                // Fail closed: a technical evaluation error is never a silent\n                // PERMIT. Attribute the deny to the culprit rule so the 403 is\n                // triageable without turning on the reporter.\n                return Result.err(\n                    AuthorizationError.forbidden({\n                        action: request.action,\n                        resource: request.resource,\n                        actor: { actorId: request.actor.raw },\n                        policyId: rule.id,\n                        policyVersion: rule.version,\n                        details: matched.errorOrNull() ?? undefined,\n                    }),\n                );\n            }\n            if (matched.getOrThrow()) {\n                applicable.push(rule);\n            }\n        }\n\n        const { effect, decidingRule } = combine(\n            policies.algorithm,\n            applicable,\n            policies.defaultEffect,\n        );\n\n        this.reportDecision(request, policies, effect, decidingRule);\n\n        if (effect === \"PERMIT\") {\n            return Result.ok({\n                action: request.action,\n                effect: \"PERMIT\",\n                matchedRule: decidingRule?.id ?? \"<default>\",\n                algorithm: policies.algorithm,\n                grantedAtIso: this.clock().toISOString(),\n            });\n        }\n\n        return Result.err(\n            AuthorizationError.policyDenied({\n                policyId: decidingRule?.id ?? \"<default-deny>\",\n                policyVersion: decidingRule?.version ?? 0,\n                evaluatedAtIso: this.clock().toISOString(),\n                action: request.action,\n                resource: request.resource,\n                actor: { actorId: request.actor.raw },\n                reasonCode: decidingRule?.id,\n            }),\n        );\n    }\n\n    // Best-effort audit trail: emits the resolved decision (PERMIT and DENY)\n    // through the configured reporter, silent by default.\n    private reportDecision(\n        request: AbacRequest,\n        policies: AbacPolicySet,\n        effect: RuleEffect,\n        decidingRule: AbacRule | undefined,\n    ): void {\n        this.coreConfig.reportSafely({\n            kind: \"abac-decision\",\n            level: \"info\",\n            action: request.action,\n            resource: request.resource,\n            actorId: request.actor.raw,\n            effect,\n            decidingRuleId:\n                decidingRule?.id ??\n                (effect === \"PERMIT\" ? \"<default>\" : \"<default-deny>\"),\n            decidingRuleVersion: decidingRule?.version,\n            algorithm: policies.algorithm,\n            occurredAt: this.clock(),\n        });\n    }\n}\n\nexport { AbacAuthorizer, type AbacDecision };\n","import { Result } from \"../result/result.js\";\nimport type { AbacAuthorizerPort } from \"../application/ports/abac-authorizer.port.js\";\nimport type { AuthorizerPort } from \"../application/ports/authorizer.port.js\";\nimport type { AuthorizationError } from \"../errors/authorization-error.js\";\nimport type { AccessRequest } from \"../rbac/access-request.js\";\n\nimport type { AbacAttributes } from \"./abac-request.js\";\n\n/**\n * The request a {@link CompositeAuthorizer} accepts — one object that satisfies\n * both the RBAC {@link AccessRequest} (its `required`/`scope`) and the ABAC\n * request (its `attributes`).\n */\ntype CompositeAccessRequest = AccessRequest & {\n    readonly attributes: AbacAttributes;\n};\n\n/**\n * Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid\n * \"does the actor hold the capability, *and* do the attributes allow it here?\"\n * flow. Short-circuits with the RBAC denial when the actor is not even capable,\n * so the boundary sees the most specific 403.\n *\n * Only the two port interfaces are referenced (both erased at runtime), so this\n * pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the\n * consumer wires up.\n */\nclass CompositeAuthorizer {\n    constructor(\n        private readonly rbac: AuthorizerPort,\n        private readonly abac: AbacAuthorizerPort,\n    ) {}\n\n    async authorize(\n        request: CompositeAccessRequest,\n    ): Promise<Result<void, AuthorizationError>> {\n        const coarse = await this.rbac.authorize(request);\n        if (coarse.isErr()) {\n            return coarse;\n        }\n        return this.abac.authorize(request);\n    }\n}\n\nexport { CompositeAuthorizer, type CompositeAccessRequest };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport type { CombiningAlgorithm } from \"../combining.js\";\n\nimport type { AbacRule, RuleEffect } from \"./rule.js\";\n\n/**\n * How the {@link AbacAuthorizer} reacts when a rule's condition cannot be\n * evaluated (a referenced attribute is absent, an operand is wrong-typed).\n *\n * - `fail-closed` (default, secure): the whole decision fails closed as\n *   `forbidden`. Safe, but it means adding a rule that reads an attribute a call\n *   site does not populate makes that call site deny everything until it does.\n * - `skip-rule`: the unevaluable rule is dropped from the applicable set and the\n *   remaining rules decide — the escape valve for evolving rules without\n *   trailing every call site. The evaluator still reports the anomaly.\n */\nexport type OnEvaluationError = \"fail-closed\" | \"skip-rule\";\n\nconst POLICY_SET_FIELD = ValidationField.of(\"abacPolicySet\");\n\n/**\n * An ordered collection of {@link AbacRule}s plus how to combine them\n * ({@link CombiningAlgorithm}), what to decide when no rule applies\n * ({@link defaultEffect}), and how to react to an unevaluable rule\n * ({@link onEvaluationError}). This is where ABAC goes beyond a single gate\n * condition: several PERMIT/DENY rules resolved by an explicit algorithm.\n *\n * Closed by default — the combining algorithm defaults to `\"deny-overrides\"`,\n * the default effect to `\"DENY\"`, and evaluation errors to `\"fail-closed\"`, so a\n * request matching nothing (or hitting a technical error) is denied. A plain\n * holder (not a value object); build through {@link of}.\n */\nclass AbacPolicySet {\n    private constructor(\n        private readonly _rules: readonly AbacRule[],\n        private readonly _algorithm: CombiningAlgorithm,\n        private readonly _defaultEffect: RuleEffect,\n        private readonly _onEvaluationError: OnEvaluationError,\n    ) {\n        Object.freeze(this._rules);\n        Object.freeze(this);\n    }\n\n    /**\n     * Builds a policy set. Rejects duplicate rule ids with\n     * {@link InvalidValueException} so a denial's `policyId` attribution is\n     * unambiguous.\n     */\n    static of(\n        rules: readonly AbacRule[],\n        options: {\n            readonly algorithm?: CombiningAlgorithm;\n            readonly defaultEffect?: RuleEffect;\n            readonly onEvaluationError?: OnEvaluationError;\n        } = {},\n    ): AbacPolicySet {\n        AbacPolicySet.assertUniqueIds(rules);\n        return new AbacPolicySet(\n            [...rules],\n            options.algorithm ?? \"deny-overrides\",\n            options.defaultEffect ?? \"DENY\",\n            options.onEvaluationError ?? \"fail-closed\",\n        );\n    }\n\n    private static assertUniqueIds(rules: readonly AbacRule[]): void {\n        const seen = new Set<string>();\n        for (const rule of rules) {\n            if (seen.has(rule.id)) {\n                throw new InvalidValueException(\n                    POLICY_SET_FIELD.nested(\"rules\"),\n                    ValidationCode.ALREADY_EXISTS,\n                    `abac policy set has duplicate rule id \"${rule.id}\"; ids must be unique for unambiguous audit attribution`,\n                );\n            }\n            seen.add(rule.id);\n        }\n    }\n\n    get rules(): readonly AbacRule[] {\n        return this._rules;\n    }\n\n    get algorithm(): CombiningAlgorithm {\n        return this._algorithm;\n    }\n\n    get defaultEffect(): RuleEffect {\n        return this._defaultEffect;\n    }\n\n    get onEvaluationError(): OnEvaluationError {\n        return this._onEvaluationError;\n    }\n}\n\nexport { AbacPolicySet };\n","// ─── Shared v1 condition DSL types ──────────────────────────────────────────\n// These types belong to the v1 engine family: both gate/v1 and compute/v1\n// share the same condition-tree DSL. Keeping them here avoids making compute/v1\n// structurally dependent on gate/v1.\n\n// Single source of truth for the operator vocabulary: the union is derived from\n// this array so a new operator is added in exactly one place, and consumers that\n// need the runtime list (e.g. AbacRule's structural check) reuse it instead of\n// hand-maintaining a parallel set that can drift out of sync.\nexport const CONDITION_OPS = [\n    \"eq\",\n    \"neq\",\n    \"gt\",\n    \"gte\",\n    \"lt\",\n    \"lte\",\n    \"in\",\n    \"notIn\",\n    \"isNull\",\n    \"isNotNull\",\n] as const;\n\nexport type ConditionOp = (typeof CONDITION_OPS)[number];\n\nexport interface ConditionLeafNode {\n    readonly field: string;\n    readonly op: ConditionOp;\n    readonly value: unknown;\n    readonly allowNull?: true;\n}\n\nexport interface ConditionAndNode {\n    readonly and: readonly ConditionNode[];\n}\n\nexport interface ConditionOrNode {\n    readonly or: readonly ConditionNode[];\n}\n\nexport interface ConditionNotNode {\n    readonly not: ConditionNode;\n}\n\nexport type ConditionNode =\n    | ConditionLeafNode\n    | ConditionAndNode\n    | ConditionOrNode\n    | ConditionNotNode;\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\nimport {\n    CONDITION_OPS,\n    type ConditionNode,\n    type ConditionOp,\n} from \"../../policies/engines/v1/condition-types.js\";\n\n/** Whether a matching {@link AbacRule} permits or denies the action. */\ntype RuleEffect = \"PERMIT\" | \"DENY\";\n\n/**\n * The serializable shape of a rule: a stable `id`/`version` (surfaced on a\n * denial as `policyId`/`policyVersion`), the {@link RuleEffect}, and the\n * {@link ConditionNode} that decides whether the rule applies to a request's\n * flattened attributes.\n */\ntype AbacRuleProps = {\n    readonly id: string;\n    readonly version: number;\n    readonly effect: RuleEffect;\n    readonly condition: ConditionNode;\n    readonly description?: string;\n};\n\nconst RULE_FIELD = ValidationField.of(\"abacRule\");\n\n// Derived from the evaluator's own operator list (single source of truth) so a\n// new operator becomes usable in ABAC rules without a parallel edit here.\nconst SUPPORTED_OPS = new Set<ConditionOp>(CONDITION_OPS);\n\nconst RULE_EFFECTS = new Set<RuleEffect>([\"PERMIT\", \"DENY\"]);\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * A single attribute-based rule: an {@link RuleEffect} that takes hold when its\n * {@link ConditionNode} matches the request's flattened attributes. The\n * condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves\n * combined with `and`/`or`/`not`), so a consumer learns one condition language\n * across the whole kit.\n *\n * A zod-free value object: it validates its own shape on construction (throwing\n * {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are\n * authored in TypeScript — trusted data, not untrusted JSON — the structural\n * check is a hand-rolled walk of the condition tree rather than a schema parse.\n * Build one through {@link of}; the constructor is private.\n *\n * **Attribute semantics a rule author must know (the condition is evaluated by\n * the shared gate/compute engine, whose runtime rules apply here too):**\n * - **A referenced attribute that is *absent* from the request is a technical\n *   evaluation error, not a non-match.