toride 0.3.0 → 0.4.0

package/dist/{chunk-2AWXNP37.js → chunk-GRFSE3QO.js}

@@ -1,8 +1,56 @@
 // src/policy/schema.ts
 import * as v from "valibot";
-var AttributeTypeSchema = v.picklist(["string", "number", "boolean"]);
+var AttributeTypeSchema = v.picklist(["string", "number", "boolean", "string[]", "number[]", "boolean[]"]);
+var MAX_ATTRIBUTE_DEPTH = 3;
+function getAttributeDepth(schema, currentDepth = 0) {
+  if (typeof schema !== "object" || schema === null) {
+    return currentDepth;
+  }
+  const obj = schema;
+  if (obj.kind === "primitive") {
+    return currentDepth;
+  }
+  if (obj.kind === "object" && typeof obj.fields === "object" && obj.fields !== null) {
+    const fields = obj.fields;
+    let maxDepth = currentDepth;
+    for (const field of Object.values(fields)) {
+      const fieldDepth = getAttributeDepth(field, currentDepth + 1);
+      if (fieldDepth > maxDepth) {
+        maxDepth = fieldDepth;
+      }
+    }
+    return maxDepth;
+  }
+  if (obj.kind === "array" && typeof obj.items === "object" && obj.items !== null) {
+    return getAttributeDepth(obj.items, currentDepth);
+  }
+  return currentDepth;
+}
+function checkAttributeDepth(input) {
+  return getAttributeDepth(input) <= MAX_ATTRIBUTE_DEPTH;
+}
+var PrimitiveAttributeSchemaNodeSchema = v.object({
+  kind: v.literal("primitive"),
+  type: AttributeTypeSchema
+});
+var ObjectAttributeSchemaNodeSchema = v.object({
+  kind: v.literal("object"),
+  fields: v.record(v.string(), v.lazy(() => AttributeSchemaNodeSchema))
+});
+var ArrayAttributeSchemaNodeSchema = v.object({
+  kind: v.literal("array"),
+  items: v.lazy(() => AttributeSchemaNodeSchema)
+});
+var AttributeSchemaNodeSchema = v.pipe(
+  v.union([
+    PrimitiveAttributeSchemaNodeSchema,
+    ObjectAttributeSchemaNodeSchema,
+    ArrayAttributeSchemaNodeSchema
+  ]),
+  v.check(checkAttributeDepth, "Attribute schema exceeds maximum depth of 3")
+);
 var ActorDeclarationSchema = v.object({
-  attributes: v.record(v.string(), AttributeTypeSchema)
+  attributes: v.record(v.string(), AttributeSchemaNodeSchema)
 });
 var ConditionOperatorSchema = v.union([
   v.object({ eq: v.unknown() }),
@@ -54,7 +102,7 @@ var FieldAccessDefSchema = v.object({
 var ResourceBlockSchema = v.object({
   roles: v.array(v.string()),
   permissions: v.array(v.string()),
-  attributes: v.optional(v.record(v.string(), AttributeTypeSchema)),
+  attributes: v.optional(v.record(v.string(), AttributeSchemaNodeSchema)),
   relations: v.optional(v.record(v.string(), v.string())),
   grants: v.optional(v.record(v.string(), v.array(v.string()))),
   derived_roles: v.optional(v.array(DerivedRoleEntrySchema)),
@@ -122,6 +170,20 @@ var DepthLimitError = class extends Error {
     this.limitType = limitType;
   }
 };
+var ForbiddenError = class extends Error {
+  actor;
+  action;
+  resourceType;
+  constructor(actor, action, resourceType) {
+    super(
+      `Actor "${actor.type}:${actor.id}" is forbidden from performing "${action}" on resource type "${resourceType}"`
+    );
+    this.name = "ForbiddenError";
+    this.actor = actor;
+    this.action = action;
+    this.resourceType = resourceType;
+  }
+};
 
