toride 0.0.1 → 0.2.0

package/dist/chunk-24PMDTLE.js

@@ -0,0 +1,2366 @@
+// src/policy/schema.ts
+import * as v from "valibot";
+var AttributeTypeSchema = v.picklist(["string", "number", "boolean"]);
+var ActorDeclarationSchema = v.object({
+  attributes: v.record(v.string(), AttributeTypeSchema)
+});
+var ConditionOperatorSchema = v.union([
+  v.object({ eq: v.unknown() }),
+  v.object({ neq: v.unknown() }),
+  v.object({ gt: v.unknown() }),
+  v.object({ gte: v.unknown() }),
+  v.object({ lt: v.unknown() }),
+  v.object({ lte: v.unknown() }),
+  v.object({ in: v.union([v.array(v.unknown()), v.string()]) }),
+  v.object({ includes: v.unknown() }),
+  v.object({ exists: v.boolean() }),
+  v.object({ startsWith: v.string() }),
+  v.object({ endsWith: v.string() }),
+  v.object({ contains: v.string() }),
+  v.object({ custom: v.string() })
+]);
+var ConditionValueSchema = v.union([
+  v.string(),
+  v.number(),
+  v.boolean(),
+  ConditionOperatorSchema
+]);
+var SimpleConditionsSchema = v.record(v.string(), ConditionValueSchema);
+var ConditionExpressionSchema = v.union([
+  v.object({ any: v.array(v.lazy(() => ConditionExpressionSchema)) }),
+  v.object({ all: v.array(v.lazy(() => ConditionExpressionSchema)) }),
+  SimpleConditionsSchema
+]);
+var RelationDefSchema = v.string();
+var DerivedRoleEntrySchema = v.object({
+  role: v.string(),
+  from_global_role: v.optional(v.string()),
+  from_role: v.optional(v.string()),
+  on_relation: v.optional(v.string()),
+  from_relation: v.optional(v.string()),
+  actor_type: v.optional(v.string()),
+  when: v.optional(ConditionExpressionSchema)
+});
+var RuleSchema = v.object({
+  effect: v.picklist(["permit", "forbid"]),
+  roles: v.optional(v.array(v.string())),
+  permissions: v.array(v.string()),
+  when: ConditionExpressionSchema
+});
+var FieldAccessDefSchema = v.object({
+  read: v.optional(v.array(v.string())),
+  update: v.optional(v.array(v.string()))
+});
+var ResourceBlockSchema = v.object({
+  roles: v.array(v.string()),
+  permissions: v.array(v.string()),
+  attributes: v.optional(v.record(v.string(), AttributeTypeSchema)),
+  relations: v.optional(v.record(v.string(), v.string())),
+  grants: v.optional(v.record(v.string(), v.array(v.string()))),
+  derived_roles: v.optional(v.array(DerivedRoleEntrySchema)),
+  rules: v.optional(v.array(RuleSchema)),
+  field_access: v.optional(v.record(v.string(), FieldAccessDefSchema))
+});
+var GlobalRoleSchema = v.object({
+  actor_type: v.string(),
+  when: ConditionExpressionSchema
+});
+var ResourceRefSchema = v.object({
+  type: v.string(),
+  id: v.string(),
+  attributes: v.optional(v.record(v.string(), v.unknown()))
+});
+var ActorRefSchema = v.object({
+  type: v.string(),
+  id: v.string(),
+  attributes: v.record(v.string(), v.unknown())
+});
+var TestCaseSchema = v.object({
+  name: v.string(),
+  actor: ActorRefSchema,
+  resolvers: v.optional(v.record(v.string(), v.record(v.string(), v.unknown()))),
+  action: v.string(),
+  resource: ResourceRefSchema,
+  expected: v.picklist(["allow", "deny"])
+});
+var PolicySchema = v.object({
+  version: v.literal("1"),
+  actors: v.record(v.string(), ActorDeclarationSchema),
+  global_roles: v.optional(v.record(v.string(), GlobalRoleSchema)),
+  resources: v.record(v.string(), ResourceBlockSchema),
+  tests: v.optional(v.array(TestCaseSchema))
+});
+var TestFileSchema = v.object({
+  policy: v.string(),
+  tests: v.array(TestCaseSchema)
+});
+
+// src/types.ts
+var ValidationError = class extends Error {
+  path;
+  constructor(message, path) {
+    super(message);
+    this.name = "ValidationError";
+    this.path = path;
+  }
+};
+var CycleError = class extends Error {
+  path;
+  constructor(message, path) {
+    super(message);
+    this.name = "CycleError";
+    this.path = path;
+  }
+};
+var DepthLimitError = class extends Error {
+  limit;
+  limitType;
+  constructor(message, limit, limitType) {
+    super(message);
+    this.name = "DepthLimitError";
+    this.limit = limit;
+    this.limitType = limitType;
+  }
+};
+
+// src/policy/validator.ts
+function extractActorAttributes(condition) {
+  const attrs = [];
+  if ("any" in condition && Array.isArray(condition.any)) {
+    for (const sub of condition.any) {
+      attrs.push(...extractActorAttributes(sub));
+    }
+    return attrs;
+  }
+  if ("all" in condition && Array.isArray(condition.all)) {
+    for (const sub of condition.all) {
+      attrs.push(...extractActorAttributes(sub));
+    }
+    return attrs;
+  }
+  for (const key of Object.keys(condition)) {
+    if (key.startsWith("$actor.")) {
+      const attrName = key.slice("$actor.".length);
+      const topLevel = attrName.split(".")[0];
+      attrs.push(topLevel);
+    }
+  }
+  return attrs;
+}
+function validateActorAttributeRefs(condition, actorTypes, path, errors) {
+  const referencedAttrs = extractActorAttributes(condition);
+  if (referencedAttrs.length === 0) return;
+  for (const attr of referencedAttrs) {
+    for (const [typeName, decl] of actorTypes) {
+      if (!(attr in decl.attributes)) {
+        errors.push({
+          message: `${path} references $actor.${attr} which is not declared in actor type "${typeName}"`,
+          path
+        });
+      }
+    }
+  }
+}
+function collectErrors(policy) {
+  const errors = [];
+  const declaredActorTypes = new Set(Object.keys(policy.actors));
+  const declaredGlobalRoles = new Set(
+    policy.global_roles ? Object.keys(policy.global_roles) : []
+  );
+  const declaredResourceTypes = new Set(Object.keys(policy.resources));
+  if (policy.global_roles) {
+    for (const [roleName, globalRole] of Object.entries(policy.global_roles)) {
+      if (!declaredActorTypes.has(globalRole.actor_type)) {
+        errors.push({
+          message: `global_roles.${roleName}.actor_type references undeclared actor type "${globalRole.actor_type}"`,
+          path: `global_roles.${roleName}.actor_type`
+        });
+      } else {
+        const actorDecl = policy.actors[globalRole.actor_type];
+        validateActorAttributeRefs(
+          globalRole.when,
+          /* @__PURE__ */ new Map([[globalRole.actor_type, actorDecl]]),
+          `global_roles.${roleName}.when`,
+          errors
+        );
+      }
+    }
+  }
+  for (const [resName, resource] of Object.entries(policy.resources)) {
+    const declaredRoles = new Set(resource.roles);
+    const declaredPermissions = new Set(resource.permissions);
+    const declaredRelations = new Set(
+      resource.relations ? Object.keys(resource.relations) : []
+    );
+    if (resource.relations) {
+      for (const [relName, relDef] of Object.entries(resource.relations)) {
+        if (!declaredResourceTypes.has(relDef) && !declaredActorTypes.has(relDef)) {
+          errors.push({
+            message: `resources.${resName}.relations.${relName} references undeclared resource type "${relDef}"`,
+            path: `resources.${resName}.relations.${relName}`
+          });
+        }
+      }
+    }
+    if (resource.grants) {
+      for (const [roleName, permissions] of Object.entries(resource.grants)) {
+        if (!declaredRoles.has(roleName)) {
+          errors.push({
+            message: `resources.${resName}.grants references undeclared role "${roleName}"`,
+            path: `resources.${resName}.grants.${roleName}`
+          });
+        }
+        for (const perm of permissions) {
+          if (perm !== "all" && !declaredPermissions.has(perm)) {
+            errors.push({
+              message: `resources.${resName}.grants.${roleName} references undeclared permission "${perm}"`,
+              path: `resources.${resName}.grants.${roleName}`
+            });
+          }
+        }
+      }
+    }
+    if (resource.derived_roles) {
+      for (let i = 0; i < resource.derived_roles.length; i++) {
+        const entry = resource.derived_roles[i];
+        const path = `resources.${resName}.derived_roles[${i}]`;
+        if (!declaredRoles.has(entry.role)) {
+          errors.push({
+            message: `${path} references undeclared role "${entry.role}"`,
+            path
+          });
+        }
+        const patternErrors = validateDerivedRolePatternsCollect(entry, path);
+        errors.push(...patternErrors);
+        if (entry.from_global_role !== void 0) {
+          if (!declaredGlobalRoles.has(entry.from_global_role)) {
+            errors.push({
+              message: `${path} references undeclared global role "${entry.from_global_role}"`,
+              path
+            });
+          }
+        }
+        if (entry.on_relation !== void 0) {
+          if (!declaredRelations.has(entry.on_relation)) {
+            errors.push({
+              message: `${path} references undeclared relation "${entry.on_relation}"`,
+              path
+            });
+          }
+        }
+        if (entry.from_relation !== void 0) {
+          if (!declaredRelations.has(entry.from_relation)) {
+            errors.push({
+              message: `${path} references undeclared relation "${entry.from_relation}"`,
+              path
+            });
+          }
+        }
+        if (entry.actor_type !== void 0) {
+          if (!declaredActorTypes.has(entry.actor_type)) {
+            errors.push({
+              message: `${path} references undeclared actor type "${entry.actor_type}"`,
+              path
+            });
+          }
+        }
+        if (entry.when) {
+          if (entry.actor_type && declaredActorTypes.has(entry.actor_type)) {
+            const actorDecl = policy.actors[entry.actor_type];
+            validateActorAttributeRefs(
+              entry.when,