** By default (`onEvaluationError:\n *   \"fail-closed\"` on the {@link AbacPolicySet}) that error fails the *entire*\n *   decision closed — so adding a rule that reads an attribute a given call site\n *   does not yet populate makes that call site start returning `forbidden`,\n *   *even for requests the older rules used to permit*. Choose\n *   `onEvaluationError: \"skip-rule\"` on the set to skip an unevaluable rule\n *   instead of failing the whole set.\n * - **`isNull` / `isNotNull` test for an explicit `null`/`undefined` *value*, not\n *   for a missing key.** A key that is absent from the bag never reaches the\n *   operator — it short-circuits to the missing-attribute error above. To match\n *   \"no deletedAt\", the consumer must put `deletedAt: null` in the bag, not omit\n *   it. Pass `allowNull: true` on a relational leaf to treat a present `null` as\n *   a non-match instead of an error.\n * - **Date comparison operands must be strict ISO-8601 UTC**\n *   (`YYYY-MM-DDTHH:mm:ss.sssZ`); a bare `\"2026-07-09\"` or an offset like\n *   `+00:00` is rejected as an invalid operand and fails closed.\n */\nclass AbacRule extends ValueObject<AbacRuleProps, AbacRuleProps> {\n    private constructor(props: AbacRuleProps) {\n        super(props);\n        this.finalize();\n    }\n\n    /**\n     * Builds a rule, validating that `id` is non-blank, `version` is an integer\n     * ≥ 1, `effect` is `\"PERMIT\"`/`\"DENY\"`, and `condition` is a well-formed\n     * condition node. Throws {@link InvalidValueException} otherwise.\n     */\n    static of(props: AbacRuleProps): AbacRule {\n        if (typeof props.id !== \"string\" || props.id.trim().length === 0) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"id\"),\n                ValidationCode.BLANK,\n                `abac rule id must be a non-empty string, got \"${props.id}\"`,\n            );\n        }\n\n        if (!Number.isInteger(props.version) || props.version < 1) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"version\"),\n                ValidationCode.OUT_OF_RANGE,\n                `abac rule version must be an integer >= 1, got \"${props.version}\"`,\n            );\n        }\n\n        if (!RULE_EFFECTS.has(props.effect)) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"effect\"),\n                ValidationCode.INVALID_FORMAT,\n                `abac rule effect must be \"PERMIT\" or \"DENY\", got \"${String(props.effect)}\"`,\n            );\n        }\n\n        AbacRule.assertConditionShape(props.condition);\n\n        return new AbacRule(props);\n    }\n\n    // Mirrors what the shared condition evaluator would reject at eval time\n    // (empty and/or nodes, malformed leaves) but fails fast at construction.\n    private static assertConditionShape(node: unknown): void {\n        if (!isPlainObject(node)) {\n            AbacRule.rejectCondition(\n                \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n            );\n        }\n\n        if (\"and\" in node || \"or\" in node) {\n            const key = \"and\" in node ? \"and\" : \"or\";\n            const children = node[key];\n            if (!Array.isArray(children) || children.length === 0) {\n                AbacRule.rejectCondition(\n                    `abac rule \"${key}\" node must hold a non-empty array of child conditions`,\n                );\n            }\n            for (const child of children) {\n                AbacRule.assertConditionShape(child);\n            }\n            return;\n        }\n\n        if (\"not\" in node) {\n            AbacRule.assertConditionShape(node.not);\n            return;\n        }\n\n        if (\"field\" in node && \"op\" in node) {\n            if (\n                typeof node.field !== \"string\" ||\n                node.field.trim().length === 0\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"field\" must be a non-empty string, got \"${String(node.field)}\"`,\n                );\n            }\n            if (\n                typeof node.op !== \"string\" ||\n                !SUPPORTED_OPS.has(node.op as ConditionOp)\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"op\" is not a supported operator, got \"${String(node.op)}\"`,\n                );\n            }\n            return;\n        }\n\n        AbacRule.rejectCondition(\n            \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n        );\n    }\n\n    private static rejectCondition(message: string): never {\n        throw new InvalidValueException(\n            RULE_FIELD.nested(\"condition\"),\n            ValidationCode.INVALID_FORMAT,\n            message,\n        );\n    }\n\n    get id(): string {\n        return this.value.id;\n    }\n\n    get version(): number {\n        return this.value.version;\n    }\n\n    get effect(): RuleEffect {\n        return this.value.effect;\n    }\n\n    /** The condition tree evaluated against a request's flattened attributes. */\n    get condition(): ConditionNode {\n        return this.value.condition as ConditionNode;\n    }\n\n    get description(): string | undefined {\n        return this.value.description;\n    }\n\n    toPrimitive(): AbacRuleProps {\n        return {\n            id: this.value.id,\n            version: this.value.version,\n            effect: this.value.effect,\n            condition: this.value.condition as ConditionNode,\n            ...(this.value.description !== undefined\n                ? { description: this.value.description }\n                : {}),\n        };\n    }\n}\n\nexport { AbacRule, type AbacRuleProps, type RuleEffect };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,YAAY,SAAqC;CAC7D,MAAM,aAAa,QAAQ;CAE3B,MAAM,UAAmC;EACrC,GAAG,WAAW;EACd,IAAI,QAAQ,MAAM;CACtB;CAEA,MAAM,WAAoC,EAAE,GAAG,WAAW,SAAS;CACnE,IAAI,QAAQ,UAAU;EAClB,SAAS,OAAO,QAAQ,SAAS;EACjC,IAAI,QAAQ,SAAS,OAAO,KAAA,GACxB,SAAS,KAAK,QAAQ,SAAS;CAEvC;CAEA,OAAO;EACH;EACA;EACA,QAAQ,EAAE,GAAG,WAAW,OAAO;EAC/B,KAAK,EAAE,GAAG,WAAW,YAAY;CACrC;AACJ;;;ACfA,SAAS,gBACL,OACA,QACoB;CACpB,OAAO,MAAM,MAAM,SAAS,KAAK,WAAW,MAAM;AACtD;;;;;;;AAQA,SAAgB,QACZ,WACA,YACA,eACa;CACb,QAAQ,WAAR;EACI,KAAK,kBAAkB;GACnB,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,QAAQ,WAAW;GACzB,IAAI,OAAO,OAAO;IAAE,QAAQ,MAAM;IAAQ,cAAc;GAAM;GAC9D,OAAO,EAAE,QAAQ,cAAc;EACnC;CACJ;AACJ;;;ACjDA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;AAkCvB,IAAM,iBAAN,MAAqB;CAIjB,YACI,SAII,CAAC,GACP;EACE,KAAK,aAAa,OAAO,cAAcA,4BAAAA;EACvC,KAAK,QAAQ,OAAO,gCAAgB,IAAI,KAAK;CACjD;CAEA,UACI,SACA,UACwC;EAExC,MAAM,YAAY,IAAIC,4BAAAA,qBADN,YAAY,OAElB,GACN,KAAK,WAAW,8BAA8B,cAAc,CAChE;EAEA,MAAM,aAAyB,CAAC;EAChC,KAAK,MAAM,QAAQ,SAAS,OAAO;GAC/B,MAAM,UAAU,UAAU,SAAS,KAAK,SAAS;GACjD,IAAI,QAAQ,MAAM,GAAG;IACjB,IAAI,SAAS,sBAAsB,aAI/B;IAKJ,OAAOC,eAAAA,OAAO,IACVC,4BAAAA,mBAAmB,UAAU;KACzB,QAAQ,QAAQ;KAChB,UAAU,QAAQ;KAClB,OAAO,EAAE,SAAS,QAAQ,MAAM,IAAI;KACpC,UAAU,KAAK;KACf,eAAe,KAAK;KACpB,SAAS,QAAQ,YAAY,KAAK,KAAA;IACtC,CAAC,CACL;GACJ;GACA,IAAI,QAAQ,WAAW,GACnB,WAAW,KAAK,IAAI;EAE5B;EAEA,MAAM,EAAE,QAAQ,iBAAiB,QAC7B,SAAS,WACT,YACA,SAAS,aACb;EAEA,KAAK,eAAe,SAAS,UAAU,QAAQ,YAAY;EAE3D,IAAI,WAAW,UACX,OAAOD,eAAAA,OAAO,GAAG;GACb,QAAQ,QAAQ;GAChB,QAAQ;GACR,aAAa,cAAc,MAAM;GACjC,WAAW,SAAS;GACpB,cAAc,KAAK,MAAM,EAAE,YAAY;EAC3C,CAAC;EAGL,OAAOA,eAAAA,OAAO,IACVC,4BAAAA,mBAAmB,aAAa;GAC5B,UAAU,cAAc,MAAM;GAC9B,eAAe,cAAc,WAAW;GACxC,gBAAgB,KAAK,MAAM,EAAE,YAAY;GACzC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,OAAO,EAAE,SAAS,QAAQ,MAAM,IAAI;GACpC,YAAY,cAAc;EAC9B,CAAC,CACL;CACJ;CAIA,eACI,SACA,UACA,QACA,cACI;EACJ,KAAK,WAAW,aAAa;GACzB,MAAM;GACN,OAAO;GACP,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,SAAS,QAAQ,MAAM;GACvB;GACA,gBACI,cAAc,OACb,WAAW,WAAW,cAAc;GACzC,qBAAqB,cAAc;GACnC,WAAW,SAAS;GACpB,YAAY,KAAK,MAAM;EAC3B,CAAC;CACL;AACJ;;;;;;;;;;;;;AChIA,IAAM,sBAAN,MAA0B;CACtB,YACI,MACA,MACF;EAFmB,KAAA,OAAA;EACA,KAAA,OAAA;CAClB;CAEH,MAAM,UACF,SACyC;EACzC,MAAM,SAAS,MAAM,KAAK,KAAK,UAAU,OAAO;EAChD,IAAI,OAAO,MAAM,GACb,OAAO;EAEX,OAAO,KAAK,KAAK,UAAU,OAAO;CACtC;AACJ;;;ACtBA,MAAM,mBAAmBC,yBAAAA,gBAAgB,GAAG,eAAe;;;;;;;;;;;;;AAc3D,IAAM,gBAAN,MAAM,cAAc;CAChB,YACI,QACA,YACA,gBACA,oBACF;EAJmB,KAAA,SAAA;EACA,KAAA,aAAA;EACA,KAAA,iBAAA;EACA,KAAA,qBAAA;EAEjB,OAAO,OAAO,KAAK,MAAM;EACzB,OAAO,OAAO,IAAI;CACtB;;;;;;CAOA,OAAO,GACH,OACA,UAII,CAAC,GACQ;EACb,cAAc,gBAAgB,KAAK;EACnC,OAAO,IAAI,cACP,CAAC,GAAG,KAAK,GACT,QAAQ,aAAa,kBACrB,QAAQ,iBAAiB,QACzB,QAAQ,qBAAqB,aACjC;CACJ;CAEA,OAAe,gBAAgB,OAAkC;EAC7D,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,QAAQ,OAAO;GACtB,IAAI,KAAK,IAAI,KAAK,EAAE,GAChB,MAAM,IAAIC,6BAAAA,sBACN,iBAAiB,OAAO,OAAO,GAC/BC,wBAAAA,eAAe,gBACf,0CAA0C,KAAK,GAAG,wDACtD;GAEJ,KAAK,IAAI,KAAK,EAAE;EACpB;CACJ;CAEA,IAAI,QAA6B;EAC7B,OAAO,KAAK;CAChB;CAEA,IAAI,YAAgC;EAChC,OAAO,KAAK;CAChB;CAEA,IAAI,gBAA4B;EAC5B,OAAO,KAAK;CAChB;CAEA,IAAI,oBAAuC;EACvC,OAAO,KAAK;CAChB;AACJ;;;ACvFA,MAAa,gBAAgB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;ACOA,MAAM,aAAaC,yBAAAA,gBAAgB,GAAG,UAAU;AAIhD,MAAM,gBAAgB,IAAI,IAAiB,aAAa;AAExD,MAAM,eAAe,IAAI,IAAgB,CAAC,UAAU,MAAM,CAAC;AAE3D,SAAS,cAAc,OAAkD;CACrE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAM,WAAN,MAAM,iBAAiBC,qBAAAA,YAA0C;CAC7D,YAAoB,OAAsB;EACtC,MAAM,KAAK;EACX,KAAK,SAAS;CAClB;;;;;;CAOA,OAAO,GAAG,OAAgC;EACtC,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,KAAK,EAAE,WAAW,GAC3D,MAAM,IAAIC,6BAAAA,sBACN,WAAW,OAAO,IAAI,GACtBC,wBAAAA,eAAe,OACf,iDAAiD,MAAM,GAAG,EAC9D;EAGJ,IAAI,CAAC,OAAO,UAAU,MAAM,OAAO,KAAK,MAAM,UAAU,GACpD,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,SAAS,GAC3BC,wBAAAA,eAAe,cACf,mDAAmD,MAAM,QAAQ,EACrE;EAGJ,IAAI,CAAC,aAAa,IAAI,MAAM,MAAM,GAC9B,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,QAAQ,GAC1BC,wBAAAA,eAAe,gBACf,qDAAqD,OAAO,MAAM,MAAM,EAAE,EAC9E;EAGJ,SAAS,qBAAqB,MAAM,SAAS;EAE7C,OAAO,IAAI,SAAS,KAAK;CAC7B;CAIA,OAAe,qBAAqB,MAAqB;EACrD,IAAI,CAAC,cAAc,IAAI,GACnB,SAAS,gBACL,gFACJ;EAGJ,IAAI,SAAS,QAAQ,QAAQ,MAAM;GAC/B,MAAM,MAAM,SAAS,OAAO,QAAQ;GACpC,MAAM,WAAW,KAAK;GACtB,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,GAChD,SAAS,gBACL,cAAc,IAAI,uDACtB;GAEJ,KAAK,MAAM,SAAS,UAChB,SAAS,qBAAqB,KAAK;GAEvC;EACJ;EAEA,IAAI,SAAS,MAAM;GACf,SAAS,qBAAqB,KAAK,GAAG;GACtC;EACJ;EAEA,IAAI,WAAW,QAAQ,QAAQ,MAAM;GACjC,IACI,OAAO,KAAK,UAAU,YACtB,KAAK,MAAM,KAAK,EAAE,WAAW,GAE7B,SAAS,gBACL,qEAAqE,OAAO,KAAK,KAAK,EAAE,EAC5F;GAEJ,IACI,OAAO,KAAK,OAAO,YACnB,CAAC,cAAc,IAAI,KAAK,EAAiB,GAEzC,SAAS,gBACL,mEAAmE,OAAO,KAAK,EAAE,EAAE,EACvF;GAEJ;EACJ;EAEA,SAAS,gBACL,gFACJ;CACJ;CAEA,OAAe,gBAAgB,SAAwB;EACnD,MAAM,IAAID,6BAAAA,sBACN,WAAW,OAAO,WAAW,GAC7BC,wBAAAA,eAAe,gBACf,OACJ;CACJ;CAEA,IAAI,KAAa;EACb,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,UAAkB;EAClB,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,SAAqB;EACrB,OAAO,KAAK,MAAM;CACtB;;CAGA,IAAI,YAA2B;EAC3B,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,cAAkC;EAClC,OAAO,KAAK,MAAM;CACtB;CAEA,cAA6B;EACzB,OAAO;GACH,IAAI,KAAK,MAAM;GACf,SAAS,KAAK,MAAM;GACpB,QAAQ,KAAK,MAAM;GACnB,WAAW,KAAK,MAAM;GACtB,GAAI,KAAK,MAAM,gBAAgB,KAAA,IACzB,EAAE,aAAa,KAAK,MAAM,YAAY,IACtC,CAAC;EACX;CACJ;AACJ"}

package/dist/rule.js

@@ -97,46 +97,73 @@ const ENGINE_VERSION = 1;
 * "errors as values" contract of `RbacAuthorizer`/`GateEngineV1`.
 *
 * A denial maps to {@link AuthorizationError.policyDenied}, attributed to the
-* deciding rule's `id`/`version`; a condition-evaluation failure (a missing
+* deciding rule's `id`/`version`. A condition-evaluation failure (a missing
 * attribute, a wrong-typed operand) fails closed as
-* {@link AuthorizationError.forbidden}. Loading the dynamic attributes is the
-* consumer's job (behind an `AbacAuthorizerPort` adapter); this class only decides.
+* {@link AuthorizationError.forbidden} — also attributed to the culprit rule's
+* `id`/`version` — unless the set opts into `onEvaluationError: "skip-rule"`, in
+* which case the unevaluable rule is skipped and the rest decide. Every resolved
+* decision (PERMIT and DENY) is emitted best-effort through the configured
+* reporter as an `abac-decision` event (silent by default). Timestamps come from
+* an injectable `clock` (default `() => new Date()`), so the decisor is pure
+* given one. Loading the dynamic attributes is the consumer's job (behind an
+* `AbacAuthorizerPort` adapter); this class only decides.