 // src/policy/validator.ts
 function extractActorAttributes(condition) {
@@ -1434,7 +1496,7 @@ var OPERATOR_KEYS2 = /* @__PURE__ */ new Set([
 async function buildConstraints(actor, action, resourceType, cache, policy, options) {
   const resourceBlock = policy.resources[resourceType];
   if (!resourceBlock) {
-    return { forbidden: true };
+    return { ok: false };
   }
   const env = options?.env ?? {};
   const rolesGrantingAction = findRolesGrantingAction(action, resourceBlock);
@@ -1443,7 +1505,7 @@ async function buildConstraints(actor, action, resourceType, cache, policy, opti
       (r) => r.effect === "permit" && r.permissions.includes(action)
     );
     if (permitRules2.length === 0) {
-      return { forbidden: true };
+      return { ok: false };
     }
   }
   const roleConstraintCache = /* @__PURE__ */ new Map();
@@ -1504,7 +1566,7 @@ async function buildConstraints(actor, action, resourceType, cache, policy, opti
     }
   }
   if (pathConstraints.length === 0) {
-    return { forbidden: true };
+    return { ok: false };
   }
   let combined;
   if (pathConstraints.length === 1) {
@@ -1526,12 +1588,12 @@ async function buildConstraints(actor, action, resourceType, cache, policy, opti
   }
   combined = simplify(combined);
   if (combined.type === "always") {
-    return { unrestricted: true };
+    return { ok: true, constraint: null };
   }
   if (combined.type === "never") {
-    return { forbidden: true };
+    return { ok: false };
   }
-  return { constraints: combined };
+  return { ok: true, constraint: combined };
 }
 function findRolesGrantingAction(action, resourceBlock) {
   const grants = resourceBlock.grants ?? {};
@@ -1949,11 +2011,11 @@ function translateConstraints(constraint, adapter, _depth = 0) {
     // Terminal nodes - should not reach the translator
     case "always":
       throw new Error(
-        'Constraint node "always" should be simplified out before translation. Use buildConstraints() which returns ConstraintResult with unrestricted/forbidden sentinels.'
+        'Constraint node "always" should be simplified out before translation. Check result.ok and result.constraint before calling translateConstraints().'
       );
     case "never":
       throw new Error(
-        'Constraint node "never" should be simplified out before translation. Use buildConstraints() which returns ConstraintResult with unrestricted/forbidden sentinels.'
+        'Constraint node "never" should be simplified out before translation. Check result.ok and result.constraint before calling translateConstraints().'
       );
     default: {
       const _exhaustive = constraint;
@@ -2168,9 +2230,9 @@ var Toride = class {
     const a = actor;
     const sharedCache = new AttributeCache(this.resolvers);
     const results = [];
-    for (const check of checks) {
-      const r = check.resource;
-      const act = check.action;
+    for (const check2 of checks) {
+      const r = check2.resource;
+      const act = check2.action;
       const result = await this.evaluateInternal(
         a,
         act,
@@ -2211,17 +2273,12 @@ var Toride = class {
    * T064: Translate constraint AST using an adapter.
    * Dispatches each constraint node to the adapter's methods.
    *
-   * Accepts ConstraintResult<R> from buildConstraints() and returns
+   * Accepts Constraint (the AST) from buildConstraints() and returns
    * TQueryMap[R] — the adapter's mapped output type for resource R.
-   * The resource type R is inferred from the ConstraintResult phantom type.
+   * Callers must check result.ok and result.constraint before calling this method.
    */
-  translateConstraints(constraints, adapter) {
-    if ("unrestricted" in constraints || "forbidden" in constraints) {
-      throw new Error(
-        "Cannot translate unrestricted or forbidden ConstraintResult. Check for 'constraints' property before calling translateConstraints()."
-      );
-    }
-    return translateConstraints(constraints.constraints, adapter);
+  translateConstraints(constraint, adapter) {
+    return translateConstraints(constraint, adapter);
   }
   /**
    * T072: Fire onDecision audit callback via microtask (non-blocking).
@@ -2260,10 +2317,10 @@ var Toride = class {
     const callback = this.options.onQuery;
     if (!callback) return;
     let resultType;
-    if ("unrestricted" in constraintResult && constraintResult.unrestricted) {
-      resultType = "unrestricted";
-    } else if ("forbidden" in constraintResult && constraintResult.forbidden) {
+    if (!constraintResult.ok) {
       resultType = "forbidden";
+    } else if (constraintResult.constraint === null) {
+      resultType = "unrestricted";
     } else {
       resultType = "constrained";
     }
@@ -2360,10 +2417,12 @@ async function runTestCases(policy, tests) {
 }
 
 export {
+  ConditionExpressionSchema,
   PolicySchema,
   ValidationError,
   CycleError,
   DepthLimitError,
+  ForbiddenError,
   validatePolicy,
   validatePolicyResult,
   validatePolicyStrict,

package/dist/cli.js

@@ -7,13 +7,96 @@ import {
   runTestCases,
   validatePolicyResult,
   validatePolicyStrict
-} from "./chunk-2AWXNP37.js";
+} from "./chunk-GRFSE3QO.js";
 