+              /* @__PURE__ */ new Map([[entry.actor_type, actorDecl]]),
+              `${path}.when`,
+              errors
+            );
+          } else if (!entry.actor_type) {
+            const allActors = new Map(
+              Object.entries(policy.actors)
+            );
+            validateActorAttributeRefs(
+              entry.when,
+              allActors,
+              `${path}.when`,
+              errors
+            );
+          }
+        }
+      }
+    }
+    if (resource.rules) {
+      for (let i = 0; i < resource.rules.length; i++) {
+        const rule = resource.rules[i];
+        const path = `resources.${resName}.rules[${i}]`;
+        for (const perm of rule.permissions) {
+          if (!declaredPermissions.has(perm)) {
+            errors.push({
+              message: `${path}.permissions references undeclared permission "${perm}"`,
+              path: `${path}.permissions`
+            });
+          }
+        }
+        if (rule.roles) {
+          for (const roleName of rule.roles) {
+            if (!declaredRoles.has(roleName)) {
+              errors.push({
+                message: `${path}.roles references undeclared role "${roleName}"`,
+                path: `${path}.roles`
+              });
+            }
+          }
+        }
+        const allActors = new Map(Object.entries(policy.actors));
+        validateActorAttributeRefs(
+          rule.when,
+          allActors,
+          `${path}.when`,
+          errors
+        );
+      }
+    }
+    if (resource.field_access) {
+      for (const [fieldName, fieldDef] of Object.entries(
+        resource.field_access
+      )) {
+        const fpath = `resources.${resName}.field_access.${fieldName}`;
+        if (fieldDef.read) {
+          for (const roleName of fieldDef.read) {
+            if (!declaredRoles.has(roleName)) {
+              errors.push({
+                message: `${fpath}.read references undeclared role "${roleName}"`,
+                path: `${fpath}.read`
+              });
+            }
+          }
+        }
+        if (fieldDef.update) {
+          for (const roleName of fieldDef.update) {
+            if (!declaredRoles.has(roleName)) {
+              errors.push({
+                message: `${fpath}.update references undeclared role "${roleName}"`,
+                path: `${fpath}.update`
+              });
+            }
+          }
+        }
+      }
+    }
+  }
+  return errors;
+}
+function validateDerivedRolePatternsCollect(entry, path) {
+  const errors = [];
+  const hasGlobal = entry.from_global_role !== void 0;
+  const hasFromRole = entry.from_role !== void 0;
+  const hasOnRelation = entry.on_relation !== void 0;
+  const hasFromRelation = entry.from_relation !== void 0;
+  const hasActorType = entry.actor_type !== void 0;
+  const hasWhen = entry.when !== void 0;
+  if (hasFromRole !== hasOnRelation) {
+    errors.push({
+      message: `${path}: from_role and on_relation must be specified together`,
+      path
+    });
+    return errors;
+  }
+  const patternCount = [
+    hasGlobal,
+    hasFromRole && hasOnRelation,
+    hasFromRelation
+  ].filter(Boolean).length;
+  if (patternCount > 1) {
+    errors.push({
+      message: `${path}: derived role entry specifies conflicting derivation patterns`,
+      path
+    });
+    return errors;
+  }
+  if (patternCount === 1) {
+    if (hasGlobal && (hasActorType || hasWhen || hasFromRelation || hasFromRole)) {
+      errors.push({
+        message: `${path}: from_global_role cannot be combined with other derivation fields`,
+        path
+      });
+    }
+    if (hasFromRelation && (hasActorType || hasWhen || hasGlobal || hasFromRole)) {
+      errors.push({
+        message: `${path}: from_relation cannot be combined with other derivation fields`,
+        path
+      });
+    }
+    return errors;
+  }
+  if (!hasWhen && !hasActorType) {
+    errors.push({
+      message: `${path}: derived role entry must specify a derivation pattern (from_global_role, from_role+on_relation, from_relation, or when)`,
+      path
+    });
+  }
+  return errors;
+}
+function collectWarnings(policy) {
+  const warnings = [];
+  for (const [resName, resource] of Object.entries(policy.resources)) {
+    const declaredRoles = new Set(resource.roles);
+    const usedRoles = /* @__PURE__ */ new Set();
+    if (resource.grants) {
+      for (const roleName of Object.keys(resource.grants)) {
+        usedRoles.add(roleName);
+      }
+    }
+    if (resource.derived_roles) {
+      for (const entry of resource.derived_roles) {
+        usedRoles.add(entry.role);
+      }
+    }
+    if (resource.rules) {
+      for (const rule of resource.rules) {
+        if (rule.roles) {
+          for (const roleName of rule.roles) {
+            usedRoles.add(roleName);
+          }
+        }
+      }
+    }
+    if (resource.field_access) {
+      for (const fieldDef of Object.values(resource.field_access)) {
+        if (fieldDef.read) {
+          for (const roleName of fieldDef.read) {
+            usedRoles.add(roleName);
+          }
+        }
+        if (fieldDef.update) {
+          for (const roleName of fieldDef.update) {
+            usedRoles.add(roleName);
+          }
+        }
+      }
+    }
+    for (const role of declaredRoles) {
+      if (!usedRoles.has(role)) {
+        warnings.push({
+          message: `resources.${resName}.roles includes "${role}" which is never used in grants, derived_roles, rules, or field_access`,
+          path: `resources.${resName}.roles`
+        });
+      }
+    }
+    if (resource.rules && resource.grants) {
+      const grantedPermissions = /* @__PURE__ */ new Set();
+      for (const perms of Object.values(resource.grants)) {
+        for (const perm of perms) {
+          if (perm === "all") {
+            for (const p of resource.permissions) {
+              grantedPermissions.add(p);
+            }
+          } else {
+            grantedPermissions.add(perm);
+          }
+        }
+      }
+      for (let i = 0; i < resource.rules.length; i++) {
+        const rule = resource.rules[i];
+        const path = `resources.${resName}.rules[${i}]`;
+        if (rule.effect === "forbid") {
+          const unreachablePerms = rule.permissions.filter(
+            (p) => !grantedPermissions.has(p)
+          );
+          if (unreachablePerms.length === rule.permissions.length) {
+            warnings.push({
+              message: `${path} is unreachable: none of its permissions [${unreachablePerms.join(", ")}] are granted to any role`,
+              path
+            });
+          }
+        }
+      }
+    }
+    if (resource.derived_roles && resource.derived_roles.length > 1) {
+      const seen = /* @__PURE__ */ new Set();
+      for (let i = 0; i < resource.derived_roles.length; i++) {
+        const entry = resource.derived_roles[i];
+        const key = JSON.stringify({
+          role: entry.role,
+          from_global_role: entry.from_global_role,
+          from_role: entry.from_role,
+          on_relation: entry.on_relation,
+          from_relation: entry.from_relation,
+          actor_type: entry.actor_type,
+          when: entry.when
+        });
+        if (seen.has(key)) {
+          warnings.push({
+            message: `resources.${resName}.derived_roles[${i}] is a duplicate (redundant) derivation entry`,
+            path: `resources.${resName}.derived_roles[${i}]`
+          });
+        } else {
+          seen.add(key);
+        }
+      }
+    }
+  }
+  return warnings;
+}
+function validatePolicy(policy) {
+  const errors = collectErrors(policy);
+  if (errors.length > 0) {
+    const messages = errors.map((e) => e.message);
+    const firstError = errors[0];
+    throw new ValidationError(
+      messages.length === 1 ? messages[0] : messages.join("; "),
+      firstError.path
+    );
+  }
+}
+function validatePolicyResult(policy) {
+  return { errors: collectErrors(policy) };
+}
+function validatePolicyStrict(policy) {
+  const errors = collectErrors(policy);
+  const warnings = collectWarnings(policy);
+  return { errors, warnings };
+}
+
+// src/testing/test-parser.ts
+import * as YAML from "yaml";
+import * as v2 from "valibot";
+function parseInlineTests(policy) {
+  return {
+    policy,
+    tests: policy.tests ?? []
+  };
+}
+function parseTestFile(yamlContent) {
+  let raw;
+  try {
+    raw = YAML.parse(yamlContent, { prettyErrors: true });
+  } catch (err) {
+    throw new Error(
+      `YAML parse error: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const result = v2.safeParse(TestFileSchema, raw);
+  if (!result.success) {
+    const issue = result.issues[0];
+    const path = issue?.path?.map((p) => String(p.key)).join(".") ?? "";
+    throw new Error(
+      `Test file validation failed: ${issue?.message ?? "unknown error"}${path ? ` at ${path}` : ""}`
+    );
+  }
+  return {
+    policyPath: result.output.policy,
+    tests: result.output.tests
+  };
+}
+
+// src/evaluation/condition.ts
+var DEFAULT_MAX_CONDITION_DEPTH = 3;
+var DEFAULT_MAX_COMBINATOR_DEPTH = 10;
+var OPERATOR_KEYS = /* @__PURE__ */ new Set([
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "includes",
+  "exists",
+  "startsWith",
+  "endsWith",
+  "contains",
+  "custom"
+]);
+var UNDEFINED_SENTINEL = /* @__PURE__ */ Symbol("UNDEFINED");
+async function evaluateCondition(condition, actor, resource, cache, env, resourceBlock, policy, options, combinatorDepth = 0) {
+  const maxDepth = options?.maxConditionDepth ?? DEFAULT_MAX_CONDITION_DEPTH;
+  const maxCombinatorDepth = options?.maxCombinatorDepth ?? DEFAULT_MAX_COMBINATOR_DEPTH;