 */
 var AbacAuthorizer = class {
 	constructor(params = {}) {
 		this.coreConfig = params.coreConfig ?? coreConfig;
+		this.clock = params.clock ?? (() => /* @__PURE__ */ new Date());
 	}
 	authorize(request, policies) {
 		const evaluator = new ConditionEvaluatorV1(abacContext(request), this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION));
 		const applicable = [];
 		for (const rule of policies.rules) {
 			const matched = evaluator.evaluate(rule.condition);
-			if (matched.isErr()) return Result.err(AuthorizationError.forbidden({
-				action: request.action,
-				resource: request.resource,
-				actor: { userId: request.actor.raw },
-				details: matched.errorOrNull() ?? void 0
-			}));
+			if (matched.isErr()) {
+				if (policies.onEvaluationError === "skip-rule") continue;
+				return Result.err(AuthorizationError.forbidden({
+					action: request.action,
+					resource: request.resource,
+					actor: { actorId: request.actor.raw },
+					policyId: rule.id,
+					policyVersion: rule.version,
+					details: matched.errorOrNull() ?? void 0
+				}));
+			}
 			if (matched.getOrThrow()) applicable.push(rule);
 		}
 		const { effect, decidingRule } = combine(policies.algorithm, applicable, policies.defaultEffect);
+		this.reportDecision(request, policies, effect, decidingRule);
 		if (effect === "PERMIT") return Result.ok({
 			action: request.action,
 			effect: "PERMIT",
 			matchedRule: decidingRule?.id ?? "<default>",
 			algorithm: policies.algorithm,
-			grantedAtIso: (/* @__PURE__ */ new Date()).toISOString()
+			grantedAtIso: this.clock().toISOString()
 		});
 		return Result.err(AuthorizationError.policyDenied({
 			policyId: decidingRule?.id ?? "<default-deny>",
 			policyVersion: decidingRule?.version ?? 0,
-			evaluatedAtIso: (/* @__PURE__ */ new Date()).toISOString(),
+			evaluatedAtIso: this.clock().toISOString(),
 			action: request.action,
 			resource: request.resource,
-			actor: { userId: request.actor.raw },
+			actor: { actorId: request.actor.raw },
 			reasonCode: decidingRule?.id
 		}));
 	}
+	reportDecision(request, policies, effect, decidingRule) {
+		this.coreConfig.reportSafely({
+			kind: "abac-decision",
+			level: "info",
+			action: request.action,
+			resource: request.resource,
+			actorId: request.actor.raw,
+			effect,
+			decidingRuleId: decidingRule?.id ?? (effect === "PERMIT" ? "<default>" : "<default-deny>"),
+			decidingRuleVersion: decidingRule?.version,
+			algorithm: policies.algorithm,
+			occurredAt: this.clock()
+		});
+	}
 };
 //#endregion
 //#region src/core/abac/composite-authorizer.ts
@@ -163,26 +190,43 @@ var CompositeAuthorizer = class {
 };
 //#endregion
 //#region src/core/abac/domain/policy-set.ts
+const POLICY_SET_FIELD = ValidationField.of("abacPolicySet");
 /**
 * An ordered collection of {@link AbacRule}s plus how to combine them
-* ({@link CombiningAlgorithm}) and what to decide when no rule applies
-* ({@link defaultEffect}). This is where ABAC goes beyond a single gate
+* ({@link CombiningAlgorithm}), what to decide when no rule applies
+* ({@link defaultEffect}), and how to react to an unevaluable rule
+* ({@link onEvaluationError}). This is where ABAC goes beyond a single gate
 * condition: several PERMIT/DENY rules resolved by an explicit algorithm.
 *
-* Closed by default — the combining algorithm defaults to `"deny-overrides"` and
-* the default effect to `"DENY"`, so a request matching nothing is denied. A
-* plain holder (not a value object); build through {@link of}.
+* Closed by default — the combining algorithm defaults to `"deny-overrides"`,
+* the default effect to `"DENY"`, and evaluation errors to `"fail-closed"`, so a
+* request matching nothing (or hitting a technical error) is denied. A plain
+* holder (not a value object); build through {@link of}.
 */
 var AbacPolicySet = class AbacPolicySet {
-	constructor(_rules, _algorithm, _defaultEffect) {
+	constructor(_rules, _algorithm, _defaultEffect, _onEvaluationError) {
 		this._rules = _rules;
 		this._algorithm = _algorithm;
 		this._defaultEffect = _defaultEffect;
+		this._onEvaluationError = _onEvaluationError;
 		Object.freeze(this._rules);
 		Object.freeze(this);
 	}
+	/**
+	* Builds a policy set. Rejects duplicate rule ids with
+	* {@link InvalidValueException} so a denial's `policyId` attribution is
+	* unambiguous.
+	*/
 	static of(rules, options = {}) {
-		return new AbacPolicySet([...rules], options.algorithm ?? "deny-overrides", options.defaultEffect ?? "DENY");
+		AbacPolicySet.assertUniqueIds(rules);
+		return new AbacPolicySet([...rules], options.algorithm ?? "deny-overrides", options.defaultEffect ?? "DENY", options.onEvaluationError ?? "fail-closed");
+	}
+	static assertUniqueIds(rules) {
+		const seen = /* @__PURE__ */ new Set();
+		for (const rule of rules) {
+			if (seen.has(rule.id)) throw new InvalidValueException(POLICY_SET_FIELD.nested("rules"), ValidationCode.ALREADY_EXISTS, `abac policy set has duplicate rule id "${rule.id}"; ids must be unique for unambiguous audit attribution`);
+			seen.add(rule.id);
+		}
 	}
 	get rules() {
 		return this._rules;
@@ -193,11 +237,13 @@ var AbacPolicySet = class AbacPolicySet {
 	get defaultEffect() {
 		return this._defaultEffect;
 	}
+	get onEvaluationError() {
+		return this._onEvaluationError;
+	}
 };
 //#endregion
-//#region src/core/abac/domain/rule.ts
-const RULE_FIELD = ValidationField.of("abacRule");
-const CONDITION_OPS = new Set([
+//#region src/core/policies/engines/v1/condition-types.ts
+const CONDITION_OPS = [
 	"eq",
 	"neq",
 	"gt",
@@ -208,7 +254,11 @@ const CONDITION_OPS = new Set([
 	"notIn",
 	"isNull",
 	"isNotNull"
-]);
+];
+//#endregion
+//#region src/core/abac/domain/rule.ts
+const RULE_FIELD = ValidationField.of("abacRule");
+const SUPPORTED_OPS = new Set(CONDITION_OPS);
 const RULE_EFFECTS = new Set(["PERMIT", "DENY"]);
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -225,6 +275,26 @@ function isPlainObject(value) {
 * authored in TypeScript — trusted data, not untrusted JSON — the structural
 * check is a hand-rolled walk of the condition tree rather than a schema parse.
 * Build one through {@link of}; the constructor is private.
+*
+* **Attribute semantics a rule author must know (the condition is evaluated by
+* the shared gate/compute engine, whose runtime rules apply here too):**
+* - **A referenced attribute that is *absent* from the request is a technical
+*   evaluation error, not a non-match.** By default (`onEvaluationError:
+*   "fail-closed"` on the {@link AbacPolicySet}) that error fails the *entire*
+*   decision closed — so adding a rule that reads an attribute a given call site
+*   does not yet populate makes that call site start returning `forbidden`,
+*   *even for requests the older rules used to permit*. Choose
+*   `onEvaluationError: "skip-rule"` on the set to skip an unevaluable rule
+*   instead of failing the whole set.
+* - **`isNull` / `isNotNull` test for an explicit `null`/`undefined` *value*, not
+*   for a missing key.** A key that is absent from the bag never reaches the
+*   operator — it short-circuits to the missing-attribute error above. To match
+*   "no deletedAt", the consumer must put `deletedAt: null` in the bag, not omit
+*   it. Pass `allowNull: true` on a relational leaf to treat a present `null` as
+*   a non-match instead of an error.
+* - **Date comparison operands must be strict ISO-8601 UTC**
+*   (`YYYY-MM-DDTHH:mm:ss.sssZ`); a bare `"2026-07-09"` or an offset like
+*   `+00:00` is rejected as an invalid operand and fails closed.
 */
 var AbacRule = class AbacRule extends ValueObject {
 	constructor(props) {
@@ -258,7 +328,7 @@ var AbacRule = class AbacRule extends ValueObject {
 		}
 		if ("field" in node && "op" in node) {
 			if (typeof node.field !== "string" || node.field.trim().length === 0) AbacRule.rejectCondition(`abac rule condition leaf "field" must be a non-empty string, got "${String(node.field)}"`);
-			if (typeof node.op !== "string" || !CONDITION_OPS.has(node.op)) AbacRule.rejectCondition(`abac rule condition leaf "op" is not a supported operator, got "${String(node.op)}"`);
+			if (typeof node.op !== "string" || !SUPPORTED_OPS.has(node.op)) AbacRule.rejectCondition(`abac rule condition leaf "op" is not a supported operator, got "${String(node.op)}"`);
 			return;
 		}
 		AbacRule.rejectCondition("abac rule condition must be a leaf { field, op } or an { and | or | not } node");

package/dist/rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule.js","names":[],"sources":["../src/core/abac/attributes.ts","../src/core/abac/combining.ts","../src/core/abac/authorizer.ts","../src/core/abac/composite-authorizer.ts","../src/core/abac/domain/policy-set.ts","../src/core/abac/domain/rule.ts"],"sourcesContent":["import type { PolicyContext } from \"../policies/engines/gate-types.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\n\n/**\n * Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the\n * condition evaluator reads (it resolves dotted fields like `resource.status` by\n * walking nested objects). The actor lands as `subject.id`; the four attribute\n * bags nest under `subject` / `resource` / `action` / `env`; a `resource`\n * reference adds `resource.type` / `resource.id`. The actor id and the resource\n * reference win over any same-named keys in the attribute bags.\n *\n * Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,\n * or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so\n * rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.\n */\nexport function abacContext(request: AbacRequest): PolicyContext {\n    const attributes = request.attributes;\n\n    const subject: Record<string, unknown> = {\n        ...attributes.subject,\n        id: request.actor.raw,\n    };\n\n    const resource: Record<string, unknown> = { ...attributes.resource };\n    if (request.resource) {\n        resource.type = request.resource.type;\n        if (request.resource.id !== undefined) {\n            resource.id = request.resource.id;\n        }\n    }\n\n    return {\n        subject,\n        resource,\n        action: { ...attributes.action },\n        env: { ...attributes.environment },\n    };\n}\n","import type { AbacRule, RuleEffect } from \"./domain/rule.js\";\n\n/**\n * How an {@link AbacPolicySet} resolves several applicable rules into one effect.\n *\n * - `deny-overrides` (default, secure): any applicable DENY wins; otherwise the\n *   first PERMIT; otherwise the set's default effect.\n * - `permit-overrides`: any applicable PERMIT wins; otherwise the first DENY;\n *   otherwise the default effect.\n * - `first-applicable`: the effect of the first rule that matches; otherwise the\n *   default effect.\n */\nexport type CombiningAlgorithm =\n    | \"deny-overrides\"\n    | \"permit-overrides\"\n    | \"first-applicable\";\n\n/** The resolved decision plus the rule (if any) that produced it. */\nexport interface CombineResult {\n    readonly effect: RuleEffect;\n    readonly decidingRule?: AbacRule;\n}\n\nfunction firstWithEffect(\n    rules: readonly AbacRule[],\n    effect: RuleEffect,\n): AbacRule | undefined {\n    return rules.find((rule) => rule.effect === effect);\n}\n\n/**\n * Applies `algorithm` to the already-matched `applicable` rules, falling back to\n * `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and\n * total; the returned `decidingRule` is absent exactly when `defaultEffect` was\n * used.\n */\nexport function combine(\n    algorithm: CombiningAlgorithm,\n    applicable: readonly AbacRule[],\n    defaultEffect: RuleEffect,\n): CombineResult {\n    switch (algorithm) {\n        case \"deny-overrides\": {\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            return { effect: defaultEffect };\n        }\n        case \"permit-overrides\": {\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            return { effect: defaultEffect };\n        }\n        case \"first-applicable\": {\n            const first = applicable[0];\n            if (first) return { effect: first.effect, decidingRule: first };\n            return { effect: defaultEffect };\n        }\n    }\n}\n","import { type CoreConfig, coreConfig } from \"../config/index.js\";\nimport { AuthorizationError } from \"../errors/authorization-error.js\";\nimport { ConditionEvaluatorV1 } from \"../policies/engines/v1/condition-evaluator.js\";\nimport { Result } from \"../result/result.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\nimport { abacContext } from \"./attributes.js\";\nimport { combine, type CombiningAlgorithm } from \"./combining.js\";\nimport type { AbacPolicySet } from \"./domain/policy-set.js\";\nimport type { AbacRule } from \"./domain/rule.js\";\n\n// ABAC reuses the gate engine's v1 condition matcher; the version stamps the\n// evaluation reports the shared reporter emits.