 // src/cli.ts
 import { readFileSync, readdirSync, statSync } from "fs";
 import { resolve, dirname, join } from "path";
 import * as YAML from "yaml";
 import * as v from "valibot";
+function normalizeAttributeValue(raw) {
+  if (raw === null || raw === void 0) return raw;
+  if (typeof raw === "string" && ["string", "number", "boolean"].includes(raw)) {
+    return { kind: "primitive", type: raw };
+  }
+  if (typeof raw === "object" && !Array.isArray(raw)) {
+    const obj = raw;
+    if ("kind" in obj && obj.kind !== void 0) {
+      if (obj.kind === "object" && typeof obj.fields === "object" && obj.fields !== null) {
+        const normalizedFields = {};
+        for (const [key, value] of Object.entries(obj.fields)) {
+          normalizedFields[key] = normalizeAttributeValue(value);
+        }
+        return { ...obj, fields: normalizedFields };
+      }
+      if (obj.kind === "array" && "items" in obj) {
+        return { ...obj, items: normalizeAttributeValue(obj.items) };
+      }
+      return obj;
+    }
+  }
+  if (typeof raw === "object" && !Array.isArray(raw)) {
+    const obj = raw;
+    const normalized = {};
+    for (const [key, value] of Object.entries(obj)) {
+      normalized[key] = normalizeAttributeValue(value);
+    }
+    return normalized;
+  }
+  if (Array.isArray(raw)) {
+    return raw.map((item) => normalizeAttributeValue(item));
+  }
+  return raw;
+}
+function normalizeAttributeRecord(attrs) {
+  const normalizedAttrs = {};
+  for (const [attrKey, attrValue] of Object.entries(attrs)) {
+    normalizedAttrs[attrKey] = normalizeAttributeValue(attrValue);
+  }
+  return normalizedAttrs;
+}
+function normalizeAttributes(raw) {
+  if (raw === null || raw === void 0 || typeof raw !== "object" || Array.isArray(raw)) {
+    return raw;
+  }
+  const obj = raw;
+  const normalized = { ...obj };
+  if ("actors" in normalized && typeof normalized.actors === "object" && normalized.actors !== null) {
+    const actors = normalized.actors;
+    const normalizedActors = {};
+    for (const [actorName, actorDef] of Object.entries(actors)) {
+      if (typeof actorDef === "object" && actorDef !== null) {
+        const actor = actorDef;
+        const normalizedActor = { ...actor };
+        if ("attributes" in normalizedActor && typeof normalizedActor.attributes === "object" && normalizedActor.attributes !== null) {
+          normalizedActor.attributes = normalizeAttributeRecord(normalizedActor.attributes);
+        }
+        normalizedActors[actorName] = normalizedActor;
+      } else {
+        normalizedActors[actorName] = actorDef;
+      }
+    }
+    normalized.actors = normalizedActors;
+  }
+  if ("resources" in normalized && typeof normalized.resources === "object" && normalized.resources !== null) {
+    const resources = normalized.resources;
+    const normalizedResources = {};
+    for (const [resName, resDef] of Object.entries(resources)) {
+      if (typeof resDef === "object" && resDef !== null) {
+        const resource = resDef;
+        const normalizedResource = { ...resource };
+        if ("attributes" in normalizedResource && typeof normalizedResource.attributes === "object" && normalizedResource.attributes !== null) {
+          normalizedResource.attributes = normalizeAttributeRecord(normalizedResource.attributes);
+        }
+        normalizedResources[resName] = normalizedResource;
+      } else {
+        normalizedResources[resName] = resDef;
+      }
+    }
+    normalized.resources = normalizedResources;
+  }
+  return normalized;
+}
 function loadPolicyFile(filePath) {
   const absPath = resolve(filePath);
   let content;
@@ -42,7 +125,8 @@ function loadPolicyFile(filePath) {
       );
     }
   }
-  const result = v.safeParse(PolicySchema, raw);
+  const normalizedRaw = normalizeAttributes(raw);
+  const result = v.safeParse(PolicySchema, normalizedRaw);
   if (!result.success) {
     const issue = result.issues[0];
     const path = issue?.path?.map((p) => String(p.key)).join(".") ?? "";