+  if ("any" in condition && Array.isArray(condition.any)) {
+    if (combinatorDepth >= maxCombinatorDepth) {
+      return false;
+    }
+    const items = condition.any;
+    for (const item of items) {
+      if (await evaluateCondition(item, actor, resource, cache, env, resourceBlock, policy, options, combinatorDepth + 1)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  if ("all" in condition && Array.isArray(condition.all)) {
+    if (combinatorDepth >= maxCombinatorDepth) {
+      return false;
+    }
+    const items = condition.all;
+    for (const item of items) {
+      if (!await evaluateCondition(item, actor, resource, cache, env, resourceBlock, policy, options, combinatorDepth + 1)) {
+        return false;
+      }
+    }
+    return true;
+  }
+  const entries = Object.entries(condition);
+  for (const [key, conditionValue] of entries) {
+    const matched = await evaluatePair(
+      key,
+      conditionValue,
+      actor,
+      resource,
+      cache,
+      env,
+      resourceBlock,
+      policy,
+      maxDepth,
+      options
+    );
+    if (!matched) return false;
+  }
+  return true;
+}
+async function evaluatePair(key, conditionValue, actor, resource, cache, env, resourceBlock, policy, maxDepth, options) {
+  const leftValue = await resolveValue(
+    key,
+    actor,
+    resource,
+    cache,
+    env,
+    resourceBlock,
+    policy,
+    maxDepth
+  );
+  if (isOperator(conditionValue)) {
+    return evaluateOperator(
+      leftValue,
+      conditionValue,
+      actor,
+      resource,
+      cache,
+      env,
+      resourceBlock,
+      policy,
+      maxDepth,
+      options
+    );
+  }
+  const rightValue = await resolveRightValue(
+    conditionValue,
+    actor,
+    resource,
+    cache,
+    env,
+    resourceBlock,
+    policy,
+    maxDepth
+  );
+  if (Array.isArray(leftValue)) {
+    if (rightValue === UNDEFINED_SENTINEL || rightValue === null || rightValue === void 0) {
+      return false;
+    }
+    return leftValue.some((v3) => {
+      if (v3 === UNDEFINED_SENTINEL || v3 === null || v3 === void 0) return false;
+      return v3 === rightValue;
+    });
+  }
+  if (leftValue === UNDEFINED_SENTINEL || leftValue === null || leftValue === void 0) {
+    return false;
+  }
+  if (rightValue === UNDEFINED_SENTINEL || rightValue === null || rightValue === void 0) {
+    return false;
+  }
+  return leftValue === rightValue;
+}
+async function resolveValue(path, actor, resource, cache, env, resourceBlock, policy, maxDepth) {
+  if (path.startsWith("$actor.")) {
+    const attrPath = path.slice(7);
+    return getNestedAttribute(actor.attributes, attrPath);
+  }
+  if (path.startsWith("$resource.")) {
+    const attrPath = path.slice(10);
+    return resolveResourcePath(
+      attrPath,
+      resource,
+      cache,
+      resourceBlock,
+      policy,
+      maxDepth
+    );
+  }
+  if (path.startsWith("$env.")) {
+    const attrName = path.slice(5);
+    const val = env[attrName];
+    return val === void 0 ? UNDEFINED_SENTINEL : val;
+  }
+  return UNDEFINED_SENTINEL;
+}
+function isResourceRef(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.type === "string" && typeof obj.id === "string";
+}
+async function resolveResourcePath(path, resource, cache, resourceBlock, policy, depthRemaining) {
+  const parts = path.split(".");
+  if (parts.length === 1) {
+    try {
+      const attrs = await cache.resolve(resource, resourceBlock);
+      const val = attrs[parts[0]];
+      return val === void 0 ? UNDEFINED_SENTINEL : val;
+    } catch {
+      return UNDEFINED_SENTINEL;
+    }
+  }
+  if (depthRemaining <= 0) {
+    return UNDEFINED_SENTINEL;
+  }
+  const relationName = parts[0];
+  const remainingPath = parts.slice(1).join(".");
+  const relationDef = resourceBlock.relations?.[relationName];
+  if (!relationDef) {
+    try {
+      const attrs = await cache.resolve(resource, resourceBlock);
+      const val = getNestedAttribute(attrs, path);
+      return val;
+    } catch {
+      return UNDEFINED_SENTINEL;
+    }
+  }
+  try {
+    const attrs = await cache.resolve(resource, resourceBlock);
+    const relValue = attrs[relationName];
+    if (relValue === null || relValue === void 0) {
+      return UNDEFINED_SENTINEL;
+    }
+    if (Array.isArray(relValue)) {
+      const results = [];
+      for (const item of relValue) {
+        if (!isResourceRef(item)) continue;
+        const relatedRef = item;
+        const relatedBlock = policy.resources[relatedRef.type] ?? {
+          roles: [],
+          permissions: []
+        };
+        const val = await resolveResourcePath(
+          remainingPath,
+          relatedRef,
+          cache,
+          relatedBlock,
+          policy,
+          depthRemaining - 1
+        );
+        results.push(val);
+      }
+      return results.length > 0 ? results : UNDEFINED_SENTINEL;
+    }
+    if (isResourceRef(relValue)) {
+      const relatedRef = relValue;
+      const relatedBlock = policy.resources[relatedRef.type] ?? {
+        roles: [],
+        permissions: []
+      };
+      return resolveResourcePath(
+        remainingPath,
+        relatedRef,
+        cache,
+        relatedBlock,
+        policy,
+        depthRemaining - 1
+      );
+    }
+    if (typeof relValue === "object") {
+      const val = getNestedAttribute(relValue, remainingPath);
+      return val;
+    }
+    return UNDEFINED_SENTINEL;
+  } catch {
+    return UNDEFINED_SENTINEL;
+  }
+}
+var FORBIDDEN_PROPS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function getNestedAttribute(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (FORBIDDEN_PROPS.has(part)) return UNDEFINED_SENTINEL;
+    if (current === null || current === void 0 || typeof current !== "object") {
+      return UNDEFINED_SENTINEL;
+    }
+    current = current[part];
+  }
+  return current === void 0 ? UNDEFINED_SENTINEL : current;
+}
+async function resolveRightValue(value, actor, resource, cache, env, resourceBlock, policy, maxDepth) {
+  if (typeof value === "string" && isCrossReference(value)) {
+    return resolveValue(value, actor, resource, cache, env, resourceBlock, policy, maxDepth);
+  }
+  return value;
+}
+function isCrossReference(value) {
+  return value.startsWith("$actor.") || value.startsWith("$resource.") || value.startsWith("$env.");
+}
+function isOperator(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const keys = Object.keys(value);
+  return keys.length === 1 && OPERATOR_KEYS.has(keys[0]);
+}
+async function evaluateOperator(leftValue, operator, actor, resource, cache, env, resourceBlock, policy, maxDepth, options) {
+  const op = operator;
+  const opKey = Object.keys(op)[0];
+  const opValue = op[opKey];
+  if (opKey === "custom") {
+    return evaluateCustom(
+      opValue,
+      actor,
+      resource,
+      env,
+      options
+    );
+  }
+  if (opKey === "exists") {
+    const exists = leftValue !== UNDEFINED_SENTINEL && leftValue !== void 0 && leftValue !== null;
+    return opValue === true ? exists : !exists;
+  }
+  const rightValue = await resolveRightValue(
+    opValue,
+    actor,
+    resource,
+    cache,
+    env,
+    resourceBlock,
+    policy,
+    maxDepth
+  );
+  if (Array.isArray(leftValue)) {
+    return evaluateAnySemantics(leftValue, opKey, rightValue);
+  }
+  if (leftValue === UNDEFINED_SENTINEL || leftValue === null || leftValue === void 0) {
+    return false;
+  }
+  return evaluateOperatorPrimitive(leftValue, opKey, rightValue);
+}
+function evaluateAnySemantics(values, opKey, rightValue) {
+  if (opKey === "includes") {
+    return values.some((v3) => v3 === rightValue);
+  }
+  return values.some((v3) => {
+    if (v3 === UNDEFINED_SENTINEL || v3 === null || v3 === void 0) return false;
+    return evaluateOperatorPrimitive(v3, opKey, rightValue);
+  });
+}
+function evaluateOperatorPrimitive(left, opKey, right) {
+  switch (opKey) {
+    case "eq":
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      return left === right;
+    case "neq":
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      return left !== right;
+    case "gt":
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      return left > right;
+    case "gte":
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      return left >= right;
+    case "lt":
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      return left < right;
+    case "lte":
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      return left <= right;
+    case "in": {
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      if (Array.isArray(right)) {
+        return right.includes(left);
+      }
+      return false;
+    }
+    case "includes": {
+      if (right === UNDEFINED_SENTINEL || right === null || right === void 0) return false;
+      if (Array.isArray(left)) {
+        return left.includes(right);
+      }
+      return false;
+    }
+    case "startsWith":
+      if (typeof left !== "string" || typeof right !== "string") return false;
+      return left.startsWith(right);
+    case "endsWith":
+      if (typeof left !== "string" || typeof right !== "string") return false;
+      return left.endsWith(right);
+    case "contains":
+      if (typeof left !== "string" || typeof right !== "string") return false;
+      return left.includes(right);
+    default:
+      return false;
+  }
+}
+async function evaluateCustom(evaluatorName, actor, resource, env, options) {
+  const evaluator = options?.customEvaluators?.[evaluatorName];
+  if (!evaluator) {
+    return options?.ruleEffect === "forbid";
+  }
+  try {
+    return await evaluator(actor, resource, env);