\nconst ENGINE_VERSION = 1;\n\n/** The successful decision returned by {@link AbacAuthorizer.authorize}. */\ninterface AbacDecision {\n    /** The audited business action that was allowed. */\n    readonly action: string;\n    readonly effect: \"PERMIT\";\n    /** The id of the rule that permitted, or `\"<default>\"` when the set's default did. */\n    readonly matchedRule: string;\n    readonly algorithm: CombiningAlgorithm;\n    /** When the decision was made, ISO-8601. */\n    readonly grantedAtIso: string;\n}\n\n/**\n * The pure ABAC decisor. Given an {@link AbacRequest} and an\n * {@link AbacPolicySet}, it flattens the request's attributes into a context,\n * matches each rule's condition with the gate engine's pure condition evaluator\n * (reused, not reimplemented), resolves the effects through the set's combining\n * algorithm, and returns a {@link Result} — never throwing, mirroring the\n * \"errors as values\" contract of `RbacAuthorizer`/`GateEngineV1`.\n *\n * A denial maps to {@link AuthorizationError.policyDenied}, attributed to the\n * deciding rule's `id`/`version`; a condition-evaluation failure (a missing\n * attribute, a wrong-typed operand) fails closed as\n * {@link AuthorizationError.forbidden}. Loading the dynamic attributes is the\n * consumer's job (behind an `AbacAuthorizerPort` adapter); this class only decides.\n */\nclass AbacAuthorizer {\n    private readonly coreConfig: CoreConfig;\n\n    constructor(params: { readonly coreConfig?: CoreConfig } = {}) {\n        this.coreConfig = params.coreConfig ?? coreConfig;\n    }\n\n    authorize(\n        request: AbacRequest,\n        policies: AbacPolicySet,\n    ): Result<AbacDecision, AuthorizationError> {\n        const context = abacContext(request);\n        const evaluator = new ConditionEvaluatorV1(\n            context,\n            this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION),\n        );\n\n        const applicable: AbacRule[] = [];\n        for (const rule of policies.rules) {\n            const matched = evaluator.evaluate(rule.condition);\n            if (matched.isErr()) {\n                // Fail closed: a technical evaluation error is never a silent PERMIT.\n                return Result.err(\n                    AuthorizationError.forbidden({\n                        action: request.action,\n                        resource: request.resource,\n                        actor: { userId: request.actor.raw },\n                        details: matched.errorOrNull() ?? undefined,\n                    }),\n                );\n            }\n            if (matched.getOrThrow()) {\n                applicable.push(rule);\n            }\n        }\n\n        const { effect, decidingRule } = combine(\n            policies.algorithm,\n            applicable,\n            policies.defaultEffect,\n        );\n\n        if (effect === \"PERMIT\") {\n            return Result.ok({\n                action: request.action,\n                effect: \"PERMIT\",\n                matchedRule: decidingRule?.id ?? \"<default>\",\n                algorithm: policies.algorithm,\n                grantedAtIso: new Date().toISOString(),\n            });\n        }\n\n        return Result.err(\n            AuthorizationError.policyDenied({\n                policyId: decidingRule?.id ?? \"<default-deny>\",\n                policyVersion: decidingRule?.version ?? 0,\n                evaluatedAtIso: new Date().toISOString(),\n                action: request.action,\n                resource: request.resource,\n                actor: { userId: request.actor.raw },\n                reasonCode: decidingRule?.id,\n            }),\n        );\n    }\n}\n\nexport { AbacAuthorizer, type AbacDecision };\n","import { Result } from \"../result/result.js\";\nimport type { AbacAuthorizerPort } from \"../application/ports/abac-authorizer.port.js\";\nimport type { AuthorizerPort } from \"../application/ports/authorizer.port.js\";\nimport type { AuthorizationError } from \"../errors/authorization-error.js\";\nimport type { AccessRequest } from \"../rbac/access-request.js\";\n\nimport type { AbacAttributes } from \"./abac-request.js\";\n\n/**\n * The request a {@link CompositeAuthorizer} accepts — one object that satisfies\n * both the RBAC {@link AccessRequest} (its `required`/`scope`) and the ABAC\n * request (its `attributes`).\n */\ntype CompositeAccessRequest = AccessRequest & {\n    readonly attributes: AbacAttributes;\n};\n\n/**\n * Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid\n * \"does the actor hold the capability, *and* do the attributes allow it here?\"\n * flow. Short-circuits with the RBAC denial when the actor is not even capable,\n * so the boundary sees the most specific 403.\n *\n * Only the two port interfaces are referenced (both erased at runtime), so this\n * pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the\n * consumer wires up.\n */\nclass CompositeAuthorizer {\n    constructor(\n        private readonly rbac: AuthorizerPort,\n        private readonly abac: AbacAuthorizerPort,\n    ) {}\n\n    async authorize(\n        request: CompositeAccessRequest,\n    ): Promise<Result<void, AuthorizationError>> {\n        const coarse = await this.rbac.authorize(request);\n        if (coarse.isErr()) {\n            return coarse;\n        }\n        return this.abac.authorize(request);\n    }\n}\n\nexport { CompositeAuthorizer, type CompositeAccessRequest };\n","import type { CombiningAlgorithm } from \"../combining.js\";\n\nimport type { AbacRule, RuleEffect } from \"./rule.js\";\n\n/**\n * An ordered collection of {@link AbacRule}s plus how to combine them\n * ({@link CombiningAlgorithm}) and what to decide when no rule applies\n * ({@link defaultEffect}). This is where ABAC goes beyond a single gate\n * condition: several PERMIT/DENY rules resolved by an explicit algorithm.\n *\n * Closed by default — the combining algorithm defaults to `\"deny-overrides\"` and\n * the default effect to `\"DENY\"`, so a request matching nothing is denied. A\n * plain holder (not a value object); build through {@link of}.\n */\nclass AbacPolicySet {\n    private constructor(\n        private readonly _rules: readonly AbacRule[],\n        private readonly _algorithm: CombiningAlgorithm,\n        private readonly _defaultEffect: RuleEffect,\n    ) {\n        Object.freeze(this._rules);\n        Object.freeze(this);\n    }\n\n    static of(\n        rules: readonly AbacRule[],\n        options: {\n            readonly algorithm?: CombiningAlgorithm;\n            readonly defaultEffect?: RuleEffect;\n        } = {},\n    ): AbacPolicySet {\n        return new AbacPolicySet(\n            [...rules],\n            options.algorithm ?? \"deny-overrides\",\n            options.defaultEffect ?? \"DENY\",\n        );\n    }\n\n    get rules(): readonly AbacRule[] {\n        return this._rules;\n    }\n\n    get algorithm(): CombiningAlgorithm {\n        return this._algorithm;\n    }\n\n    get defaultEffect(): RuleEffect {\n        return this._defaultEffect;\n    }\n}\n\nexport { AbacPolicySet };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\nimport type {\n    ConditionNode,\n    ConditionOp,\n} from \"../../policies/engines/v1/condition-types.js\";\n\n/** Whether a matching {@link AbacRule} permits or denies the action. */\ntype RuleEffect = \"PERMIT\" | \"DENY\";\n\n/**\n * The serializable shape of a rule: a stable `id`/`version` (surfaced on a\n * denial as `policyId`/`policyVersion`), the {@link RuleEffect}, and the\n * {@link ConditionNode} that decides whether the rule applies to a request's\n * flattened attributes.\n */\ntype AbacRuleProps = {\n    readonly id: string;\n    readonly version: number;\n    readonly effect: RuleEffect;\n    readonly condition: ConditionNode;\n    readonly description?: string;\n};\n\nconst RULE_FIELD = ValidationField.of(\"abacRule\");\n\nconst CONDITION_OPS = new Set<ConditionOp>([\n    \"eq\",\n    \"neq\",\n    \"gt\",\n    \"gte\",\n    \"lt\",\n    \"lte\",\n    \"in\",\n    \"notIn\",\n    \"isNull\",\n    \"isNotNull\",\n]);\n\nconst RULE_EFFECTS = new Set<RuleEffect>([\"PERMIT\", \"DENY\"]);\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * A single attribute-based rule: an {@link RuleEffect} that takes hold when its\n * {@link ConditionNode} matches the request's flattened attributes. The\n * condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves\n * combined with `and`/`or`/`not`), so a consumer learns one condition language\n * across the whole kit.\n *\n * A zod-free value object: it validates its own shape on construction (throwing\n * {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are\n * authored in TypeScript — trusted data, not untrusted JSON — the structural\n * check is a hand-rolled walk of the condition tree rather than a schema parse.\n * Build one through {@link of}; the constructor is private.\n */\nclass AbacRule extends ValueObject<AbacRuleProps, AbacRuleProps> {\n    private constructor(props: AbacRuleProps) {\n        super(props);\n        this.finalize();\n    }\n\n    /**\n     * Builds a rule, validating that `id` is non-blank, `version` is an integer\n     * ≥ 1, `effect` is `\"PERMIT\"`/`\"DENY\"`, and `condition` is a well-formed\n     * condition node. Throws {@link InvalidValueException} otherwise.\n     */\n    static of(props: AbacRuleProps): AbacRule {\n        if (typeof props.id !== \"string\" || props.id.trim().length === 0) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"id\"),\n                ValidationCode.BLANK,\n                `abac rule id must be a non-empty string, got \"${props.id}\"`,\n            );\n        }\n\n        if (!Number.isInteger(props.version) || props.version < 1) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"version\"),\n                ValidationCode.OUT_OF_RANGE,\n                `abac rule version must be an integer >= 1, got \"${props.version}\"`,\n            );\n        }\n\n        if (!RULE_EFFECTS.has(props.effect)) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"effect\"),\n                ValidationCode.INVALID_FORMAT,\n                `abac rule effect must be \"PERMIT\" or \"DENY\", got \"${String(props.effect)}\"`,\n            );\n        }\n\n        AbacRule.assertConditionShape(props.condition);\n\n        return new AbacRule(props);\n    }\n\n    // Mirrors what the shared condition evaluator would reject at eval time\n    // (empty and/or nodes, malformed leaves) but fails fast at construction.\n    private static assertConditionShape(node: unknown): void {\n        if (!isPlainObject(node)) {\n            AbacRule.rejectCondition(\n                \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n            );\n        }\n\n        if (\"and\" in node || \"or\" in node) {\n            const key = \"and\" in node ? \"and\" : \"or\";\n            const children = node[key];\n            if (!Array.isArray(children) || children.length === 0) {\n                AbacRule.rejectCondition(\n                    `abac rule \"${key}\" node must hold a non-empty array of child conditions`,\n                );\n            }\n            for (const child of children) {\n                AbacRule.assertConditionShape(child);\n            }\n            return;\n        }\n\n        if (\"not\" in node) {\n            AbacRule.assertConditionShape(node.not);\n            return;\n        }\n\n        if (\"field\" in node && \"op\" in node) {\n            if (\n                typeof node.field !== \"string\" ||\n                node.field.trim().length === 0\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"field\" must be a non-empty string, got \"${String(node.field)}\"`,\n                );\n            }\n            if (\n                typeof node.op !