package/dist/{client-aExMng5T.d.ts → client-CBp3admQ.d.ts}

@@ -45,6 +45,58 @@ interface DefaultSchema extends TorideSchema {
     actorAttributeMap: Record<string, Record<string, unknown>>;
     relationMap: Record<string, Record<string, string>>;
 }
+/**
+ * Virtual field mapping configuration.
+ * Describes how a virtual field maps to a related resource query.
+ */
+interface VirtualFieldMapping {
+    /** The relation name to query */
+    readonly relation: string;
+    /** The field in the related resource to match against */
+    readonly matchField: string;
+    /** Optional filter to apply to the relation query */
+    readonly filter?: Record<string, unknown>;
+}
+/**
+ * Extracts keys from T whose values are arrays.
+ */
+type ArrayKeys<T> = {
+    [K in keyof T]: T[K] extends unknown[] ? K : never;
+}[keyof T];
+type ModelScalars<T> = T extends {
+    scalars: infer S extends Record<string, unknown>;
+} ? S : T extends Record<string, unknown> ? T : never;
+type UnwrapRelation<T> = T extends readonly (infer U)[] ? U : NonNullable<T>;
+type PayloadRelations<T> = T extends {
+    objects: infer O extends Record<string, unknown>;
+} ? {
+    [K in keyof O & string]: ModelScalars<UnwrapRelation<O[K]>>;
+} : Record<string, never>;
+type VirtualFieldMappingFor<TRelations extends Record<string, Record<string, unknown>>> = {
+    [R in keyof TRelations & string]: {
+        readonly relation: R;
+        readonly matchField: keyof TRelations[R] & string;
+        readonly filter?: {
+            readonly [F in keyof TRelations[R]]?: TRelations[R][F];
+        };
+    };
+}[keyof TRelations & string];
+/**
+ * Conditional type that uses model-aware detection when TModelMap is provided,
+ * falls back to ArrayKeys otherwise.
+ */
+type VirtualFieldKeysFor<S extends TorideSchema, R extends string, TModelMap> = [TModelMap] extends [never] ? S["resourceAttributeMap"][R] extends Record<string, unknown> ? Record<string, unknown> extends S["resourceAttributeMap"][R] ? string : ArrayKeys<S["resourceAttributeMap"][R]> : never : R extends keyof TModelMap ? Exclude<keyof S["resourceAttributeMap"][R] & string, keyof ModelScalars<TModelMap[R]> & string> : string;
+/**
+ * Per-resource mapping of virtual field keys to VirtualFieldMapping.
+ * When TModelMap is provided, uses model-aware detection for virtual field keys.
+ */
+type VirtualFieldsConfig<S extends TorideSchema, TModelMap = never> = {
+    [R in S["resources"]]?: {
+        [K in VirtualFieldKeysFor<S, R & string, TModelMap>]?: R extends keyof TModelMap ? TModelMap[R] extends {
+            objects: Record<string, unknown>;
+        } ? VirtualFieldMappingFor<PayloadRelations<TModelMap[R]>> : VirtualFieldMapping : VirtualFieldMapping;
+    };
+};
 /**
  * Represents an entity performing actions.
  * Generic discriminated union over actor types in S.
@@ -145,10 +197,27 @@ interface TorideOptions<S extends TorideSchema = DefaultSchema> {
     readonly onQuery?: (event: QueryEvent) => void;
 }
 /** Attribute type for actor declarations. */
-type AttributeType = "string" | "number" | "boolean";
+type AttributeType = "string" | "number" | "boolean" | "string[]" | "number[]" | "boolean[]";
+/** Schema for a primitive attribute. */
+interface PrimitiveAttributeSchema {
+    readonly kind: "primitive";
+    readonly type: AttributeType;
+}
+/** Schema for a nested object attribute. */
+interface ObjectAttributeSchema {
+    readonly kind: "object";
+    readonly fields: Record<string, AttributeSchema>;
+}
+/** Schema for an array attribute. */
+interface ArrayAttributeSchema {
+    readonly kind: "array";
+    readonly items: AttributeSchema;
+}
+/** Discriminated union of all attribute schema types. */
+type AttributeSchema = PrimitiveAttributeSchema | ObjectAttributeSchema | ArrayAttributeSchema;
 /** Actor type declaration with attribute schema. */
 interface ActorDeclaration {
-    readonly attributes: Record<string, AttributeType>;
+    readonly attributes: Record<string, AttributeSchema>;
 }
 /** Global role definition derived from actor attributes. */
 interface GlobalRole {
@@ -190,7 +259,7 @@ interface ResourceBlock {
     readonly roles: string[];
     readonly permissions: string[];
     /** Optional typed attribute declarations for this resource type. */
-    readonly attributes?: Record<string, AttributeType>;
+    readonly attributes?: Record<string, AttributeSchema>;
     /** Relations map field names to target resource type names (simplified). */
     readonly relations?: Record<string, string>;
     readonly grants?: Record<string, string[]>;
@@ -324,6 +393,13 @@ declare class DepthLimitError extends Error {
     readonly limitType: "condition" | "derivation";
     constructor(message: string, limit: number, limitType: "condition" | "derivation");
 }
+/** Thrown when an actor is forbidden from performing an action. */
+declare class ForbiddenError extends Error {
+    readonly actor: ActorRef;
+    readonly action: string;
+    readonly resourceType: string;
+    constructor(actor: ActorRef, action: string, resourceType: string);
+}
 