+  } catch {
+    return options?.ruleEffect === "forbid";
+  }
+}
+
+// src/evaluation/role-resolver.ts
+var DEFAULT_MAX_DERIVED_ROLE_DEPTH = 5;
+async function resolveRoles(actor, resource, cache, resourceBlock, policy, options) {
+  const maxDepth = options?.maxDerivedRoleDepth ?? DEFAULT_MAX_DERIVED_ROLE_DEPTH;
+  const direct = [];
+  const derived = [];
+  const derivedEntries = resourceBlock.derived_roles ?? [];
+  const visited = /* @__PURE__ */ new Set();
+  visited.add(`${resource.type}:${resource.id}`);
+  for (const entry of derivedEntries) {
+    try {
+      const traces = await evaluateDerivedRole(
+        entry,
+        actor,
+        resource,
+        cache,
+        resourceBlock,
+        policy,
+        maxDepth,
+        maxDepth,
+        visited
+      );
+      derived.push(...traces);
+    } catch (e) {
+      if (e instanceof CycleError || e instanceof DepthLimitError) {
+        throw e;
+      }
+    }
+  }
+  return { direct, derived };
+}
+async function evaluateDerivedRole(entry, actor, resource, cache, resourceBlock, policy, depthRemaining, maxDepth, visited) {
+  if (entry.from_global_role !== void 0) {
+    return evaluateGlobalRole(entry, actor, policy);
+  }
+  if (entry.from_role !== void 0 && entry.on_relation !== void 0) {
+    return evaluateRelationRole(
+      entry,
+      actor,
+      resource,
+      cache,
+      policy,
+      depthRemaining,
+      maxDepth,
+      visited
+    );
+  }
+  if (entry.from_relation !== void 0) {
+    return evaluateRelationIdentity(entry, actor, resource, cache);
+  }
+  if (entry.actor_type !== void 0 && entry.when !== void 0) {
+    return evaluateActorTypeCondition(entry, actor, resource, cache, resourceBlock, policy);
+  }
+  if (entry.when !== void 0) {
+    return evaluateWhenOnly(entry, actor, resource, cache, resourceBlock, policy);
+  }
+  return [];
+}
+function evaluateGlobalRole(entry, actor, policy) {
+  const globalRoleName = entry.from_global_role;
+  const globalRole = policy.global_roles?.[globalRoleName];
+  if (!globalRole) return [];
+  if (actor.type !== globalRole.actor_type) return [];
+  if (!evaluateActorCondition(globalRole.when, actor)) return [];
+  return [
+    {
+      role: entry.role,
+      via: `global_role:${globalRoleName}`
+    }
+  ];
+}
+async function evaluateRelationRole(entry, actor, resource, cache, policy, depthRemaining, maxDepth, visited) {
+  if (depthRemaining <= 0) {
+    throw new DepthLimitError(
+      `Derived role chain exceeded maximum depth of ${maxDepth}`,
+      maxDepth,
+      "derivation"
+    );
+  }
+  const relationName = entry.on_relation;
+  const requiredRole = entry.from_role;
+  let relatedRefs;
+  try {
+    const attrs = await cache.resolve(resource);
+    const relValue = attrs[relationName];
+    if (!relValue) return [];
+    if (Array.isArray(relValue)) {
+      relatedRefs = relValue.filter(
+        (r) => r != null && typeof r === "object" && "type" in r && "id" in r
+      );
+    } else if (typeof relValue === "object" && relValue !== null && "type" in relValue && "id" in relValue) {
+      relatedRefs = [relValue];
+    } else {
+      return [];
+    }
+  } catch {
+    return [];
+  }
+  const traces = [];
+  for (const relatedRef of relatedRefs) {
+    const refKey = `${relatedRef.type}:${relatedRef.id}`;
+    if (visited.has(refKey)) {
+      throw new CycleError(
+        `Cycle detected in derived role resolution: ${refKey} already visited`,
+        [...visited, refKey]
+      );
+    }
+    const branchVisited = new Set(visited);
+    branchVisited.add(refKey);
+    let hasRole = false;
+    const relatedBlock = policy.resources[relatedRef.type];
+    if (relatedBlock?.derived_roles?.length) {
+      const relatedResult = await resolveRolesRecursive(
+        actor,
+        relatedRef,
+        cache,
+        relatedBlock,
+        policy,
+        depthRemaining - 1,
+        maxDepth,
+        branchVisited
+      );
+      if (relatedResult.derived.some((d) => d.role === requiredRole)) {
+        hasRole = true;
+      }
+    }
+    if (hasRole) {
+      traces.push({
+        role: entry.role,
+        via: `from_role:${requiredRole} on ${relationName} -> ${relatedRef.type}:${relatedRef.id}`
+      });
+    }
+  }
+  return traces;
+}
+async function resolveRolesRecursive(actor, resource, cache, resourceBlock, policy, depthRemaining, maxDepth, visited) {
+  if (depthRemaining <= 0) {
+    throw new DepthLimitError(
+      `Derived role chain exceeded maximum depth of ${maxDepth}`,
+      maxDepth,
+      "derivation"
+    );
+  }
+  const direct = [];
+  const derived = [];
+  const derivedEntries = resourceBlock.derived_roles ?? [];
+  for (const entry of derivedEntries) {
+    try {
+      const traces = await evaluateDerivedRole(
+        entry,
+        actor,
+        resource,
+        cache,
+        resourceBlock,
+        policy,
+        depthRemaining,
+        maxDepth,
+        visited
+      );
+      derived.push(...traces);
+    } catch (e) {
+      if (e instanceof CycleError || e instanceof DepthLimitError) {
+        throw e;
+      }
+    }
+  }
+  return { direct, derived };
+}
+async function evaluateRelationIdentity(entry, actor, resource, cache) {
+  const relationName = entry.from_relation;
+  let relatedRefs;
+  try {
+    const attrs = await cache.resolve(resource);
+    const relValue = attrs[relationName];
+    if (!relValue) return [];
+    if (Array.isArray(relValue)) {
+      relatedRefs = relValue.filter(
+        (r) => r != null && typeof r === "object" && "type" in r && "id" in r
+      );
+    } else if (typeof relValue === "object" && relValue !== null && "type" in relValue && "id" in relValue) {
+      relatedRefs = [relValue];
+    } else {
+      return [];
+    }
+  } catch {
+    return [];
+  }
+  for (const ref of relatedRefs) {
+    if (ref.type === actor.type && ref.id === actor.id) {
+      return [
+        {
+          role: entry.role,
+          via: `identity on ${relationName} -> ${ref.type}:${ref.id}`
+        }
+      ];
+    }
+  }
+  return [];
+}
+async function evaluateActorTypeCondition(entry, actor, resource, cache, resourceBlock, policy) {
+  if (actor.type !== entry.actor_type) return [];
+  const matched = await evaluateRoleCondition(entry.when, actor, resource, cache, resourceBlock, policy);
+  if (!matched) return [];
+  return [
+    {
+      role: entry.role,
+      via: `actor_type:${entry.actor_type} + when condition`
+    }
+  ];
+}
+async function evaluateWhenOnly(entry, actor, resource, cache, resourceBlock, policy) {
+  const matched = await evaluateRoleCondition(entry.when, actor, resource, cache, resourceBlock, policy);
+  if (!matched) return [];
+  return [
+    {
+      role: entry.role,
+      via: `when condition`
+    }
+  ];
+}
+async function evaluateRoleCondition(condition, actor, resource, cache, resourceBlock, policy) {
+  try {
+    return await evaluateCondition(
+      condition,
+      actor,
+      resource,
+      cache,
+      {},
+      // empty env — $env conditions will resolve to undefined -> fail-closed
+      resourceBlock,
+      policy
+    );
+  } catch {
+    return false;
+  }
+}
+var MAX_ACTOR_COMBINATOR_DEPTH = 10;
+function evaluateActorCondition(condition, actor, combinatorDepth = 0) {
+  if ("any" in condition && Array.isArray(condition.any)) {
+    if (combinatorDepth >= MAX_ACTOR_COMBINATOR_DEPTH) return false;
+    return condition.any.some(
+      (c) => evaluateActorCondition(c, actor, combinatorDepth + 1)
+    );
+  }
+  if ("all" in condition && Array.isArray(condition.all)) {
+    if (combinatorDepth >= MAX_ACTOR_COMBINATOR_DEPTH) return false;
+    return condition.all.every(
+      (c) => evaluateActorCondition(c, actor, combinatorDepth + 1)
+    );
+  }
+  const entries = Object.entries(condition);
+  for (const [key, expectedValue] of entries) {
+    if (key.startsWith("$actor.")) {
+      const attrName = key.slice(7);
+      const actualValue = actor.attributes[attrName];
+      if (actualValue === void 0 || actualValue === null) return false;
+      if (actualValue !== expectedValue) return false;
+    }
+    if (key.startsWith("$resource.") || key.startsWith("$env.")) return false;
+  }
+  return true;
+}
+
+// src/evaluation/rule-engine.ts
+function expandGrants(roles, grants, allPermissions) {
+  const permissionSet = /* @__PURE__ */ new Set();
+  for (const role of roles) {
+    const roleGrants = grants[role];
+    if (!roleGrants) continue;
+    for (const perm of roleGrants) {
+      if (perm === "all") {
+        for (const p of allPermissions) {
+          permissionSet.add(p);
+        }
+      } else {
+        permissionSet.add(perm);
+      }
+    }
+  }
+  return permissionSet;
+}
+async function evaluate(actor, action, resource, resourceBlock, cache, policy, options) {
+  const resolvedRoles = await resolveRoles(
+    actor,
+    resource,
+    cache,
+    resourceBlock,
+    policy,
+    options
+  );
+  const derivedRoleNames = resolvedRoles.derived.map((d) => d.role);
+  const allRoles = [
+    .../* @__PURE__ */ new Set([...resolvedRoles.direct, ...derivedRoleNames])
+  ];
+  const grants = resourceBlock.grants ?? {};
+  const grantedPermissionSet = expandGrants(
+    allRoles,
+    grants,
+    resourceBlock.permissions
+  );
+  const grantedPermissions = [...grantedPermissionSet];
+  let allowed = grantedPermissionSet.has(action);
+  const rules = resourceBlock.rules ?? [];
+  const matchedRules = [];
+  const env = options?.env ?? {};
+  if (rules.length > 0) {
+    const { permitGranted, forbidMatched, ruleResults } = await evaluateRules(