== \"string\" ||\n                !CONDITION_OPS.has(node.op as ConditionOp)\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"op\" is not a supported operator, got \"${String(node.op)}\"`,\n                );\n            }\n            return;\n        }\n\n        AbacRule.rejectCondition(\n            \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n        );\n    }\n\n    private static rejectCondition(message: string): never {\n        throw new InvalidValueException(\n            RULE_FIELD.nested(\"condition\"),\n            ValidationCode.INVALID_FORMAT,\n            message,\n        );\n    }\n\n    get id(): string {\n        return this.value.id;\n    }\n\n    get version(): number {\n        return this.value.version;\n    }\n\n    get effect(): RuleEffect {\n        return this.value.effect;\n    }\n\n    /** The condition tree evaluated against a request's flattened attributes. */\n    get condition(): ConditionNode {\n        return this.value.condition as ConditionNode;\n    }\n\n    get description(): string | undefined {\n        return this.value.description;\n    }\n\n    toPrimitive(): AbacRuleProps {\n        return {\n            id: this.value.id,\n            version: this.value.version,\n            effect: this.value.effect,\n            condition: this.value.condition as ConditionNode,\n            ...(this.value.description !== undefined\n                ? { description: this.value.description }\n                : {}),\n        };\n    }\n}\n\nexport { AbacRule, type AbacRuleProps, type RuleEffect };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,YAAY,SAAqC;CAC7D,MAAM,aAAa,QAAQ;CAE3B,MAAM,UAAmC;EACrC,GAAG,WAAW;EACd,IAAI,QAAQ,MAAM;CACtB;CAEA,MAAM,WAAoC,EAAE,GAAG,WAAW,SAAS;CACnE,IAAI,QAAQ,UAAU;EAClB,SAAS,OAAO,QAAQ,SAAS;EACjC,IAAI,QAAQ,SAAS,OAAO,KAAA,GACxB,SAAS,KAAK,QAAQ,SAAS;CAEvC;CAEA,OAAO;EACH;EACA;EACA,QAAQ,EAAE,GAAG,WAAW,OAAO;EAC/B,KAAK,EAAE,GAAG,WAAW,YAAY;CACrC;AACJ;;;ACfA,SAAS,gBACL,OACA,QACoB;CACpB,OAAO,MAAM,MAAM,SAAS,KAAK,WAAW,MAAM;AACtD;;;;;;;AAQA,SAAgB,QACZ,WACA,YACA,eACa;CACb,QAAQ,WAAR;EACI,KAAK,kBAAkB;GACnB,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,QAAQ,WAAW;GACzB,IAAI,OAAO,OAAO;IAAE,QAAQ,MAAM;IAAQ,cAAc;GAAM;GAC9D,OAAO,EAAE,QAAQ,cAAc;EACnC;CACJ;AACJ;;;ACjDA,MAAM,iBAAiB;;;;;;;;;;;;;;;AA4BvB,IAAM,iBAAN,MAAqB;CAGjB,YAAY,SAA+C,CAAC,GAAG;EAC3D,KAAK,aAAa,OAAO,cAAc;CAC3C;CAEA,UACI,SACA,UACwC;EAExC,MAAM,YAAY,IAAI,qBADN,YAAY,OAElB,GACN,KAAK,WAAW,8BAA8B,cAAc,CAChE;EAEA,MAAM,aAAyB,CAAC;EAChC,KAAK,MAAM,QAAQ,SAAS,OAAO;GAC/B,MAAM,UAAU,UAAU,SAAS,KAAK,SAAS;GACjD,IAAI,QAAQ,MAAM,GAEd,OAAO,OAAO,IACV,mBAAmB,UAAU;IACzB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI;IACnC,SAAS,QAAQ,YAAY,KAAK,KAAA;GACtC,CAAC,CACL;GAEJ,IAAI,QAAQ,WAAW,GACnB,WAAW,KAAK,IAAI;EAE5B;EAEA,MAAM,EAAE,QAAQ,iBAAiB,QAC7B,SAAS,WACT,YACA,SAAS,aACb;EAEA,IAAI,WAAW,UACX,OAAO,OAAO,GAAG;GACb,QAAQ,QAAQ;GAChB,QAAQ;GACR,aAAa,cAAc,MAAM;GACjC,WAAW,SAAS;GACpB,+BAAc,IAAI,KAAK,GAAE,YAAY;EACzC,CAAC;EAGL,OAAO,OAAO,IACV,mBAAmB,aAAa;GAC5B,UAAU,cAAc,MAAM;GAC9B,eAAe,cAAc,WAAW;GACxC,iCAAgB,IAAI,KAAK,GAAE,YAAY;GACvC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI;GACnC,YAAY,cAAc;EAC9B,CAAC,CACL;CACJ;AACJ;;;;;;;;;;;;;AC9EA,IAAM,sBAAN,MAA0B;CACtB,YACI,MACA,MACF;EAFmB,KAAA,OAAA;EACA,KAAA,OAAA;CAClB;CAEH,MAAM,UACF,SACyC;EACzC,MAAM,SAAS,MAAM,KAAK,KAAK,UAAU,OAAO;EAChD,IAAI,OAAO,MAAM,GACb,OAAO;EAEX,OAAO,KAAK,KAAK,UAAU,OAAO;CACtC;AACJ;;;;;;;;;;;;;AC5BA,IAAM,gBAAN,MAAM,cAAc;CAChB,YACI,QACA,YACA,gBACF;EAHmB,KAAA,SAAA;EACA,KAAA,aAAA;EACA,KAAA,iBAAA;EAEjB,OAAO,OAAO,KAAK,MAAM;EACzB,OAAO,OAAO,IAAI;CACtB;CAEA,OAAO,GACH,OACA,UAGI,CAAC,GACQ;EACb,OAAO,IAAI,cACP,CAAC,GAAG,KAAK,GACT,QAAQ,aAAa,kBACrB,QAAQ,iBAAiB,MAC7B;CACJ;CAEA,IAAI,QAA6B;EAC7B,OAAO,KAAK;CAChB;CAEA,IAAI,YAAgC;EAChC,OAAO,KAAK;CAChB;CAEA,IAAI,gBAA4B;EAC5B,OAAO,KAAK;CAChB;AACJ;;;ACvBA,MAAM,aAAa,gBAAgB,GAAG,UAAU;AAEhD,MAAM,gBAAgB,IAAI,IAAiB;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,MAAM,eAAe,IAAI,IAAgB,CAAC,UAAU,MAAM,CAAC;AAE3D,SAAS,cAAc,OAAkD;CACrE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;;;;;;;;;;;;AAeA,IAAM,WAAN,MAAM,iBAAiB,YAA0C;CAC7D,YAAoB,OAAsB;EACtC,MAAM,KAAK;EACX,KAAK,SAAS;CAClB;;;;;;CAOA,OAAO,GAAG,OAAgC;EACtC,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,KAAK,EAAE,WAAW,GAC3D,MAAM,IAAI,sBACN,WAAW,OAAO,IAAI,GACtB,eAAe,OACf,iDAAiD,MAAM,GAAG,EAC9D;EAGJ,IAAI,CAAC,OAAO,UAAU,MAAM,OAAO,KAAK,MAAM,UAAU,GACpD,MAAM,IAAI,sBACN,WAAW,OAAO,SAAS,GAC3B,eAAe,cACf,mDAAmD,MAAM,QAAQ,EACrE;EAGJ,IAAI,CAAC,aAAa,IAAI,MAAM,MAAM,GAC9B,MAAM,IAAI,sBACN,WAAW,OAAO,QAAQ,GAC1B,eAAe,gBACf,qDAAqD,OAAO,MAAM,MAAM,EAAE,EAC9E;EAGJ,SAAS,qBAAqB,MAAM,SAAS;EAE7C,OAAO,IAAI,SAAS,KAAK;CAC7B;CAIA,OAAe,qBAAqB,MAAqB;EACrD,IAAI,CAAC,cAAc,IAAI,GACnB,SAAS,gBACL,gFACJ;EAGJ,IAAI,SAAS,QAAQ,QAAQ,MAAM;GAC/B,MAAM,MAAM,SAAS,OAAO,QAAQ;GACpC,MAAM,WAAW,KAAK;GACtB,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,GAChD,SAAS,gBACL,cAAc,IAAI,uDACtB;GAEJ,KAAK,MAAM,SAAS,UAChB,SAAS,qBAAqB,KAAK;GAEvC;EACJ;EAEA,IAAI,SAAS,MAAM;GACf,SAAS,qBAAqB,KAAK,GAAG;GACtC;EACJ;EAEA,IAAI,WAAW,QAAQ,QAAQ,MAAM;GACjC,IACI,OAAO,KAAK,UAAU,YACtB,KAAK,MAAM,KAAK,EAAE,WAAW,GAE7B,SAAS,gBACL,qEAAqE,OAAO,KAAK,KAAK,EAAE,EAC5F;GAEJ,IACI,OAAO,KAAK,OAAO,YACnB,CAAC,cAAc,IAAI,KAAK,EAAiB,GAEzC,SAAS,gBACL,mEAAmE,OAAO,KAAK,EAAE,EAAE,EACvF;GAEJ;EACJ;EAEA,SAAS,gBACL,gFACJ;CACJ;CAEA,OAAe,gBAAgB,SAAwB;EACnD,MAAM,IAAI,sBACN,WAAW,OAAO,WAAW,GAC7B,eAAe,gBACf,OACJ;CACJ;CAEA,IAAI,KAAa;EACb,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,UAAkB;EAClB,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,SAAqB;EACrB,OAAO,KAAK,MAAM;CACtB;;CAGA,IAAI,YAA2B;EAC3B,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,cAAkC;EAClC,OAAO,KAAK,MAAM;CACtB;CAEA,cAA6B;EACzB,OAAO;GACH,IAAI,KAAK,MAAM;GACf,SAAS,KAAK,MAAM;GACpB,QAAQ,KAAK,MAAM;GACnB,WAAW,KAAK,MAAM;GACtB,GAAI,KAAK,MAAM,gBAAgB,KAAA,IACzB,EAAE,aAAa,KAAK,MAAM,YAAY,IACtC,CAAC;EACX;CACJ;AACJ"}
+{"version":3,"file":"rule.js","names":[],"sources":["../src/core/abac/attributes.ts","../src/core/abac/combining.ts","../src/core/abac/authorizer.ts","../src/core/abac/composite-authorizer.ts","../src/core/abac/domain/policy-set.ts","../src/core/policies/engines/v1/condition-types.ts","../src/core/abac/domain/rule.ts"],"sourcesContent":["import type { PolicyContext } from \"../policies/engines/gate-types.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\n\n/**\n * Flattens an {@link AbacRequest} into the nested {@link PolicyContext} the\n * condition evaluator reads (it resolves dotted fields like `resource.status` by\n * walking nested objects). The actor lands as `subject.id`; the four attribute\n * bags nest under `subject` / `resource` / `action` / `env`; a `resource`\n * reference adds `resource.type` / `resource.id`. The actor id and the resource\n * reference win over any same-named keys in the attribute bags.\n *\n * Consumers fold dynamic facts (e.g. RBAC roles/permissions derived from grants,\n * or a computed `ownerIsActor` flag) into `attributes.subject` / `resource` so\n * rules can reference `subject.roles`, `resource.ownerIsActor`, and the like.\n */\nexport function abacContext(request: AbacRequest): PolicyContext {\n    const attributes = request.attributes;\n\n    const subject: Record<string, unknown> = {\n        ...attributes.subject,\n        id: request.actor.raw,\n    };\n\n    const resource: Record<string, unknown> = { ...attributes.resource };\n    if (request.resource) {\n        resource.type = request.resource.type;\n        if (request.resource.id !== undefined) {\n            resource.id = request.resource.id;\n        }\n    }\n\n    return {\n        subject,\n        resource,\n        action: { ...attributes.action },\n        env: { ...attributes.environment },\n    };\n}\n","import type { AbacRule, RuleEffect } from \"./domain/rule.js\";\n\n/**\n * How an {@link AbacPolicySet} resolves several applicable rules into one effect.\n *\n * - `deny-overrides` (default, secure): any applicable DENY wins; otherwise the\n *   first PERMIT; otherwise the set's default effect.\n * - `permit-overrides`: any applicable PERMIT wins; otherwise the first DENY;\n *   otherwise the default effect.\n * - `first-applicable`: the effect of the first rule that matches; otherwise the\n *   default effect.\n */\nexport type CombiningAlgorithm =\n    | \"deny-overrides\"\n    | \"permit-overrides\"\n    | \"first-applicable\";\n\n/** The resolved decision plus the rule (if any) that produced it. */\nexport interface CombineResult {\n    readonly effect: RuleEffect;\n    readonly decidingRule?: AbacRule;\n}\n\nfunction firstWithEffect(\n    rules: readonly AbacRule[],\n    effect: RuleEffect,\n): AbacRule | undefined {\n    return rules.find((rule) => rule.effect === effect);\n}\n\n/**\n * Applies `algorithm` to the already-matched `applicable` rules, falling back to\n * `defaultEffect` when the algorithm reaches no rule-backed decision. Pure and\n * total; the returned `decidingRule` is absent exactly when `defaultEffect` was\n * used.\n */\nexport function combine(\n    algorithm: CombiningAlgorithm,\n    applicable: readonly AbacRule[],\n    defaultEffect: RuleEffect,\n): CombineResult {\n    switch (algorithm) {\n        case \"deny-overrides\": {\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            return { effect: defaultEffect };\n        }\n        case \"permit-overrides\": {\n            const permit = firstWithEffect(applicable, \"PERMIT\");\n            if (permit) return { effect: \"PERMIT\", decidingRule: permit };\n            const deny = firstWithEffect(applicable, \"DENY\");\n            if (deny) return { effect: \"DENY\", decidingRule: deny };\n            return { effect: defaultEffect };\n        }\n        case \"first-applicable\": {\n            const first = applicable[0];\n            if (first) return { effect: first.effect, decidingRule: first };\n            return { effect: defaultEffect };\n        }\n    }\n}\n","import { type CoreConfig, coreConfig } from \"../config/index.js\";\nimport { AuthorizationError } from \"../errors/authorization-error.js\";\nimport { ConditionEvaluatorV1 } from \"../policies/engines/v1/condition-evaluator.js\";\nimport { Result } from \"../result/result.js\";\n\nimport type { AbacRequest } from \"./abac-request.js\";\nimport { abacContext } from \"./attributes.js\";\nimport { combine, type CombiningAlgorithm } from \"./combining.js\";\nimport type { AbacPolicySet } from \"./domain/policy-set.js\";\nimport type { AbacRule, RuleEffect } from \"./domain/rule.js\";\n\n// ABAC reuses the gate engine's v1 condition matcher; the version stamps the\n// evaluation reports the shared reporter emits.\nconst ENGINE_VERSION = 1;\n\n/** The successful decision returned by {@link AbacAuthorizer.authorize}. */\ninterface AbacDecision {\n    /** The audited business action that was allowed. */\n    readonly action: string;\n    readonly effect: \"PERMIT\";\n    /** The id of the rule that permitted, or `\"<default>\"` when the set's default did. */\n    readonly matchedRule: string;\n    readonly algorithm: CombiningAlgorithm;\n    /** When the decision was made, ISO-8601. */\n    readonly grantedAtIso: string;\n}\n\n/**\n * The pure ABAC decisor. Given an {@link AbacRequest} and an\n * {@link AbacPolicySet}, it flattens the request's attributes into a context,\n * matches each rule's condition with the gate engine's pure condition evaluator\n * (reused, not reimplemented), resolves the effects through the set's combining\n * algorithm, and returns a {@link Result} — never throwing, mirroring the\n * \"errors as values\" contract of `RbacAuthorizer`/`GateEngineV1`.\n *\n * A denial maps to {@link AuthorizationError.policyDenied}, attributed to the\n * deciding rule's `id`/`version`. A condition-evaluation failure (a missing\n * attribute, a wrong-typed operand) fails closed as\n * {@link AuthorizationError.forbidden} — also attributed to the culprit rule's\n * `id`/`version` — unless the set opts into `onEvaluationError: \"skip-rule\"`, in\n * which case the unevaluable rule is skipped and the rest decide. Every resolved\n * decision (PERMIT and DENY) is emitted best-effort through the configured\n * reporter as an `abac-decision` event (silent by default). Timestamps come from\n * an injectable `clock` (default `() => new Date()`), so the decisor is pure\n * given one. Loading the dynamic attributes is the consumer's job (behind an\n * `AbacAuthorizerPort` adapter); this class only decides.\n */\nclass AbacAuthorizer {\n    private readonly coreConfig: CoreConfig;\n    private readonly clock: () => Date;\n\n    constructor(\n        params: {\n            readonly coreConfig?: CoreConfig;\n            /** Injectable clock for deterministic timestamps; defaults to `() => new Date()`. */\n            readonly clock?: () => Date;\n        } = {},\n    ) {\n        this.coreConfig = params.coreConfig ?? coreConfig;\n        this.clock = params.clock ?? (() => new Date());\n    }\n\n    authorize(\n        request: AbacRequest,\n        policies: AbacPolicySet,\n    ): Result<AbacDecision, AuthorizationError> {\n        const context = abacContext(request);\n        const evaluator = new ConditionEvaluatorV1(\n            context,\n            this.coreConfig.getConditionEvaluationOptions(ENGINE_VERSION),\n        );\n\n        const applicable: AbacRule[] = [];\n        for (const rule of policies.rules) {\n            const matched = evaluator.evaluate(rule.condition);\n            if (matched.isErr()) {\n                if (policies.onEvaluationError === \"skip-rule\") {\n                    // Escape valve for evolving rules: drop the unevaluable rule\n                    // (the evaluator already reported the anomaly) and let the\n                    // rest decide, instead of failing the whole set closed.