 /**
  * A serializable map of permissions keyed by "Type:id".
@@ -370,4 +446,4 @@ declare class TorideClient<S extends TorideSchema = DefaultSchema> {
     permittedActions<R extends S["resources"]>(resource: ClientResourceRef<S, R>): S["permissionMap"][R][];
 }
 
-export { type ActorRef as A, type BatchCheckItem as B, type CheckOptions as C, type DefaultSchema as D, type ExplainResult as E, type FieldAccessDef as F, type GlobalRole as G, type MatchedRule as M, type Policy as P, type QueryEvent as Q, type ResourceRef as R, type SimpleConditions as S, type TorideSchema as T, ValidationError as V, type TorideOptions as a, type PermissionSnapshot as b, type TestCase as c, type Resolvers as d, type ActorDeclaration as e, type AttributeType as f, type ClientResourceRef as g, type ConditionExpression as h, type ConditionOperator as i, type ConditionValue as j, CycleError as k, type DecisionEvent as l, DepthLimitError as m, type DerivedRoleEntry as n, type DerivedRoleTrace as o, type EvaluatorFn as p, type ResolvedRolesDetail as q, type ResourceBlock as r, type ResourceResolver as s, type Rule as t, TorideClient as u, CLIENT_VERSION as v };
+export { type ActorRef as A, type BatchCheckItem as B, type CheckOptions as C, type DefaultSchema as D, type ExplainResult as E, type FieldAccessDef as F, type GlobalRole as G, type VirtualFieldMapping as H, type VirtualFieldMappingFor as I, type VirtualFieldsConfig as J, CLIENT_VERSION as K, type MatchedRule as M, type ObjectAttributeSchema as O, type Policy as P, type QueryEvent as Q, type ResourceRef as R, type SimpleConditions as S, type TorideSchema as T, ValidationError as V, type TorideOptions as a, type PermissionSnapshot as b, type TestCase as c, type Resolvers as d, type ActorDeclaration as e, type ArrayAttributeSchema as f, type AttributeSchema as g, type AttributeType as h, type ClientResourceRef as i, type ConditionExpression as j, type ConditionOperator as k, type ConditionValue as l, CycleError as m, type DecisionEvent as n, DepthLimitError as o, type DerivedRoleEntry as p, type DerivedRoleTrace as q, type EvaluatorFn as r, ForbiddenError as s, type PayloadRelations as t, type PrimitiveAttributeSchema as u, type ResolvedRolesDetail as v, type ResourceBlock as w, type ResourceResolver as x, type Rule as y, TorideClient as z };