+      rules,
+      action,
+      allRoles,
+      actor,
+      resource,
+      cache,
+      env,
+      resourceBlock,
+      policy,
+      options
+    );
+    matchedRules.push(...ruleResults);
+    if (forbidMatched) {
+      allowed = false;
+    } else if (!allowed && permitGranted) {
+      allowed = true;
+    }
+  }
+  let finalDecision;
+  if (matchedRules.some((r) => r.effect === "forbid" && r.matched)) {
+    finalDecision = `Denied: action "${action}" is forbidden by rule`;
+  } else if (allowed) {
+    finalDecision = `Allowed: action "${action}" is granted via roles [${allRoles.join(", ")}]`;
+  } else {
+    finalDecision = `Denied: action "${action}" is not granted (default-deny)`;
+  }
+  return {
+    allowed,
+    resolvedRoles,
+    grantedPermissions,
+    matchedRules,
+    finalDecision
+  };
+}
+async function evaluateRules(rules, action, allRoles, actor, resource, cache, env, resourceBlock, policy, options) {
+  let permitGranted = false;
+  let forbidMatched = false;
+  const ruleResults = [];
+  for (const rule of rules) {
+    if (!rule.permissions.includes(action)) continue;
+    if (rule.roles && rule.roles.length > 0) {
+      if (!rule.roles.some((r) => allRoles.includes(r))) {
+        ruleResults.push({
+          effect: rule.effect,
+          matched: false,
+          rule,
+          resolvedValues: {}
+        });
+        continue;
+      }
+    }
+    if (forbidMatched && rule.effect === "permit") {
+      ruleResults.push({
+        effect: rule.effect,
+        matched: false,
+        rule,
+        resolvedValues: {}
+      });
+      continue;
+    }
+    let conditionMatched;
+    try {
+      conditionMatched = await evaluateCondition(
+        rule.when,
+        actor,
+        resource,
+        cache,
+        env,
+        resourceBlock,
+        policy,
+        {
+          maxConditionDepth: options?.maxConditionDepth,
+          customEvaluators: options?.customEvaluators,
+          ruleEffect: rule.effect
+        }
+      );
+    } catch {
+      conditionMatched = rule.effect === "forbid";
+    }
+    ruleResults.push({
+      effect: rule.effect,
+      matched: conditionMatched,
+      rule,
+      resolvedValues: {}
+    });
+    if (conditionMatched) {
+      if (rule.effect === "forbid") {
+        forbidMatched = true;
+      } else if (rule.effect === "permit") {
+        permitGranted = true;
+      }
+    }
+  }
+  return { permitGranted, forbidMatched, ruleResults };
+}
+
+// src/evaluation/cache.ts
+function isResourceRef2(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.type === "string" && typeof obj.id === "string";
+}
+var AttributeCache = class {
+  cache = /* @__PURE__ */ new Map();
+  /** Pre-seeded inline attributes from cascading (T017). */
+  seededInline = /* @__PURE__ */ new Map();
+  resolvers;
+  constructor(resolvers) {
+    this.resolvers = resolvers ?? {};
+  }
+  key(type, id) {
+    return `${type}:${id}`;
+  }
+  /**
+   * Resolve all attributes for a resource reference.
+   * Merges inline attributes with resolver results (inline takes precedence).
+   * Results are cached by `${type}:${id}`.
+   *
+   * @param ref The resource reference
+   * @param resourceBlock Optional resource block for FR-016 validation of resolver results
+   */
+  async resolve(ref, resourceBlock) {
+    const k = this.key(ref.type, ref.id);
+    if (!this.cache.has(k)) {
+      this.cache.set(k, this.doResolve(ref, resourceBlock));
+    }
+    return this.cache.get(k);
+  }
+  /**
+   * Seed inline attributes for a resource from cascading (T017).
+   * Called when a relation-target value has extra fields beyond type/id.
+   * These are merged into the cache entry as pre-populated inline attributes.
+   */
+  seedInline(type, id, attrs) {
+    const k = this.key(type, id);
+    const existing = this.seededInline.get(k);
+    if (existing) {
+      this.seededInline.set(k, { ...attrs, ...existing });
+    } else {
+      this.seededInline.set(k, attrs);
+    }
+  }
+  async doResolve(ref, resourceBlock) {
+    const k = this.key(ref.type, ref.id);
+    const seeded = this.seededInline.get(k) ?? {};
+    const inline = ref.attributes ?? {};
+    const allInline = { ...seeded, ...inline };
+    const resolver = this.resolvers[ref.type];
+    if (!resolver) {
+      this.processCascadingInline(allInline, resourceBlock);
+      return allInline;
+    }
+    const resolved = await resolver(ref);
+    if (resourceBlock?.relations) {
+      this.validateResolverRelations(resolved, allInline, resourceBlock.relations, ref.type);
+    }
+    const merged = { ...resolved, ...allInline };
+    this.processCascadingInline(merged, resourceBlock);
+    return merged;
+  }
+  /**
+   * T017: Extract extra fields from ResourceRef-shaped relation values
+   * and seed them into the cache for the referenced resource.
+   */
+  processCascadingInline(attrs, resourceBlock) {
+    if (!resourceBlock?.relations) return;
+    for (const [fieldName, targetType] of Object.entries(resourceBlock.relations)) {
+      const value = attrs[fieldName];
+      if (!isResourceRef2(value)) continue;
+      const { type, id, ...extra } = value;
+      if (Object.keys(extra).length > 0) {
+        this.seedInline(targetType, id, extra);
+      }
+    }
+  }
+  /**
+   * T018: Validate that resolver-returned values for declared relation fields
+   * are valid ResourceRefs. Throws ValidationError if not.
+   * Only validates fields that come from the resolver (not inline).
+   */
+  validateResolverRelations(resolverResult, inlineAttrs, relations, resourceType) {
+    for (const [fieldName, targetType] of Object.entries(relations)) {
+      if (fieldName in inlineAttrs) continue;
+      const value = resolverResult[fieldName];
+      if (value === void 0 || value === null) continue;
+      if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          if (!isResourceRef2(value[i])) {
+            throw new ValidationError(
+              `Resolver for "${resourceType}" returned invalid value for relation field "${fieldName}[${i}]": expected ResourceRef with type/id, got ${typeof value[i] === "object" ? JSON.stringify(value[i]) : String(value[i])}. Declared relation target type: "${targetType}".`,
+              `resolvers.${resourceType}.${fieldName}[${i}]`
+            );
+          }
+        }
+        continue;
+      }
+      if (!isResourceRef2(value)) {
+        throw new ValidationError(
+          `Resolver for "${resourceType}" returned invalid value for relation field "${fieldName}": expected ResourceRef with type/id, got ${typeof value === "object" ? JSON.stringify(value) : String(value)}. Declared relation target type: "${targetType}".`,
+          `resolvers.${resourceType}.${fieldName}`
+        );
+      }
+    }
+  }
+};
+
+// src/partial/constraint-builder.ts
+var OPERATOR_KEYS2 = /* @__PURE__ */ new Set([
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "includes",
+  "exists",
+  "startsWith",
+  "endsWith",
+  "contains",
+  "custom"
+]);
+async function buildConstraints(actor, action, resourceType, cache, policy, options) {
+  const resourceBlock = policy.resources[resourceType];
+  if (!resourceBlock) {
+    return { forbidden: true };
+  }
+  const env = options?.env ?? {};
+  const rolesGrantingAction = findRolesGrantingAction(action, resourceBlock);
+  if (rolesGrantingAction.length === 0) {
+    const permitRules2 = (resourceBlock.rules ?? []).filter(
+      (r) => r.effect === "permit" && r.permissions.includes(action)
+    );
+    if (permitRules2.length === 0) {
+      return { forbidden: true };
+    }
+  }
+  const roleConstraintCache = /* @__PURE__ */ new Map();
+  const pathConstraints = [];
+  async function getRoleConstraints(role) {
+    const cached = roleConstraintCache.get(role);
+    if (cached !== void 0) return cached;
+    const constraints = [];
+    const derivedEntries = resourceBlock.derived_roles ?? [];
+    for (const entry of derivedEntries) {
+      if (entry.role !== role) continue;
+      const constraint = await evaluateDerivedRoleConstraint(
+        entry,
+        actor,
+        resourceType,
+        cache,
+        policy,
+        resourceBlock,
+        env
+      );
+      if (constraint !== null) constraints.push(constraint);
+    }
+    roleConstraintCache.set(role, constraints);
+    return constraints;
+  }
+  for (const role of rolesGrantingAction) {
+    const roleResults = await getRoleConstraints(role);
+    pathConstraints.push(...roleResults);
+  }
+  const permitRules = (resourceBlock.rules ?? []).filter(
+    (r) => r.effect === "permit" && r.permissions.includes(action)
+  );
+  for (const rule of permitRules) {
+    if (rule.roles && rule.roles.length > 0) {
+      const derivableRoleConstraints = [];
+      for (const role of rule.roles) {
+        const rc = await getRoleConstraints(role);
+        derivableRoleConstraints.push(...rc);
+      }
+      if (derivableRoleConstraints.length === 0) continue;
+      const ruleConstraint = conditionToConstraint(rule.when, actor, env);
+      if (ruleConstraint !== null) {
+        pathConstraints.push(
+          simplify({
+            type: "and",
+            children: [
+              derivableRoleConstraints.length === 1 ? derivableRoleConstraints[0] : { type: "or", children: derivableRoleConstraints },
+              ruleConstraint
+            ]
+          })
+        );
+      }
+    } else {
+      const ruleConstraint = conditionToConstraint(rule.when, actor, env);
+      if (ruleConstraint !== null && pathConstraints.length > 0) {
+        pathConstraints.push(ruleConstraint);