\n                    continue;\n                }\n                // Fail closed: a technical evaluation error is never a silent\n                // PERMIT. Attribute the deny to the culprit rule so the 403 is\n                // triageable without turning on the reporter.\n                return Result.err(\n                    AuthorizationError.forbidden({\n                        action: request.action,\n                        resource: request.resource,\n                        actor: { actorId: request.actor.raw },\n                        policyId: rule.id,\n                        policyVersion: rule.version,\n                        details: matched.errorOrNull() ?? undefined,\n                    }),\n                );\n            }\n            if (matched.getOrThrow()) {\n                applicable.push(rule);\n            }\n        }\n\n        const { effect, decidingRule } = combine(\n            policies.algorithm,\n            applicable,\n            policies.defaultEffect,\n        );\n\n        this.reportDecision(request, policies, effect, decidingRule);\n\n        if (effect === \"PERMIT\") {\n            return Result.ok({\n                action: request.action,\n                effect: \"PERMIT\",\n                matchedRule: decidingRule?.id ?? \"<default>\",\n                algorithm: policies.algorithm,\n                grantedAtIso: this.clock().toISOString(),\n            });\n        }\n\n        return Result.err(\n            AuthorizationError.policyDenied({\n                policyId: decidingRule?.id ?? \"<default-deny>\",\n                policyVersion: decidingRule?.version ?? 0,\n                evaluatedAtIso: this.clock().toISOString(),\n                action: request.action,\n                resource: request.resource,\n                actor: { actorId: request.actor.raw },\n                reasonCode: decidingRule?.id,\n            }),\n        );\n    }\n\n    // Best-effort audit trail: emits the resolved decision (PERMIT and DENY)\n    // through the configured reporter, silent by default.\n    private reportDecision(\n        request: AbacRequest,\n        policies: AbacPolicySet,\n        effect: RuleEffect,\n        decidingRule: AbacRule | undefined,\n    ): void {\n        this.coreConfig.reportSafely({\n            kind: \"abac-decision\",\n            level: \"info\",\n            action: request.action,\n            resource: request.resource,\n            actorId: request.actor.raw,\n            effect,\n            decidingRuleId:\n                decidingRule?.id ??\n                (effect === \"PERMIT\" ? \"<default>\" : \"<default-deny>\"),\n            decidingRuleVersion: decidingRule?.version,\n            algorithm: policies.algorithm,\n            occurredAt: this.clock(),\n        });\n    }\n}\n\nexport { AbacAuthorizer, type AbacDecision };\n","import { Result } from \"../result/result.js\";\nimport type { AbacAuthorizerPort } from \"../application/ports/abac-authorizer.port.js\";\nimport type { AuthorizerPort } from \"../application/ports/authorizer.port.js\";\nimport type { AuthorizationError } from \"../errors/authorization-error.js\";\nimport type { AccessRequest } from \"../rbac/access-request.js\";\n\nimport type { AbacAttributes } from \"./abac-request.js\";\n\n/**\n * The request a {@link CompositeAuthorizer} accepts — one object that satisfies\n * both the RBAC {@link AccessRequest} (its `required`/`scope`) and the ABAC\n * request (its `attributes`).\n */\ntype CompositeAccessRequest = AccessRequest & {\n    readonly attributes: AbacAttributes;\n};\n\n/**\n * Runs a coarse RBAC check first, then refines with ABAC — the standard hybrid\n * \"does the actor hold the capability, *and* do the attributes allow it here?\"\n * flow. Short-circuits with the RBAC denial when the actor is not even capable,\n * so the boundary sees the most specific 403.\n *\n * Only the two port interfaces are referenced (both erased at runtime), so this\n * pulls in no RBAC/ABAC engine code of its own — it just sequences the seams the\n * consumer wires up.\n */\nclass CompositeAuthorizer {\n    constructor(\n        private readonly rbac: AuthorizerPort,\n        private readonly abac: AbacAuthorizerPort,\n    ) {}\n\n    async authorize(\n        request: CompositeAccessRequest,\n    ): Promise<Result<void, AuthorizationError>> {\n        const coarse = await this.rbac.authorize(request);\n        if (coarse.isErr()) {\n            return coarse;\n        }\n        return this.abac.authorize(request);\n    }\n}\n\nexport { CompositeAuthorizer, type CompositeAccessRequest };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport type { CombiningAlgorithm } from \"../combining.js\";\n\nimport type { AbacRule, RuleEffect } from \"./rule.js\";\n\n/**\n * How the {@link AbacAuthorizer} reacts when a rule's condition cannot be\n * evaluated (a referenced attribute is absent, an operand is wrong-typed).\n *\n * - `fail-closed` (default, secure): the whole decision fails closed as\n *   `forbidden`. Safe, but it means adding a rule that reads an attribute a call\n *   site does not populate makes that call site deny everything until it does.\n * - `skip-rule`: the unevaluable rule is dropped from the applicable set and the\n *   remaining rules decide — the escape valve for evolving rules without\n *   trailing every call site. The evaluator still reports the anomaly.\n */\nexport type OnEvaluationError = \"fail-closed\" | \"skip-rule\";\n\nconst POLICY_SET_FIELD = ValidationField.of(\"abacPolicySet\");\n\n/**\n * An ordered collection of {@link AbacRule}s plus how to combine them\n * ({@link CombiningAlgorithm}), what to decide when no rule applies\n * ({@link defaultEffect}), and how to react to an unevaluable rule\n * ({@link onEvaluationError}). This is where ABAC goes beyond a single gate\n * condition: several PERMIT/DENY rules resolved by an explicit algorithm.\n *\n * Closed by default — the combining algorithm defaults to `\"deny-overrides\"`,\n * the default effect to `\"DENY\"`, and evaluation errors to `\"fail-closed\"`, so a\n * request matching nothing (or hitting a technical error) is denied. A plain\n * holder (not a value object); build through {@link of}.\n */\nclass AbacPolicySet {\n    private constructor(\n        private readonly _rules: readonly AbacRule[],\n        private readonly _algorithm: CombiningAlgorithm,\n        private readonly _defaultEffect: RuleEffect,\n        private readonly _onEvaluationError: OnEvaluationError,\n    ) {\n        Object.freeze(this._rules);\n        Object.freeze(this);\n    }\n\n    /**\n     * Builds a policy set. Rejects duplicate rule ids with\n     * {@link InvalidValueException} so a denial's `policyId` attribution is\n     * unambiguous.\n     */\n    static of(\n        rules: readonly AbacRule[],\n        options: {\n            readonly algorithm?: CombiningAlgorithm;\n            readonly defaultEffect?: RuleEffect;\n            readonly onEvaluationError?: OnEvaluationError;\n        } = {},\n    ): AbacPolicySet {\n        AbacPolicySet.assertUniqueIds(rules);\n        return new AbacPolicySet(\n            [...rules],\n            options.algorithm ?? \"deny-overrides\",\n            options.defaultEffect ?? \"DENY\",\n            options.onEvaluationError ?? \"fail-closed\",\n        );\n    }\n\n    private static assertUniqueIds(rules: readonly AbacRule[]): void {\n        const seen = new Set<string>();\n        for (const rule of rules) {\n            if (seen.has(rule.id)) {\n                throw new InvalidValueException(\n                    POLICY_SET_FIELD.nested(\"rules\"),\n                    ValidationCode.ALREADY_EXISTS,\n                    `abac policy set has duplicate rule id \"${rule.id}\"; ids must be unique for unambiguous audit attribution`,\n                );\n            }\n            seen.add(rule.id);\n        }\n    }\n\n    get rules(): readonly AbacRule[] {\n        return this._rules;\n    }\n\n    get algorithm(): CombiningAlgorithm {\n        return this._algorithm;\n    }\n\n    get defaultEffect(): RuleEffect {\n        return this._defaultEffect;\n    }\n\n    get onEvaluationError(): OnEvaluationError {\n        return this._onEvaluationError;\n    }\n}\n\nexport { AbacPolicySet };\n","// ─── Shared v1 condition DSL types ──────────────────────────────────────────\n// These types belong to the v1 engine family: both gate/v1 and compute/v1\n// share the same condition-tree DSL. Keeping them here avoids making compute/v1\n// structurally dependent on gate/v1.\n\n// Single source of truth for the operator vocabulary: the union is derived from\n// this array so a new operator is added in exactly one place, and consumers that\n// need the runtime list (e.g. AbacRule's structural check) reuse it instead of\n// hand-maintaining a parallel set that can drift out of sync.\nexport const CONDITION_OPS = [\n    \"eq\",\n    \"neq\",\n    \"gt\",\n    \"gte\",\n    \"lt\",\n    \"lte\",\n    \"in\",\n    \"notIn\",\n    \"isNull\",\n    \"isNotNull\",\n] as const;\n\nexport type ConditionOp = (typeof CONDITION_OPS)[number];\n\nexport interface ConditionLeafNode {\n    readonly field: string;\n    readonly op: ConditionOp;\n    readonly value: unknown;\n    readonly allowNull?: true;\n}\n\nexport interface ConditionAndNode {\n    readonly and: readonly ConditionNode[];\n}\n\nexport interface ConditionOrNode {\n    readonly or: readonly ConditionNode[];\n}\n\nexport interface ConditionNotNode {\n    readonly not: ConditionNode;\n}\n\nexport type ConditionNode =\n    | ConditionLeafNode\n    | ConditionAndNode\n    | ConditionOrNode\n    | ConditionNotNode;\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\nimport {\n    CONDITION_OPS,\n    type ConditionNode,\n    type ConditionOp,\n} from \"../../policies/engines/v1/condition-types.js\";\n\n/** Whether a matching {@link AbacRule} permits or denies the action. */\ntype RuleEffect = \"PERMIT\" | \"DENY\";\n\n/**\n * The serializable shape of a rule: a stable `id`/`version` (surfaced on a\n * denial as `policyId`/`policyVersion`), the {@link RuleEffect}, and the\n * {@link ConditionNode} that decides whether the rule applies to a request's\n * flattened attributes.\n */\ntype AbacRuleProps = {\n    readonly id: string;\n    readonly version: number;\n    readonly effect: RuleEffect;\n    readonly condition: ConditionNode;\n    readonly description?: string;\n};\n\nconst RULE_FIELD = ValidationField.of(\"abacRule\");\n\n// Derived from the evaluator's own operator list (single source of truth) so a\n// new operator becomes usable in ABAC rules without a parallel edit here.\nconst SUPPORTED_OPS = new Set<ConditionOp>(CONDITION_OPS);\n\nconst RULE_EFFECTS = new Set<RuleEffect>([\"PERMIT\", \"DENY\"]);\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * A single attribute-based rule: an {@link RuleEffect} that takes hold when its\n * {@link ConditionNode} matches the request's flattened attributes. The\n * condition reuses the gate/compute condition DSL (`{ field, op, value }` leaves\n * combined with `and`/`or`/`not`), so a consumer learns one condition language\n * across the whole kit.\n *\n * A zod-free value object: it validates its own shape on construction (throwing\n * {@link InvalidValueException}) and is deep-frozen thereafter. Because rules are\n * authored in TypeScript — trusted data, not untrusted JSON — the structural\n * check is a hand-rolled walk of the condition tree rather than a schema parse.\n * Build one through {@link of}; the constructor is private.\n *\n * **Attribute semantics a rule author must know (the condition is evaluated by\n * the shared gate/compute engine, whose runtime rules apply here too):**\n * - **A referenced attribute that is *absent* from the request is a technical\n *   evaluation error, not a non-match.** By default (`onEvaluationError:\n *   \"fail-closed\"` on the {@link AbacPolicySet}) that error fails the *entire*\n *   decision closed — so adding a rule that reads an attribute a given call site\n *   does not yet populate makes that call site start returning `forbidden`,\n *   *even for requests the older rules used to permit*. Choose\n *   `onEvaluationError: \"skip-rule\"` on the set to skip an unevaluable rule\n *   instead of failing the whole set.