package/dist/client.d.ts

@@ -1 +1 @@
-export { v as CLIENT_VERSION, g as ClientResourceRef, b as PermissionSnapshot, u as TorideClient } from './client-aExMng5T.js';
+export { K as CLIENT_VERSION, i as ClientResourceRef, b as PermissionSnapshot, z as TorideClient } from './client-CBp3admQ.js';

package/dist/index.d.ts

@@ -1,5 +1,64 @@
-import { P as Policy, T as TorideSchema, D as DefaultSchema, a as TorideOptions, A as ActorRef, R as ResourceRef, C as CheckOptions, E as ExplainResult, b as PermissionSnapshot, B as BatchCheckItem, c as TestCase, d as Resolvers } from './client-aExMng5T.js';
-export { e as ActorDeclaration, f as AttributeType, g as ClientResourceRef, h as ConditionExpression, i as ConditionOperator, j as ConditionValue, k as CycleError, l as DecisionEvent, m as DepthLimitError, n as DerivedRoleEntry, o as DerivedRoleTrace, p as EvaluatorFn, F as FieldAccessDef, G as GlobalRole, M as MatchedRule, Q as QueryEvent, q as ResolvedRolesDetail, r as ResourceBlock, s as ResourceResolver, t as Rule, S as SimpleConditions, u as TorideClient, V as ValidationError } from './client-aExMng5T.js';
+import * as v from 'valibot';
+import { P as Policy, T as TorideSchema, D as DefaultSchema, a as TorideOptions, A as ActorRef, R as ResourceRef, C as CheckOptions, E as ExplainResult, b as PermissionSnapshot, B as BatchCheckItem, c as TestCase, d as Resolvers } from './client-CBp3admQ.js';
+export { e as ActorDeclaration, f as ArrayAttributeSchema, g as AttributeSchema, h as AttributeType, i as ClientResourceRef, j as ConditionExpression, k as ConditionOperator, l as ConditionValue, m as CycleError, n as DecisionEvent, o as DepthLimitError, p as DerivedRoleEntry, q as DerivedRoleTrace, r as EvaluatorFn, F as FieldAccessDef, s as ForbiddenError, G as GlobalRole, M as MatchedRule, O as ObjectAttributeSchema, t as PayloadRelations, u as PrimitiveAttributeSchema, Q as QueryEvent, v as ResolvedRolesDetail, w as ResourceBlock, x as ResourceResolver, y as Rule, S as SimpleConditions, z as TorideClient, V as ValidationError, H as VirtualFieldMapping, I as VirtualFieldMappingFor, J as VirtualFieldsConfig } from './client-CBp3admQ.js';
+
+/**
+ * ConditionExpression: recursive type using lazy().
+ * Either simple conditions, { any: [...] }, or { all: [...] }.
+ */
+declare const ConditionExpressionSchema: v.GenericSchema<unknown>;
+declare const PolicySchema: v.ObjectSchema<{
+    readonly version: v.LiteralSchema<"1", undefined>;
+    readonly actors: v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+        readonly attributes: v.RecordSchema<v.StringSchema<undefined>, any, undefined>;
+    }, undefined>, undefined>;
+    readonly global_roles: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+        readonly actor_type: v.StringSchema<undefined>;
+        readonly when: v.GenericSchema<unknown>;
+    }, undefined>, undefined>, undefined>;
+    readonly resources: v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+        readonly roles: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+        readonly permissions: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+        readonly attributes: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, any, undefined>, undefined>;
+        readonly relations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        readonly grants: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>, undefined>;
+        readonly derived_roles: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly role: v.StringSchema<undefined>;
+            readonly from_global_role: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly from_role: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly on_relation: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly from_relation: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly actor_type: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly when: v.OptionalSchema<v.GenericSchema<unknown>, undefined>;
+        }, undefined>, undefined>, undefined>;
+        readonly rules: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly effect: v.PicklistSchema<["permit", "forbid"], undefined>;
+            readonly roles: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
+            readonly permissions: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+            readonly when: v.GenericSchema<unknown>;
+        }, undefined>, undefined>, undefined>;
+        readonly field_access: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+            readonly read: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
+            readonly update: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>, undefined>, undefined>;
+    }, undefined>, undefined>;
+    readonly tests: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        readonly name: v.StringSchema<undefined>;
+        readonly actor: v.ObjectSchema<{
+            readonly type: v.StringSchema<undefined>;
+            readonly id: v.StringSchema<undefined>;
+            readonly attributes: v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>;
+        }, undefined>;
+        readonly resolvers: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
+        readonly action: v.StringSchema<undefined>;
+        readonly resource: v.ObjectSchema<{
+            readonly type: v.StringSchema<undefined>;
+            readonly id: v.StringSchema<undefined>;
+            readonly attributes: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+        readonly expected: v.PicklistSchema<["allow", "deny"], undefined>;
+    }, undefined>, undefined>, undefined>;
+}, undefined>;
 