+      }
+    }
+  }
+  if (pathConstraints.length === 0) {
+    return { forbidden: true };
+  }
+  let combined;
+  if (pathConstraints.length === 1) {
+    combined = pathConstraints[0];
+  } else {
+    combined = { type: "or", children: pathConstraints };
+  }
+  const forbidRules = (resourceBlock.rules ?? []).filter(
+    (r) => r.effect === "forbid" && r.permissions.includes(action)
+  );
+  for (const rule of forbidRules) {
+    const forbidConstraint = conditionToConstraint(rule.when, actor, env);
+    if (forbidConstraint !== null) {
+      combined = {
+        type: "and",
+        children: [combined, { type: "not", child: forbidConstraint }]
+      };
+    }
+  }
+  combined = simplify(combined);
+  if (combined.type === "always") {
+    return { unrestricted: true };
+  }
+  if (combined.type === "never") {
+    return { forbidden: true };
+  }
+  return { constraints: combined };
+}
+function findRolesGrantingAction(action, resourceBlock) {
+  const grants = resourceBlock.grants ?? {};
+  const roles = [];
+  for (const [role, permissions] of Object.entries(grants)) {
+    if (permissions.includes(action) || permissions.includes("all")) {
+      roles.push(role);
+    }
+  }
+  return roles;
+}
+async function evaluateDerivedRoleConstraint(entry, actor, _resourceType, _cache, policy, resourceBlock, env) {
+  if (entry.from_global_role !== void 0) {
+    return evaluateGlobalRoleConstraint(entry, actor, policy);
+  }
+  if (entry.from_role !== void 0 && entry.on_relation !== void 0) {
+    return evaluateRelationRoleConstraint(entry, actor, resourceBlock, policy);
+  }
+  if (entry.from_relation !== void 0) {
+    return evaluateRelationIdentityConstraint(entry, actor, resourceBlock);
+  }
+  if (entry.actor_type !== void 0 && entry.when !== void 0) {
+    return evaluateActorTypeConstraint(entry, actor, env);
+  }
+  if (entry.when !== void 0) {
+    return evaluateWhenOnlyConstraint(entry, actor, env);
+  }
+  return null;
+}
+function evaluateGlobalRoleConstraint(entry, actor, policy) {
+  const globalRoleName = entry.from_global_role;
+  const globalRole = policy.global_roles?.[globalRoleName];
+  if (!globalRole) return null;
+  if (actor.type !== globalRole.actor_type) return null;
+  if (!evaluateActorCondition2(globalRole.when, actor)) return null;
+  return { type: "always" };
+}
+function evaluateRelationRoleConstraint(entry, actor, resourceBlock, policy) {
+  const relationName = entry.on_relation;
+  const requiredRole = entry.from_role;
+  const relationDef = resourceBlock.relations?.[relationName];
+  if (!relationDef) return null;
+  const targetResourceType = relationDef;
+  return {
+    type: "relation",
+    field: relationName,
+    resourceType: targetResourceType,
+    constraint: {
+      type: "has_role",
+      actorId: actor.id,
+      actorType: actor.type,
+      role: requiredRole
+    }
+  };
+}
+function evaluateRelationIdentityConstraint(entry, actor, resourceBlock) {
+  const relationName = entry.from_relation;
+  const relationDef = resourceBlock.relations?.[relationName];
+  if (!relationDef) {
+    return {
+      type: "field_eq",
+      field: relationName,
+      value: actor.id
+    };
+  }
+  return {
+    type: "relation",
+    field: relationName,
+    resourceType: relationDef,
+    constraint: {
+      type: "and",
+      children: [
+        { type: "field_eq", field: "id", value: actor.id },
+        { type: "field_eq", field: "type", value: actor.type }
+      ]
+    }
+  };
+}
+function evaluateActorTypeConstraint(entry, actor, env) {
+  if (actor.type !== entry.actor_type) return null;
+  return conditionToConstraint(entry.when, actor, env);
+}
+function evaluateWhenOnlyConstraint(entry, actor, env) {
+  return conditionToConstraint(entry.when, actor, env);
+}
+function conditionToConstraint(condition, actor, env) {
+  if ("any" in condition && Array.isArray(condition.any)) {
+    const items = condition.any;
+    const children2 = [];
+    for (const item of items) {
+      const child = conditionToConstraint(item, actor, env);
+      if (child !== null) children2.push(child);
+    }
+    if (children2.length === 0) return null;
+    if (children2.length === 1) return children2[0];
+    return { type: "or", children: children2 };
+  }
+  if ("all" in condition && Array.isArray(condition.all)) {
+    const items = condition.all;
+    const children2 = [];
+    for (const item of items) {
+      const child = conditionToConstraint(item, actor, env);
+      if (child !== null) children2.push(child);
+    }
+    if (children2.length === 0) return { type: "always" };
+    if (children2.length === 1) return children2[0];
+    return { type: "and", children: children2 };
+  }
+  const entries = Object.entries(condition);
+  const children = [];
+  for (const [key, conditionValue] of entries) {
+    const constraint = pairToConstraint(key, conditionValue, actor, env);
+    if (constraint !== null) {
+      children.push(constraint);
+    }
+  }
+  if (children.length === 0) return { type: "always" };
+  if (children.length === 1) return children[0];
+  return { type: "and", children };
+}
+function pairToConstraint(key, conditionValue, actor, env) {
+  if (key.startsWith("$actor.")) {
+    const attrPath = key.slice(7);
+    const actorValue = getNestedAttribute2(actor.attributes, attrPath);
+    if (isOperator2(conditionValue)) {
+      return evaluateActorOperatorConstraint(actorValue, conditionValue, actor, env);
+    }
+    const rightValue = resolveStaticValue(conditionValue, actor, env);
+    if (rightValue === void 0 || rightValue === null) return null;
+    if (actorValue === void 0 || actorValue === null) return null;
+    return actorValue === rightValue ? { type: "always" } : { type: "never" };
+  }
+  if (key.startsWith("$resource.")) {
+    const field = key.slice(10);
+    if (isOperator2(conditionValue)) {
+      return operatorToConstraint(field, conditionValue, actor, env);
+    }
+    const rightValue = resolveStaticValue(conditionValue, actor, env);
+    if (rightValue === void 0 || rightValue === null) return null;
+    return { type: "field_eq", field, value: rightValue };
+  }
+  if (key.startsWith("$env.")) {
+    const envPath = key.slice(5);
+    const envValue = env[envPath];
+    if (envValue === void 0 || envValue === null) return { type: "never" };
+    if (isOperator2(conditionValue)) {
+      return evaluateActorOperatorConstraint(envValue, conditionValue, actor, env);
+    }
+    const rightValue = resolveStaticValue(conditionValue, actor, env);
+    if (rightValue === void 0 || rightValue === null) return null;
+    return envValue === rightValue ? { type: "always" } : { type: "never" };
+  }
+  return null;
+}
+function operatorToConstraint(field, operator, actor, env) {
+  const op = operator;
+  const opKey = Object.keys(op)[0];
+  const opValue = op[opKey];
+  if (opKey === "custom") {
+    return { type: "unknown", name: opValue };
+  }
+  if (opKey === "exists") {
+    return { type: "field_exists", field, exists: opValue };
+  }
+  const resolvedValue = resolveStaticValue(opValue, actor, env);
+  switch (opKey) {
+    case "eq":
+      return { type: "field_eq", field, value: resolvedValue };
+    case "neq":
+      return { type: "field_neq", field, value: resolvedValue };
+    case "gt":
+      return { type: "field_gt", field, value: resolvedValue };
+    case "gte":
+      return { type: "field_gte", field, value: resolvedValue };
+    case "lt":
+      return { type: "field_lt", field, value: resolvedValue };
+    case "lte":
+      return { type: "field_lte", field, value: resolvedValue };
+    case "in":
+      if (Array.isArray(resolvedValue)) {
+        return { type: "field_in", field, values: resolvedValue };
+      }
+      return { type: "field_in", field, values: [resolvedValue] };
+    case "includes":
+      return { type: "field_includes", field, value: resolvedValue };
+    case "startsWith":
+    case "endsWith":
+    case "contains":
+      return { type: "field_contains", field, value: resolvedValue };
+    default:
+      return null;
+  }
+}
+function evaluateActorOperatorConstraint(leftValue, operator, actor, env) {
+  const op = operator;
+  const opKey = Object.keys(op)[0];
+  const opValue = op[opKey];
+  if (opKey === "custom") {
+    return { type: "unknown", name: opValue };
+  }
+  if (opKey === "exists") {
+    const exists = leftValue !== void 0 && leftValue !== null;
+    return (opValue === true ? exists : !exists) ? { type: "always" } : { type: "never" };
+  }
+  if (typeof opValue === "string" && opValue.startsWith("$resource.")) {
+    const field = opValue.slice(10);
+    if (leftValue === void 0 || leftValue === null) return { type: "never" };
+    return actorResourceCrossConstraint(leftValue, opKey, field);
+  }
+  const resolvedRight = resolveStaticValue(opValue, actor, env);
+  if (leftValue === void 0 || leftValue === null) return { type: "never" };
+  if (resolvedRight === void 0 || resolvedRight === null) return { type: "never" };
+  let result;
+  switch (opKey) {
+    case "eq":
+      result = leftValue === resolvedRight;
+      break;
+    case "neq":
+      result = leftValue !== resolvedRight;
+      break;
+    case "gt":
+      result = leftValue > resolvedRight;
+      break;
+    case "gte":
+      result = leftValue >= resolvedRight;
+      break;
+    case "lt":
+      result = leftValue < resolvedRight;
+      break;
+    case "lte":
+      result = leftValue <= resolvedRight;
+      break;
+    case "in":
+      result = Array.isArray(resolvedRight) ? resolvedRight.includes(leftValue) : false;