\n * - **`isNull` / `isNotNull` test for an explicit `null`/`undefined` *value*, not\n *   for a missing key.** A key that is absent from the bag never reaches the\n *   operator — it short-circuits to the missing-attribute error above. To match\n *   \"no deletedAt\", the consumer must put `deletedAt: null` in the bag, not omit\n *   it. Pass `allowNull: true` on a relational leaf to treat a present `null` as\n *   a non-match instead of an error.\n * - **Date comparison operands must be strict ISO-8601 UTC**\n *   (`YYYY-MM-DDTHH:mm:ss.sssZ`); a bare `\"2026-07-09\"` or an offset like\n *   `+00:00` is rejected as an invalid operand and fails closed.\n */\nclass AbacRule extends ValueObject<AbacRuleProps, AbacRuleProps> {\n    private constructor(props: AbacRuleProps) {\n        super(props);\n        this.finalize();\n    }\n\n    /**\n     * Builds a rule, validating that `id` is non-blank, `version` is an integer\n     * ≥ 1, `effect` is `\"PERMIT\"`/`\"DENY\"`, and `condition` is a well-formed\n     * condition node. Throws {@link InvalidValueException} otherwise.\n     */\n    static of(props: AbacRuleProps): AbacRule {\n        if (typeof props.id !== \"string\" || props.id.trim().length === 0) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"id\"),\n                ValidationCode.BLANK,\n                `abac rule id must be a non-empty string, got \"${props.id}\"`,\n            );\n        }\n\n        if (!Number.isInteger(props.version) || props.version < 1) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"version\"),\n                ValidationCode.OUT_OF_RANGE,\n                `abac rule version must be an integer >= 1, got \"${props.version}\"`,\n            );\n        }\n\n        if (!RULE_EFFECTS.has(props.effect)) {\n            throw new InvalidValueException(\n                RULE_FIELD.nested(\"effect\"),\n                ValidationCode.INVALID_FORMAT,\n                `abac rule effect must be \"PERMIT\" or \"DENY\", got \"${String(props.effect)}\"`,\n            );\n        }\n\n        AbacRule.assertConditionShape(props.condition);\n\n        return new AbacRule(props);\n    }\n\n    // Mirrors what the shared condition evaluator would reject at eval time\n    // (empty and/or nodes, malformed leaves) but fails fast at construction.\n    private static assertConditionShape(node: unknown): void {\n        if (!isPlainObject(node)) {\n            AbacRule.rejectCondition(\n                \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n            );\n        }\n\n        if (\"and\" in node || \"or\" in node) {\n            const key = \"and\" in node ? \"and\" : \"or\";\n            const children = node[key];\n            if (!Array.isArray(children) || children.length === 0) {\n                AbacRule.rejectCondition(\n                    `abac rule \"${key}\" node must hold a non-empty array of child conditions`,\n                );\n            }\n            for (const child of children) {\n                AbacRule.assertConditionShape(child);\n            }\n            return;\n        }\n\n        if (\"not\" in node) {\n            AbacRule.assertConditionShape(node.not);\n            return;\n        }\n\n        if (\"field\" in node && \"op\" in node) {\n            if (\n                typeof node.field !== \"string\" ||\n                node.field.trim().length === 0\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"field\" must be a non-empty string, got \"${String(node.field)}\"`,\n                );\n            }\n            if (\n                typeof node.op !== \"string\" ||\n                !SUPPORTED_OPS.has(node.op as ConditionOp)\n            ) {\n                AbacRule.rejectCondition(\n                    `abac rule condition leaf \"op\" is not a supported operator, got \"${String(node.op)}\"`,\n                );\n            }\n            return;\n        }\n\n        AbacRule.rejectCondition(\n            \"abac rule condition must be a leaf { field, op } or an { and | or | not } node\",\n        );\n    }\n\n    private static rejectCondition(message: string): never {\n        throw new InvalidValueException(\n            RULE_FIELD.nested(\"condition\"),\n            ValidationCode.INVALID_FORMAT,\n            message,\n        );\n    }\n\n    get id(): string {\n        return this.value.id;\n    }\n\n    get version(): number {\n        return this.value.version;\n    }\n\n    get effect(): RuleEffect {\n        return this.value.effect;\n    }\n\n    /** The condition tree evaluated against a request's flattened attributes. */\n    get condition(): ConditionNode {\n        return this.value.condition as ConditionNode;\n    }\n\n    get description(): string | undefined {\n        return this.value.description;\n    }\n\n    toPrimitive(): AbacRuleProps {\n        return {\n            id: this.value.id,\n            version: this.value.version,\n            effect: this.value.effect,\n            condition: this.value.condition as ConditionNode,\n            ...(this.value.description !== undefined\n                ? { description: this.value.description }\n                : {}),\n        };\n    }\n}\n\nexport { AbacRule, type AbacRuleProps, type RuleEffect };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,YAAY,SAAqC;CAC7D,MAAM,aAAa,QAAQ;CAE3B,MAAM,UAAmC;EACrC,GAAG,WAAW;EACd,IAAI,QAAQ,MAAM;CACtB;CAEA,MAAM,WAAoC,EAAE,GAAG,WAAW,SAAS;CACnE,IAAI,QAAQ,UAAU;EAClB,SAAS,OAAO,QAAQ,SAAS;EACjC,IAAI,QAAQ,SAAS,OAAO,KAAA,GACxB,SAAS,KAAK,QAAQ,SAAS;CAEvC;CAEA,OAAO;EACH;EACA;EACA,QAAQ,EAAE,GAAG,WAAW,OAAO;EAC/B,KAAK,EAAE,GAAG,WAAW,YAAY;CACrC;AACJ;;;ACfA,SAAS,gBACL,OACA,QACoB;CACpB,OAAO,MAAM,MAAM,SAAS,KAAK,WAAW,MAAM;AACtD;;;;;;;AAQA,SAAgB,QACZ,WACA,YACA,eACa;CACb,QAAQ,WAAR;EACI,KAAK,kBAAkB;GACnB,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,SAAS,gBAAgB,YAAY,QAAQ;GACnD,IAAI,QAAQ,OAAO;IAAE,QAAQ;IAAU,cAAc;GAAO;GAC5D,MAAM,OAAO,gBAAgB,YAAY,MAAM;GAC/C,IAAI,MAAM,OAAO;IAAE,QAAQ;IAAQ,cAAc;GAAK;GACtD,OAAO,EAAE,QAAQ,cAAc;EACnC;EACA,KAAK,oBAAoB;GACrB,MAAM,QAAQ,WAAW;GACzB,IAAI,OAAO,OAAO;IAAE,QAAQ,MAAM;IAAQ,cAAc;GAAM;GAC9D,OAAO,EAAE,QAAQ,cAAc;EACnC;CACJ;AACJ;;;ACjDA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;AAkCvB,IAAM,iBAAN,MAAqB;CAIjB,YACI,SAII,CAAC,GACP;EACE,KAAK,aAAa,OAAO,cAAc;EACvC,KAAK,QAAQ,OAAO,gCAAgB,IAAI,KAAK;CACjD;CAEA,UACI,SACA,UACwC;EAExC,MAAM,YAAY,IAAI,qBADN,YAAY,OAElB,GACN,KAAK,WAAW,8BAA8B,cAAc,CAChE;EAEA,MAAM,aAAyB,CAAC;EAChC,KAAK,MAAM,QAAQ,SAAS,OAAO;GAC/B,MAAM,UAAU,UAAU,SAAS,KAAK,SAAS;GACjD,IAAI,QAAQ,MAAM,GAAG;IACjB,IAAI,SAAS,sBAAsB,aAI/B;IAKJ,OAAO,OAAO,IACV,mBAAmB,UAAU;KACzB,QAAQ,QAAQ;KAChB,UAAU,QAAQ;KAClB,OAAO,EAAE,SAAS,QAAQ,MAAM,IAAI;KACpC,UAAU,KAAK;KACf,eAAe,KAAK;KACpB,SAAS,QAAQ,YAAY,KAAK,KAAA;IACtC,CAAC,CACL;GACJ;GACA,IAAI,QAAQ,WAAW,GACnB,WAAW,KAAK,IAAI;EAE5B;EAEA,MAAM,EAAE,QAAQ,iBAAiB,QAC7B,SAAS,WACT,YACA,SAAS,aACb;EAEA,KAAK,eAAe,SAAS,UAAU,QAAQ,YAAY;EAE3D,IAAI,WAAW,UACX,OAAO,OAAO,GAAG;GACb,QAAQ,QAAQ;GAChB,QAAQ;GACR,aAAa,cAAc,MAAM;GACjC,WAAW,SAAS;GACpB,cAAc,KAAK,MAAM,EAAE,YAAY;EAC3C,CAAC;EAGL,OAAO,OAAO,IACV,mBAAmB,aAAa;GAC5B,UAAU,cAAc,MAAM;GAC9B,eAAe,cAAc,WAAW;GACxC,gBAAgB,KAAK,MAAM,EAAE,YAAY;GACzC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,OAAO,EAAE,SAAS,QAAQ,MAAM,IAAI;GACpC,YAAY,cAAc;EAC9B,CAAC,CACL;CACJ;CAIA,eACI,SACA,UACA,QACA,cACI;EACJ,KAAK,WAAW,aAAa;GACzB,MAAM;GACN,OAAO;GACP,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,SAAS,QAAQ,MAAM;GACvB;GACA,gBACI,cAAc,OACb,WAAW,WAAW,cAAc;GACzC,qBAAqB,cAAc;GACnC,WAAW,SAAS;GACpB,YAAY,KAAK,MAAM;EAC3B,CAAC;CACL;AACJ;;;;;;;;;;;;;AChIA,IAAM,sBAAN,MAA0B;CACtB,YACI,MACA,MACF;EAFmB,KAAA,OAAA;EACA,KAAA,OAAA;CAClB;CAEH,MAAM,UACF,SACyC;EACzC,MAAM,SAAS,MAAM,KAAK,KAAK,UAAU,OAAO;EAChD,IAAI,OAAO,MAAM,GACb,OAAO;EAEX,OAAO,KAAK,KAAK,UAAU,OAAO;CACtC;AACJ;;;ACtBA,MAAM,mBAAmB,gBAAgB,GAAG,eAAe;;;;;;;;;;;;;AAc3D,IAAM,gBAAN,MAAM,cAAc;CAChB,YACI,QACA,YACA,gBACA,oBACF;EAJmB,KAAA,SAAA;EACA,KAAA,aAAA;EACA,KAAA,iBAAA;EACA,KAAA,qBAAA;EAEjB,OAAO,OAAO,KAAK,MAAM;EACzB,OAAO,OAAO,IAAI;CACtB;;;;;;CAOA,OAAO,GACH,OACA,UAII,CAAC,GACQ;EACb,cAAc,gBAAgB,KAAK;EACnC,OAAO,IAAI,cACP,CAAC,GAAG,KAAK,GACT,QAAQ,aAAa,kBACrB,QAAQ,iBAAiB,QACzB,QAAQ,qBAAqB,aACjC;CACJ;CAEA,OAAe,gBAAgB,OAAkC;EAC7D,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,QAAQ,OAAO;GACtB,IAAI,KAAK,IAAI,KAAK,EAAE,GAChB,MAAM,IAAI,sBACN,iBAAiB,OAAO,OAAO,GAC/B,eAAe,gBACf,0CAA0C,KAAK,GAAG,wDACtD;GAEJ,KAAK,IAAI,KAAK,EAAE;EACpB;CACJ;CAEA,IAAI,QAA6B;EAC7B,OAAO,KAAK;CAChB;CAEA,IAAI,YAAgC;EAChC,OAAO,KAAK;CAChB;CAEA,IAAI,gBAA4B;EAC5B,OAAO,KAAK;CAChB;CAEA,IAAI,oBAAuC;EACvC,OAAO,KAAK;CAChB;AACJ;;;ACvFA,MAAa,gBAAgB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;ACOA,MAAM,aAAa,gBAAgB,GAAG,UAAU;AAIhD,MAAM,gBAAgB,IAAI,IAAiB,aAAa;AAExD,MAAM,eAAe,IAAI,IAAgB,CAAC,UAAU,MAAM,CAAC;AAE3D,SAAS,cAAc,OAAkD;CACrE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAM,WAAN,MAAM,iBAAiB,YAA0C;CAC7D,YAAoB,OAAsB;EACtC,MAAM,KAAK;EACX,KAAK,SAAS;CAClB;;;;;;CAOA,OAAO,GAAG,OAAgC;EACtC,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,KAAK,EAAE,WAAW,GAC3D,MAAM,IAAI,sBACN,WAAW,OAAO,IAAI,GACtB,eAAe,OACf,iDAAiD,MAAM,GAAG,EAC9D;EAGJ,IAAI,CAAC,OAAO,UAAU,MAAM,OAAO,KAAK,MAAM,UAAU,GACpD,MAAM,IAAI,sBACN,WAAW,OAAO,SAAS,GAC3B,eAAe,cACf,mDAAmD,MAAM,QAAQ,EACrE;EAGJ,IAAI,CAAC,aAAa,IAAI,MAAM,MAAM,GAC9B,MAAM,IAAI,sBACN,WAAW,OAAO,QAAQ,GAC1B,eAAe,gBACf,qDAAqD,OAAO,MAAM,MAAM,EAAE,EAC9E;EAGJ,SAAS,qBAAqB,MAAM,SAAS;EAE7C,OAAO,IAAI,SAAS,KAAK;CAC7B;CAIA,OAAe,qBAAqB,MAAqB;EACrD,IAAI,CAAC,cAAc,IAAI,GACnB,SAAS,gBACL,gFACJ;EAGJ,IAAI,SAAS,QAAQ,QAAQ,MAAM;GAC/B,MAAM,MAAM,SAAS,OAAO,QAAQ;GACpC,MAAM,WAAW,KAAK;GACtB,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,GAChD,SAAS,gBACL,cAAc,IAAI,uDACtB;GAEJ,KAAK,MAAM,SAAS,UAChB,SAAS,qBAAqB,KAAK;GAEvC;EACJ;EAEA,IAAI,SAAS,MAAM;GACf,SAAS,qBAAqB,KAAK,GAAG;GACtC;EACJ;EAEA,IAAI,WAAW,QAAQ,QAAQ,MAAM;GACjC,IACI,OAAO,KAAK,UAAU,YACtB,KAAK,MAAM,KAAK,EAAE,WAAW,GAE7B,SAAS,gBACL,qEAAqE,OAAO,KAAK,KAAK,EAAE,EAC5F;GAEJ,IACI,OAAO,KAAK,OAAO,YACnB,CAAC,cAAc,IAAI,KAAK,EAAiB,GAEzC,SAAS,gBACL,mEAAmE,OAAO,KAAK,EAAE,EAAE,EACvF;GAEJ;EACJ;EAEA,SAAS,gBACL,gFACJ;CACJ;CAEA,OAAe,gBAAgB,SAAwB;EACnD,MAAM,IAAI,sBACN,WAAW,OAAO,WAAW,GAC7B,eAAe,gBACf,OACJ;CACJ;CAEA,IAAI,KAAa;EACb,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,UAAkB;EAClB,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,SAAqB;EACrB,OAAO,KAAK,MAAM;CACtB;;CAGA,IAAI,YAA2B;EAC3B,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,cAAkC;EAClC,OAAO,KAAK,MAAM;CACtB;CAEA,cAA6B;EACzB,OAAO;GACH,IAAI,KAAK,MAAM;GACf,SAAS,KAAK,MAAM;GACpB,QAAQ,KAAK,MAAM;GACnB,WAAW,KAAK,MAAM;GACtB,GAAI,KAAK,MAAM,gBAAgB,KAAA,IACzB,EAAE,aAAa,KAAK,MAAM,YAAY,IACtC,CAAC;EACX;CACJ;AACJ"}

package/dist/ruleset-registry.cjs

@@ -1,6 +1,14 @@
 const require_domain_exception = require("./domain-exception.cjs");
 //#region src/core/domain/rulesets/ruleset-registry.ts
 var RulesetRegistryError = class extends require_domain_exception.DomainException {};
+/**
+* Runtime guard for the `RulesetId` shape (`name@major.minor`). The template
+* type only protects TypeScript callers — a JS consumer (or a cast) could
+* register `"foo"` or `"foo@1.5.2"`, and either would silently corrupt
+* {@link RulesetRegistry.getCurrent}'s version ordering via `NaN`/ignored
+* segments. Same idea as `CONTRACT_VERSION_PATTERN` in `versioning/version.ts`.
+*/
+const RULESET_ID_PATTERN = /^.+@\d+\.\d+$/;
 function parseVersion(id) {
 	const atIdx = id.lastIndexOf("@");
 	const [major, minor] = id.slice(atIdx + 1).split(".").map(Number);
@@ -13,17 +21,28 @@ var RulesetRegistry = class {
 	}
 	register(ruleset) {
 		if (this._sealed) throw new RulesetRegistryError("Registry is sealed. No new rulesets can be registered.");
+		if (!RULESET_ID_PATTERN.test(ruleset.id)) throw new RulesetRegistryError(`Invalid ruleset id "${ruleset.id}". Expected "<name>@<major>.<minor>", e.g. "order-creation@1.0".`);
 		if (this._store.has(ruleset.id)) throw new RulesetRegistryError(`Ruleset with id "${ruleset.id}" is already registered.`);
 		this._store.set(ruleset.id, ruleset);
 	}
 	seal() {
 		this._sealed = true;
 	}
+	/**
+	* Looks up a ruleset by exact id. The `T` parameter is a caller-asserted
+	* cast, not a runtime check: asking for the wrong `T` compiles and returns
+	* the object mistyped — the standard registry trade-off. Keep the id and
+	* the expected type paired at the call site.
+	*/
 	get(id) {
 		const ruleset = this._store.get(id);
 		if (!ruleset) throw new RulesetRegistryError(`Ruleset "${id}" not found. Available: [${Array.from(this._store.keys()).join(", ")}]`);
 		return ruleset;
 	}
+	/**
+	* Returns the highest `major.minor` version registered under `prefix`.