 /**
  * Parse and validate a YAML string into a typed Policy object.
@@ -151,13 +210,11 @@ type Constraint = FieldEqConstraint | FieldNeqConstraint | FieldGtConstraint | F
 type LeafConstraint = FieldEqConstraint | FieldNeqConstraint | FieldGtConstraint | FieldGteConstraint | FieldLtConstraint | FieldLteConstraint | FieldInConstraint | FieldNinConstraint | FieldExistsConstraint | FieldIncludesConstraint | FieldContainsConstraint;
 /** Result of partial evaluation, tagged with resource type R (phantom). */
 type ConstraintResult<R extends string = string> = {
-    readonly unrestricted: true;
-    readonly __resource?: R;
-} | {
-    readonly forbidden: true;
+    readonly ok: true;
+    readonly constraint: Constraint | null;
     readonly __resource?: R;
 } | {
-    readonly constraints: Constraint;
+    readonly ok: false;
     readonly __resource?: R;
 };
 /**
@@ -244,11 +301,11 @@ declare class Toride<S extends TorideSchema = DefaultSchema> {
      * T064: Translate constraint AST using an adapter.
      * Dispatches each constraint node to the adapter's methods.
      *
-     * Accepts ConstraintResult<R> from buildConstraints() and returns
+     * Accepts Constraint (the AST) from buildConstraints() and returns
      * TQueryMap[R] — the adapter's mapped output type for resource R.
-     * The resource type R is inferred from the ConstraintResult phantom type.
+     * Callers must check result.ok and result.constraint before calling this method.
      */
-    translateConstraints<R extends string, TQueryMap extends Record<string, unknown>>(constraints: ConstraintResult<R>, adapter: ConstraintAdapter<TQueryMap>): TQueryMap[R];
+    translateConstraints<R extends string, TQueryMap extends Record<string, unknown>>(constraint: Constraint, adapter: ConstraintAdapter<TQueryMap>): TQueryMap[R];
     /**
      * T072: Fire onDecision audit callback via microtask (non-blocking).
      * Errors are silently swallowed to prevent audit failures from affecting authorization.
@@ -319,4 +376,4 @@ declare function runTestCases(policy: Policy, tests: TestCase[]): Promise<TestRe
 
 declare const VERSION = "0.0.1";
 
-export { ActorRef, BatchCheckItem, CheckOptions, type Constraint, type ConstraintAdapter, type ConstraintResult, DefaultSchema, ExplainResult, type LeafConstraint, PermissionSnapshot, Policy, Resolvers, ResourceRef, type StrictValidationResult, TestCase, type TestFileResult, type TestResult, Toride, TorideOptions, TorideSchema, VERSION, type ValidationDiagnostic, type ValidationResult, createMockResolver, createToride, loadJson, loadYaml, mergePolicies, parseInlineTests, parseTestFile, runTestCases, validatePolicy, validatePolicyResult, validatePolicyStrict };
+export { ActorRef, BatchCheckItem, CheckOptions, ConditionExpressionSchema, type Constraint, type ConstraintAdapter, type ConstraintResult, DefaultSchema, ExplainResult, type LeafConstraint, PermissionSnapshot, Policy, PolicySchema, Resolvers, ResourceRef, type StrictValidationResult, TestCase, type TestFileResult, type TestResult, Toride, TorideOptions, TorideSchema, VERSION, type ValidationDiagnostic, type ValidationResult, createMockResolver, createToride, loadJson, loadYaml, mergePolicies, parseInlineTests, parseTestFile, runTestCases, validatePolicy, validatePolicyResult, validatePolicyStrict };