+      break;
+    case "includes":
+      result = Array.isArray(leftValue) ? leftValue.includes(resolvedRight) : false;
+      break;
+    default:
+      return null;
+  }
+  return result ? { type: "always" } : { type: "never" };
+}
+function actorResourceCrossConstraint(leftValue, opKey, resourceField) {
+  switch (opKey) {
+    case "eq":
+      return { type: "field_eq", field: resourceField, value: leftValue };
+    case "neq":
+      return { type: "field_neq", field: resourceField, value: leftValue };
+    case "in":
+      return { type: "field_includes", field: resourceField, value: leftValue };
+    case "includes":
+      if (Array.isArray(leftValue)) {
+        return { type: "field_in", field: resourceField, values: leftValue };
+      }
+      return null;
+    case "gt":
+      return { type: "field_lt", field: resourceField, value: leftValue };
+    case "gte":
+      return { type: "field_lte", field: resourceField, value: leftValue };
+    case "lt":
+      return { type: "field_gt", field: resourceField, value: leftValue };
+    case "lte":
+      return { type: "field_gte", field: resourceField, value: leftValue };
+    default:
+      return { type: "never" };
+  }
+}
+function resolveStaticValue(value, actor, env) {
+  if (typeof value === "string") {
+    if (value.startsWith("$actor.")) {
+      const attrPath = value.slice(7);
+      return getNestedAttribute2(actor.attributes, attrPath);
+    }
+    if (value.startsWith("$env.")) {
+      const envPath = value.slice(5);
+      return env[envPath];
+    }
+    if (value.startsWith("$resource.")) {
+      return value;
+    }
+  }
+  return value;
+}
+var FORBIDDEN_PROPS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function getNestedAttribute2(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (FORBIDDEN_PROPS2.has(part)) return void 0;
+    if (current === null || current === void 0 || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[part];
+  }
+  return current;
+}
+function evaluateActorCondition2(condition, actor) {
+  if ("any" in condition && Array.isArray(condition.any)) {
+    return condition.any.some(
+      (c) => evaluateActorCondition2(c, actor)
+    );
+  }
+  if ("all" in condition && Array.isArray(condition.all)) {
+    return condition.all.every(
+      (c) => evaluateActorCondition2(c, actor)
+    );
+  }
+  const entries = Object.entries(condition);
+  for (const [key, expectedValue] of entries) {
+    if (key.startsWith("$actor.")) {
+      const attrName = key.slice(7);
+      const actualValue = getNestedAttribute2(actor.attributes, attrName);
+      if (actualValue === void 0 || actualValue === null) return false;
+      if (actualValue !== expectedValue) return false;
+    } else if (key.startsWith("$resource.") || key.startsWith("$env.")) {
+      return false;
+    }
+  }
+  return true;
+}
+function isOperator2(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const keys = Object.keys(value);
+  return keys.length === 1 && OPERATOR_KEYS2.has(keys[0]);
+}
+var MAX_SIMPLIFY_DEPTH = 100;
+function simplify(constraint, _depth = 0) {
+  if (_depth > MAX_SIMPLIFY_DEPTH) {
+    return constraint;
+  }
+  switch (constraint.type) {
+    case "and": {
+      let children = constraint.children.map((c) => simplify(c, _depth + 1));
+      children = children.filter((c) => c.type !== "always");
+      if (children.some((c) => c.type === "never")) {
+        return { type: "never" };
+      }
+      if (children.length === 0) return { type: "always" };
+      if (children.length === 1) return children[0];
+      return { type: "and", children };
+    }
+    case "or": {
+      let children = constraint.children.map((c) => simplify(c, _depth + 1));
+      children = children.filter((c) => c.type !== "never");
+      if (children.some((c) => c.type === "always")) {
+        return { type: "always" };
+      }
+      if (children.length === 0) return { type: "never" };
+      if (children.length === 1) return children[0];
+      return { type: "or", children };
+    }
+    case "not": {
+      const child = simplify(constraint.child, _depth + 1);
+      if (child.type === "always") return { type: "never" };
+      if (child.type === "never") return { type: "always" };
+      if (child.type === "not") return child.child;
+      return { type: "not", child };
+    }
+    case "relation": {
+      const simplified = simplify(constraint.constraint, _depth + 1);
+      return { type: "relation", field: constraint.field, resourceType: constraint.resourceType, constraint: simplified };
+    }
+    default:
+      return constraint;
+  }
+}
+
+// src/partial/translator.ts
+var MAX_TRANSLATE_DEPTH = 100;
+function translateConstraints(constraint, adapter, _depth = 0) {
+  if (_depth > MAX_TRANSLATE_DEPTH) {
+    throw new Error(
+      `translateConstraints exceeded maximum recursion depth (${MAX_TRANSLATE_DEPTH}). The constraint AST may be malformed or excessively nested.`
+    );
+  }
+  switch (constraint.type) {
+    // Leaf constraints
+    case "field_eq":
+    case "field_neq":
+    case "field_gt":
+    case "field_gte":
+    case "field_lt":
+    case "field_lte":
+    case "field_in":
+    case "field_nin":
+    case "field_exists":
+    case "field_includes":
+    case "field_contains":
+      return adapter.translate(constraint);
+    // Relation constraint
+    case "relation": {
+      const childQuery = translateConstraints(constraint.constraint, adapter, _depth + 1);
+      return adapter.relation(constraint.field, constraint.resourceType, childQuery);
+    }
+    // Has role constraint
+    case "has_role":
+      return adapter.hasRole(constraint.actorId, constraint.actorType, constraint.role);
+    // Unknown constraint (custom evaluator)
+    case "unknown":
+      return adapter.unknown(constraint.name);
+    // Combinators
+    case "and": {
+      const queries = constraint.children.map((c) => translateConstraints(c, adapter, _depth + 1));
+      return adapter.and(queries);
+    }
+    case "or": {
+      const queries = constraint.children.map((c) => translateConstraints(c, adapter, _depth + 1));
+      return adapter.or(queries);
+    }
+    case "not": {
+      const childQuery = translateConstraints(constraint.child, adapter, _depth + 1);
+      return adapter.not(childQuery);
+    }
+    // Terminal nodes - should not reach the translator
+    case "always":
+      throw new Error(
+        'Constraint node "always" should be simplified out before translation. Use buildConstraints() which returns ConstraintResult with unrestricted/forbidden sentinels.'
+      );
+    case "never":
+      throw new Error(
+        'Constraint node "never" should be simplified out before translation. Use buildConstraints() which returns ConstraintResult with unrestricted/forbidden sentinels.'
+      );
+    default: {
+      const _exhaustive = constraint;
+      throw new Error(`Unknown constraint type: ${constraint.type}`);
+    }
+  }
+}
+
+// src/snapshot.ts
+async function snapshot(engine, actor, resources, options) {
+  const entries = await Promise.all(
+    resources.map(async (resource) => {
+      const key = `${resource.type}:${resource.id}`;
+      const actions = await engine.permittedActions(actor, resource, options);
+      return [key, actions];
+    })
+  );
+  return Object.fromEntries(entries);
+}
+
+// src/field-access.ts
+async function canField(engine, actor, operation, resource, field, fieldAccess, options) {
+  if (!fieldAccess) {
+    return engine.can(actor, operation, resource, options);
+  }
+  const fieldDef = fieldAccess[field];
+  if (!fieldDef || !fieldDef[operation]) {
+    return engine.can(actor, operation, resource, options);
+  }
+  const allowedRoles = fieldDef[operation];
+  const actorRoles = await engine.resolvedRoles(actor, resource, options);
+  return actorRoles.some((role) => allowedRoles.includes(role));
+}
+async function permittedFields(engine, actor, operation, resource, fieldAccess, options) {
+  if (!fieldAccess) {
+    return [];
+  }
+  const fieldNames = Object.keys(fieldAccess);
+  if (fieldNames.length === 0) {
+    return [];
+  }
+  const actorRoles = await engine.resolvedRoles(actor, resource, options);
+  let hasResourcePermission;
+  const permitted = [];
+  for (const fieldName of fieldNames) {
+    const fieldDef = fieldAccess[fieldName];
+    const allowedRoles = fieldDef?.[operation];
+    if (allowedRoles) {
+      if (actorRoles.some((role) => allowedRoles.includes(role))) {
+        permitted.push(fieldName);
+      }
+    } else {
+      if (hasResourcePermission === void 0) {
+        hasResourcePermission = await engine.can(actor, operation, resource, options);
+      }
+      if (hasResourcePermission) {
+        permitted.push(fieldName);
+      }
+    }
+  }
+  return permitted;
+}
+
+// src/engine.ts
+var Toride = class {
+  policy;
+  resolvers;
+  options;
+  constructor(options) {
+    this.policy = options.policy;
+    this.resolvers = options.resolvers ?? {};
+    this.options = options;
+  }
+  /**
+   * Check if an actor can perform an action on a resource.
+   * Default-deny: returns false if resource type is unknown or no grants match.
+   */
+  async can(actor, action, resource, options) {
+    const a = actor;
+    const r = resource;
+    const act = action;
+    const result = await this.evaluateInternal(a, act, r, options);
+    this.fireDecisionEvent(a, act, r, result);
+    return result.allowed;
+  }
+  /**
+   * T097: Atomic policy swap. In-flight checks capture the resource block
+   * at the start of evaluateInternal, so they complete with the old policy.