+	* The same caller-asserted `T` cast as {@link get} applies.
+	*/
 	getCurrent(prefix) {
 		const matchingEntries = Array.from(this._store.entries()).filter(([key]) => key.startsWith(prefix + "@"));
 		if (matchingEntries.length === 0) throw new RulesetRegistryError(`No rulesets found with prefix "${prefix}".`);

package/dist/ruleset-registry.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ruleset-registry.cjs","names":["DomainException"],"sources":["../src/core/domain/rulesets/ruleset-registry.ts"],"sourcesContent":["import { DomainException } from \"../../exceptions/domain-exception.js\";\nimport {\n    type Ruleset,\n    type RulesetRegistry as RulesetRegistryContract,\n} from \"./ruleset.contracts.js\";\n\nclass RulesetRegistryError extends DomainException {}\n\nfunction parseVersion(id: string): [number, number] {\n    const atIdx = id.lastIndexOf(\"@\");\n    const versionStr = id.slice(atIdx + 1);\n    const [major, minor] = versionStr.split(\".\").map(Number);\n    return [major, minor];\n}\n\nclass RulesetRegistry implements RulesetRegistryContract {\n    private readonly _store = new Map<string, Ruleset>();\n    private _sealed = false;\n\n    register(ruleset: Ruleset): void {\n        if (this._sealed) {\n            throw new RulesetRegistryError(\n                \"Registry is sealed. No new rulesets can be registered.\",\n            );\n        }\n        if (this._store.has(ruleset.id)) {\n            throw new RulesetRegistryError(\n                `Ruleset with id \"${ruleset.id}\" is already registered.`,\n            );\n        }\n        this._store.set(ruleset.id, ruleset);\n    }\n\n    seal(): void {\n        this._sealed = true;\n    }\n\n    get<T extends Ruleset>(id: string): T {\n        const ruleset = this._store.get(id);\n        if (!ruleset) {\n            const available = Array.from(this._store.keys()).join(\", \");\n            throw new RulesetRegistryError(\n                `Ruleset \"${id}\" not found. Available: [${available}]`,\n            );\n        }\n        return ruleset as T;\n    }\n\n    getCurrent<T extends Ruleset>(prefix: string): T {\n        const matchingEntries = Array.from(this._store.entries()).filter(\n            ([key]) => key.startsWith(prefix + \"@\"),\n        );\n\n        if (matchingEntries.length === 0) {\n            throw new RulesetRegistryError(\n                `No rulesets found with prefix \"${prefix}\".`,\n            );\n        }\n\n        const sorted = matchingEntries.sort(([a], [b]) => {\n            const [aMajor, aMinor] = parseVersion(a);\n            const [bMajor, bMinor] = parseVersion(b);\n            if (aMajor !== bMajor) return aMajor - bMajor;\n            return aMinor - bMinor;\n        });\n\n        return sorted[sorted.length - 1][1] as T;\n    }\n}\n\nexport { RulesetRegistry };\n"],"mappings":";;AAMA,IAAM,uBAAN,cAAmCA,yBAAAA,gBAAgB,CAAC;AAEpD,SAAS,aAAa,IAA8B;CAChD,MAAM,QAAQ,GAAG,YAAY,GAAG;CAEhC,MAAM,CAAC,OAAO,SADK,GAAG,MAAM,QAAQ,CACJ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;CACvD,OAAO,CAAC,OAAO,KAAK;AACxB;AAEA,IAAM,kBAAN,MAAyD;;gCAC3B,IAAI,IAAqB;iBACjC;;CAElB,SAAS,SAAwB;EAC7B,IAAI,KAAK,SACL,MAAM,IAAI,qBACN,wDACJ;EAEJ,IAAI,KAAK,OAAO,IAAI,QAAQ,EAAE,GAC1B,MAAM,IAAI,qBACN,oBAAoB,QAAQ,GAAG,yBACnC;EAEJ,KAAK,OAAO,IAAI,QAAQ,IAAI,OAAO;CACvC;CAEA,OAAa;EACT,KAAK,UAAU;CACnB;CAEA,IAAuB,IAAe;EAClC,MAAM,UAAU,KAAK,OAAO,IAAI,EAAE;EAClC,IAAI,CAAC,SAED,MAAM,IAAI,qBACN,YAAY,GAAG,2BAFD,MAAM,KAAK,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,IAEA,EAAE,EACxD;EAEJ,OAAO;CACX;CAEA,WAA8B,QAAmB;EAC7C,MAAM,kBAAkB,MAAM,KAAK,KAAK,OAAO,QAAQ,CAAC,EAAE,QACrD,CAAC,SAAS,IAAI,WAAW,SAAS,GAAG,CAC1C;EAEA,IAAI,gBAAgB,WAAW,GAC3B,MAAM,IAAI,qBACN,kCAAkC,OAAO,GAC7C;EAGJ,MAAM,SAAS,gBAAgB,MAAM,CAAC,IAAI,CAAC,OAAO;GAC9C,MAAM,CAAC,QAAQ,UAAU,aAAa,CAAC;GACvC,MAAM,CAAC,QAAQ,UAAU,aAAa,CAAC;GACvC,IAAI,WAAW,QAAQ,OAAO,SAAS;GACvC,OAAO,SAAS;EACpB,CAAC;EAED,OAAO,OAAO,OAAO,SAAS,GAAG;CACrC;AACJ"}
+{"version":3,"file":"ruleset-registry.cjs","names":["DomainException"],"sources":["../src/core/domain/rulesets/ruleset-registry.ts"],"sourcesContent":["import { DomainException } from \"../../exceptions/domain-exception.js\";\nimport {\n    type Ruleset,\n    type RulesetRegistry as RulesetRegistryContract,\n} from \"./ruleset.contracts.js\";\n\nclass RulesetRegistryError extends DomainException {}\n\n/**\n * Runtime guard for the `RulesetId` shape (`name@major.minor`). The template\n * type only protects TypeScript callers — a JS consumer (or a cast) could\n * register `\"foo\"` or `\"foo@1.5.2\"`, and either would silently corrupt\n * {@link RulesetRegistry.getCurrent}'s version ordering via `NaN`/ignored\n * segments. Same idea as `CONTRACT_VERSION_PATTERN` in `versioning/version.ts`.\n */\nconst RULESET_ID_PATTERN = /^.+@\\d+\\.\\d+$/;\n\nfunction parseVersion(id: string): [number, number] {\n    const atIdx = id.lastIndexOf(\"@\");\n    const versionStr = id.slice(atIdx + 1);\n    const [major, minor] = versionStr.split(\".\").map(Number);\n    return [major, minor];\n}\n\nclass RulesetRegistry implements RulesetRegistryContract {\n    private readonly _store = new Map<string, Ruleset>();\n    private _sealed = false;\n\n    register(ruleset: Ruleset): void {\n        if (this._sealed) {\n            throw new RulesetRegistryError(\n                \"Registry is sealed. No new rulesets can be registered.\",\n            );\n        }\n        if (!RULESET_ID_PATTERN.test(ruleset.id)) {\n            throw new RulesetRegistryError(\n                `Invalid ruleset id \"${ruleset.id}\". Expected \"<name>@<major>.<minor>\", e.g. \"order-creation@1.0\".`,\n            );\n        }\n        if (this._store.has(ruleset.id)) {\n            throw new RulesetRegistryError(\n                `Ruleset with id \"${ruleset.id}\" is already registered.`,\n            );\n        }\n        this._store.set(ruleset.id, ruleset);\n    }\n\n    seal(): void {\n        this._sealed = true;\n    }\n\n    /**\n     * Looks up a ruleset by exact id. The `T` parameter is a caller-asserted\n     * cast, not a runtime check: asking for the wrong `T` compiles and returns\n     * the object mistyped — the standard registry trade-off. Keep the id and\n     * the expected type paired at the call site.\n     */\n    get<T extends Ruleset>(id: string): T {\n        const ruleset = this._store.get(id);\n        if (!ruleset) {\n            const available = Array.from(this._store.keys()).join(\", \");\n            throw new RulesetRegistryError(\n                `Ruleset \"${id}\" not found. Available: [${available}]`,\n            );\n        }\n        return ruleset as T;\n    }\n\n    /**\n     * Returns the highest `major.minor` version registered under `prefix`.\n     * The same caller-asserted `T` cast as {@link get} applies.\n     */\n    getCurrent<T extends Ruleset>(prefix: string): T {\n        const matchingEntries = Array.from(this._store.entries()).filter(\n            ([key]) => key.startsWith(prefix + \"@\"),\n        );\n\n        if (matchingEntries.length === 0) {\n            throw new RulesetRegistryError(\n                `No rulesets found with prefix \"${prefix}\".`,\n            );\n        }\n\n        const sorted = matchingEntries.sort(([a], [b]) => {\n            const [aMajor, aMinor] = parseVersion(a);\n            const [bMajor, bMinor] = parseVersion(b);\n            if (aMajor !== bMajor) return aMajor - bMajor;\n            return aMinor - bMinor;\n        });\n\n        return sorted[sorted.length - 1][1] as T;\n    }\n}\n\nexport { RulesetRegistry };\n"],"mappings":";;AAMA,IAAM,uBAAN,cAAmCA,yBAAAA,gBAAgB,CAAC;;;;;;;;AASpD,MAAM,qBAAqB;AAE3B,SAAS,aAAa,IAA8B;CAChD,MAAM,QAAQ,GAAG,YAAY,GAAG;CAEhC,MAAM,CAAC,OAAO,SADK,GAAG,MAAM,QAAQ,CACJ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;CACvD,OAAO,CAAC,OAAO,KAAK;AACxB;AAEA,IAAM,kBAAN,MAAyD;;gCAC3B,IAAI,IAAqB;iBACjC;;CAElB,SAAS,SAAwB;EAC7B,IAAI,KAAK,SACL,MAAM,IAAI,qBACN,wDACJ;EAEJ,IAAI,CAAC,mBAAmB,KAAK,QAAQ,EAAE,GACnC,MAAM,IAAI,qBACN,uBAAuB,QAAQ,GAAG,iEACtC;EAEJ,IAAI,KAAK,OAAO,IAAI,QAAQ,EAAE,GAC1B,MAAM,IAAI,qBACN,oBAAoB,QAAQ,GAAG,yBACnC;EAEJ,KAAK,OAAO,IAAI,QAAQ,IAAI,OAAO;CACvC;CAEA,OAAa;EACT,KAAK,UAAU;CACnB;;;;;;;CAQA,IAAuB,IAAe;EAClC,MAAM,UAAU,KAAK,OAAO,IAAI,EAAE;EAClC,IAAI,CAAC,SAED,MAAM,IAAI,qBACN,YAAY,GAAG,2BAFD,MAAM,KAAK,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,IAEA,EAAE,EACxD;EAEJ,OAAO;CACX;;;;;CAMA,WAA8B,QAAmB;EAC7C,MAAM,kBAAkB,MAAM,KAAK,KAAK,OAAO,QAAQ,CAAC,EAAE,QACrD,CAAC,SAAS,IAAI,WAAW,SAAS,GAAG,CAC1C;EAEA,IAAI,gBAAgB,WAAW,GAC3B,MAAM,IAAI,qBACN,kCAAkC,OAAO,GAC7C;EAGJ,MAAM,SAAS,gBAAgB,MAAM,CAAC,IAAI,CAAC,OAAO;GAC9C,MAAM,CAAC,QAAQ,UAAU,aAAa,CAAC;GACvC,MAAM,CAAC,QAAQ,UAAU,aAAa,CAAC;GACvC,IAAI,WAAW,QAAQ,OAAO,SAAS;GACvC,OAAO,SAAS;EACpB,CAAC;EAED,OAAO,OAAO,OAAO,SAAS,GAAG;CACrC;AACJ"}

package/dist/ruleset-registry.js

@@ -1,6 +1,14 @@
 import { t as DomainException } from "./domain-exception.js";
 //#region src/core/domain/rulesets/ruleset-registry.ts
 var RulesetRegistryError = class extends DomainException {};
+/**
+* Runtime guard for the `RulesetId` shape (`name@major.minor`). The template
+* type only protects TypeScript callers — a JS consumer (or a cast) could
+* register `"foo"` or `"foo@1.5.2"`, and either would silently corrupt
+* {@link RulesetRegistry.getCurrent}'s version ordering via `NaN`/ignored
+* segments. Same idea as `CONTRACT_VERSION_PATTERN` in `versioning/version.ts`.
+*/
+const RULESET_ID_PATTERN = /^.+@\d+\.\d+$/;
 function parseVersion(id) {
 	const atIdx = id.lastIndexOf("@");
 	const [major, minor] = id.slice(atIdx + 1).split(".").map(Number);
@@ -13,17 +21,28 @@ var RulesetRegistry = class {
 	}
 	register(ruleset) {
 		if (this._sealed) throw new RulesetRegistryError("Registry is sealed. No new rulesets can be registered.");
+		if (!RULESET_ID_PATTERN.test(ruleset.id)) throw new RulesetRegistryError(`Invalid ruleset id "${ruleset.id}". Expected "<name>@<major>.<minor>", e.g. "order-creation@1.0".`);
 		if (this._store.has(ruleset.id)) throw new RulesetRegistryError(`Ruleset with id "${ruleset.id}" is already registered.`);
 		this._store.set(ruleset.id, ruleset);
 	}
 	seal() {
 		this._sealed = true;
 	}
+	/**
+	* Looks up a ruleset by exact id. The `T` parameter is a caller-asserted
+	* cast, not a runtime check: asking for the wrong `T` compiles and returns
+	* the object mistyped — the standard registry trade-off. Keep the id and
+	* the expected type paired at the call site.
+	*/
 	get(id) {
 		const ruleset = this._store.get(id);
 		if (!ruleset) throw new RulesetRegistryError(`Ruleset "${id}" not found. Available: [${Array.from(this._store.keys()).join(", ")}]`);
 		return ruleset;
 	}
+	/**
+	* Returns the highest `major.minor` version registered under `prefix`.
+	* The same caller-asserted `T` cast as {@link get} applies.
+	*/
 	getCurrent(prefix) {
 		const matchingEntries = Array.from(this._store.entries()).filter(([key]) => key.startsWith(prefix + "@"));
 		if (matchingEntries.length === 0) throw new RulesetRegistryError(`No rulesets found with prefix "${prefix}".`);