+   * JS single-threaded nature ensures the assignment is atomic.
+   */
+  setPolicy(policy) {
+    this.policy = policy;
+  }
+  /**
+   * T068: Return full ExplainResult with role derivation traces,
+   * granted permissions, matched rules, and human-readable final decision.
+   */
+  async explain(actor, action, resource, options) {
+    const a = actor;
+    const r = resource;
+    const act = action;
+    const result = await this.evaluateInternal(a, act, r, options);
+    this.fireDecisionEvent(a, act, r, result);
+    return result;
+  }
+  /**
+   * T069: Check all declared permissions for a resource and return permitted ones.
+   * Uses a shared cache across all per-action evaluations.
+   */
+  async permittedActions(actor, resource, options) {
+    const a = actor;
+    const r = resource;
+    const resourceBlock = this.policy.resources[r.type];
+    if (!resourceBlock) {
+      return [];
+    }
+    const sharedCache = new AttributeCache(this.resolvers);
+    const permitted = [];
+    for (const action of resourceBlock.permissions) {
+      const result = await this.evaluateInternal(
+        a,
+        action,
+        r,
+        options,
+        sharedCache
+      );
+      if (result.allowed) {
+        permitted.push(action);
+      }
+    }
+    return permitted;
+  }
+  /**
+   * T083: Generate a PermissionSnapshot for a list of resources.
+   * Calls permittedActions() for each resource and returns a map
+   * keyed by "Type:id" with arrays of permitted action strings.
+   * Suitable for serializing to the client via TorideClient.
+   */
+  async snapshot(actor, resources, options) {
+    return snapshot(
+      this,
+      actor,
+      resources,
+      options
+    );
+  }
+  /**
+   * T095: Check if an actor can perform a field-level operation on a specific field.
+   * Restricted fields require the actor to have a role listed in field_access.
+   * Unlisted fields are unrestricted: any actor with the resource-level permission can access them.
+   */
+  async canField(actor, operation, resource, field, options) {
+    const r = resource;
+    const resourceBlock = this.policy.resources[r.type];
+    if (!resourceBlock) {
+      return false;
+    }
+    return canField(
+      this,
+      actor,
+      operation,
+      r,
+      field,
+      resourceBlock.field_access,
+      options
+    );
+  }
+  /**
+   * T095: Return the list of declared field_access field names the actor can access
+   * for the given operation. Only returns explicitly declared fields.
+   */
+  async permittedFields(actor, operation, resource, options) {
+    const r = resource;
+    const resourceBlock = this.policy.resources[r.type];
+    if (!resourceBlock) {
+      return [];
+    }
+    return permittedFields(
+      this,
+      actor,
+      operation,
+      r,
+      resourceBlock.field_access,
+      options
+    );
+  }
+  /**
+   * T070: Return flat deduplicated list of all resolved roles (direct + derived).
+   */
+  async resolvedRoles(actor, resource, options) {
+    const a = actor;
+    const r = resource;
+    const resourceBlock = this.policy.resources[r.type];
+    if (!resourceBlock) {
+      return [];
+    }
+    const action = resourceBlock.permissions[0] ?? "__resolvedRoles__";
+    const result = await this.evaluateInternal(a, action, r, options);
+    const directRoles = result.resolvedRoles.direct;
+    const derivedRoleNames = result.resolvedRoles.derived.map((d) => d.role);
+    return [.../* @__PURE__ */ new Set([...directRoles, ...derivedRoleNames])];
+  }
+  /**
+   * T071: Evaluate multiple checks for the same actor with a shared resolver cache.
+   * Returns boolean[] in the same order as the input checks.
+   */
+  async canBatch(actor, checks, options) {
+    if (checks.length === 0) {
+      return [];
+    }
+    const a = actor;
+    const sharedCache = new AttributeCache(this.resolvers);
+    const results = [];
+    for (const check of checks) {
+      const r = check.resource;
+      const act = check.action;
+      const result = await this.evaluateInternal(
+        a,
+        act,
+        r,
+        options,
+        sharedCache
+      );
+      this.fireDecisionEvent(a, act, r, result);
+      results.push(result.allowed);
+    }
+    return results;
+  }
+  /**
+   * T064: Build constraint AST for partial evaluation / data filtering.
+   * Returns ConstraintResult with unrestricted/forbidden sentinels or constraint AST.
+   */
+  async buildConstraints(actor, action, resourceType, options) {
+    const a = actor;
+    const act = action;
+    const rt = resourceType;
+    const cache = new AttributeCache(this.resolvers);
+    const constraintResult = await buildConstraints(
+      a,
+      act,
+      rt,
+      cache,
+      this.policy,
+      {
+        env: options?.env,
+        maxDerivedRoleDepth: this.options.maxDerivedRoleDepth,
+        customEvaluators: this.options.customEvaluators
+      }
+    );
+    this.fireQueryEvent(a, act, rt, constraintResult);
+    return constraintResult;
+  }
+  /**
+   * T064: Translate constraint AST using an adapter.
+   * Dispatches each constraint node to the adapter's methods.
+   */
+  translateConstraints(constraints, adapter) {
+    return translateConstraints(constraints, adapter);
+  }
+  /**
+   * T072: Fire onDecision audit callback via microtask (non-blocking).
+   * Errors are silently swallowed to prevent audit failures from affecting authorization.
+   */
+  fireDecisionEvent(actor, action, resource, result) {
+    const callback = this.options.onDecision;
+    if (!callback) return;
+    const directRoles = result.resolvedRoles.direct;
+    const derivedRoleNames = result.resolvedRoles.derived.map((d) => d.role);
+    const resolvedRoles = [.../* @__PURE__ */ new Set([...directRoles, ...derivedRoleNames])];
+    const event = {
+      actor,
+      action,
+      resource,
+      allowed: result.allowed,
+      resolvedRoles,
+      matchedRules: result.matchedRules.map((r) => ({
+        effect: r.effect,
+        matched: r.matched
+      })),
+      timestamp: /* @__PURE__ */ new Date()
+    };
+    queueMicrotask(() => {
+      try {
+        callback(event);
+      } catch {
+      }
+    });
+  }
+  /**
+   * T072: Fire onQuery audit callback via microtask (non-blocking).
+   * Errors are silently swallowed.
+   */
+  fireQueryEvent(actor, action, resourceType, constraintResult) {
+    const callback = this.options.onQuery;
+    if (!callback) return;
+    let resultType;
+    if ("unrestricted" in constraintResult && constraintResult.unrestricted) {
+      resultType = "unrestricted";
+    } else if ("forbidden" in constraintResult && constraintResult.forbidden) {
+      resultType = "forbidden";
+    } else {
+      resultType = "constrained";
+    }
+    const event = {
+      actor,
+      action,
+      resourceType,
+      resultType,
+      timestamp: /* @__PURE__ */ new Date()
+    };
+    queueMicrotask(() => {
+      try {
+        callback(event);
+      } catch {
+      }
+    });
+  }
+  /**
+   * Evaluate with full ExplainResult (shared code path for can(), explain(), and helpers).
+   * Accepts an optional pre-existing AttributeCache for shared-cache scenarios (canBatch, permittedActions).
+   */
+  async evaluateInternal(actor, action, resource, checkOptions, existingCache) {
+    const resourceBlock = this.policy.resources[resource.type];
+    if (!resourceBlock) {
+      return {
+        allowed: false,
+        resolvedRoles: { direct: [], derived: [] },
+        grantedPermissions: [],
+        matchedRules: [],
+        finalDecision: `Denied: unknown resource type "${resource.type}"`
+      };
+    }
+    const cache = existingCache ?? new AttributeCache(this.resolvers);
+    const env = checkOptions?.env ?? {};
+    try {
+      return await evaluate(actor, action, resource, resourceBlock, cache, this.policy, {
+        maxDerivedRoleDepth: this.options.maxDerivedRoleDepth,
+        maxConditionDepth: this.options.maxConditionDepth,
+        customEvaluators: this.options.customEvaluators,
+        env
+      });
+    } catch {
+      return {
+        allowed: false,
+        resolvedRoles: { direct: [], derived: [] },
+        grantedPermissions: [],
+        matchedRules: [],
+        finalDecision: `Denied: evaluation error (fail-closed)`
+      };
+    }
+  }
+};
+function createToride(options) {
+  return new Toride(options);
+}
+
+// src/testing/mock-resolver.ts
+function createMockResolver(testCase) {
+  const { resolvers: mockData } = testCase;
+  if (!mockData) return {};
+  const typeSet = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(mockData)) {
+    const colonIndex = key.indexOf(":");
+    if (colonIndex > 0) {
+      typeSet.add(key.substring(0, colonIndex));
+    }
+  }
+  const resolvers = {};
+  for (const type of typeSet) {
+    resolvers[type] = async (ref) => {
+      const key = `${ref.type}:${ref.id}`;
+      return mockData[key] ?? {};
+    };
+  }
+  return resolvers;
+}
+
+// src/testing/test-runner.ts
+async function runTestCases(policy, tests) {
+  const results = [];
+  for (const tc of tests) {
+    const resolvers = createMockResolver(tc);
+    const engine = new Toride({ policy, resolvers });
+    const allowed = await engine.can(tc.actor, tc.action, tc.resource);
+    const actual = allowed ? "allow" : "deny";
+    results.push({
+      name: tc.name,
+      passed: actual === tc.expected,
+      expected: tc.expected,
+      actual
+    });
+  }
+  return results;
+}
+
+export {
+  PolicySchema,
+  ValidationError,
+  CycleError,
+  DepthLimitError,
+  validatePolicy,
+  validatePolicyResult,
+  validatePolicyStrict,
+  parseInlineTests,
+  parseTestFile,
+  Toride,
+  createToride,
+  createMockResolver,
+  runTestCases
+};