@o3co/auth.policy-verifier.builtins 0.1.1 → 0.2.0

package/README.ja.md

@@ -16,12 +16,15 @@ npm install @o3co/auth.policy-verifier.builtins
 | --- | --- | --- | --- |
 | `PayloadScopeCollector` | `payload.scope`（スペース区切り文字列） | `ATTR_SCOPES: string[]` | なし |
 | `PayloadSubjectIdCollector` | `payload.sub`、`payload.azp` | `ATTR_USER_ID`、`ATTR_CLIENT_ID` | なし |
-| `RequestContextCollector` | `context.requestContext.ip` | `ATTR_CLIENT_IP` | なし |
 | `StaticPermissionCollector` | — | `ATTR_PERMISSIONS: string[]` | `{ permissions: string[] }` |
 | `StaticRoleCollector` | — | `ATTR_ROLES: Role[]` | `{ roles: Role[] }` |
 
 `StaticPermissionCollector` と `StaticRoleCollector` は、リクエストのコンテキストに関わらず、コンストラクタに渡した値を常に出力します。
 
+### `requestContext` 向けの組み込みコレクターは提供しない
+
+本エンジンは `CollectorContext.requestContext` をそのまま attribute に展開するコレクターを提供しません。`requestContext` の形は利用側プロジェクトの transport/interceptor が定めるため、その解釈はプロジェクト側の責務です。必要なフィールドごとに焦点を絞った `AttributeCollector` を実装し、その中で値の型・形状を検証し、プロジェクト固有の定数キーで格納してください。詳細と具体例は [AGENTS.md — Core Vocabulary Scope](../../AGENTS.md#core-vocabulary-scope) を参照してください。
+
 ## Rules
 
 ### HasPermission
@@ -49,6 +52,17 @@ new HasScope(scope: string)
 - `ATTR_SCOPES` 内のプレフィックスなし scope 文字列（例: `"resource"`）は、比較前に `"read:resource"` へ正規化されます。
 - 正規化後に大文字・小文字を区別しない完全一致で比較します。
 
+### AttrMatchRule
+
+```ts
+new AttrMatchRule({ a: string, b: string, group?: string })
+```
+
+- `code`: `"attr_mismatch"`。
+- `attrs.get(a)` と `attrs.get(b)` がいずれも非空文字列かつ等しいときに `true` を返します。それ以外はすべて `false`（fail closed）。
+- 純粋な述語です。`CollectorContext` を参照しません。比較対象の値はプロジェクト側の上流 `AttributeCollector` が attrs に格納し、プロジェクト側の `RuleCollector` でこの Rule を構築します。
+- `ruleType` の既定値は `"attr_match:${a}:${b}"` です。評価器は `ruleType` 内で OR、`ruleType` 間で AND を取るので、この既定値により異なる2つの比較は AND（両方必要）として扱われます。2つの比較を OR 結合したい場合（例「DID または email で一致」）は、両方の Rule に同じ `group` を指定してください。その `group` 値が `ruleType` として使われます。
+
 ## Rule Collectors
 
 | 名前 | 導出する permission / scope | 返り値 |
@@ -88,7 +102,6 @@ import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
 | --- | --- | --- |
 | `attributeCollector` | `"PayloadScopeCollector"` | `() => new PayloadScopeCollector()` |
 | `attributeCollector` | `"PayloadSubjectIdCollector"` | `() => new PayloadSubjectIdCollector()` |
-| `attributeCollector` | `"RequestContextCollector"` | `() => new RequestContextCollector()` |
 | `attributeCollector` | `"StaticPermissionCollector"` | `(config) => new StaticPermissionCollector(config)` |
 | `attributeCollector` | `"StaticRoleCollector"` | `(config) => new StaticRoleCollector(config)` |
 | `ruleCollector` | `"ResourceActionScopeRuleCollector"` | `() => new ResourceActionScopeRuleCollector()` |

package/README.md

@@ -16,12 +16,15 @@ All collectors implement `AttributeCollector`.
 | --- | --- | --- | --- |
 | `PayloadScopeCollector` | `payload.scope` (space-separated string) | `ATTR_SCOPES: string[]` | none |
 | `PayloadSubjectIdCollector` | `payload.sub`, `payload.azp` | `ATTR_USER_ID`, `ATTR_CLIENT_ID` | none |
-| `RequestContextCollector` | `context.requestContext.ip` | `ATTR_CLIENT_IP` | none |
 | `StaticPermissionCollector` | — | `ATTR_PERMISSIONS: string[]` | `{ permissions: string[] }` |
 | `StaticRoleCollector` | — | `ATTR_ROLES: Role[]` | `{ roles: Role[] }` |
 
 `StaticPermissionCollector` and `StaticRoleCollector` always emit the values supplied at construction time, regardless of request context.
 
+### No built-in collector for `requestContext`
+
+The engine does not ship a collector that expands `CollectorContext.requestContext` into attributes. The shape of `requestContext` is defined by each consuming project's transport/interceptor, so interpreting it is a project concern. Write a focused `AttributeCollector` for each field you need to promote — validate its shape there, and store it under a project-specific constant key. See [AGENTS.md — Core Vocabulary Scope](../../AGENTS.md#core-vocabulary-scope) for the rationale and a worked example.
+
 ## Rules
 
 ### HasPermission
@@ -49,6 +52,17 @@ new HasScope(scope: string)
 - A bare scope string `"resource"` in `ATTR_SCOPES` is normalized to `"read:resource"` before comparison.
 - Matching is case-insensitive exact match after normalization.
 
+### AttrMatchRule
+
+```ts
+new AttrMatchRule({ a: string, b: string, group?: string })
+```
+
+- `code`: `"attr_mismatch"`.
+- Passes when `attrs.get(a)` and `attrs.get(b)` are both non-empty strings and equal. Any other case returns `false` (fail closed).
+- Pure predicate — does not read `CollectorContext`. Consuming projects provide the two values to compare through upstream `AttributeCollector`s and wire the rule through their own `RuleCollector`.
+- `ruleType` defaults to `"attr_match:${a}:${b}"`. The evaluator ORs rules within a `ruleType` and ANDs across different `ruleType`s, so the default ensures two independent comparisons are AND-combined (required together). Pass `group` explicitly when you want two comparisons to be OR-combined (for example, "identify by DID or by email") — both rules then share the provided `group` as their `ruleType`.
+
 ## Rule Collectors
 
 | Name | Derives permission/scope | Returns |
@@ -88,7 +102,6 @@ import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
 | --- | --- | --- |
 | `attributeCollector` | `"PayloadScopeCollector"` | `() => new PayloadScopeCollector()` |
 | `attributeCollector` | `"PayloadSubjectIdCollector"` | `() => new PayloadSubjectIdCollector()` |
-| `attributeCollector` | `"RequestContextCollector"` | `() => new RequestContextCollector()` |
 | `attributeCollector` | `"StaticPermissionCollector"` | `(config) => new StaticPermissionCollector(config)` |
 | `attributeCollector` | `"StaticRoleCollector"` | `(config) => new StaticRoleCollector(config)` |
 | `ruleCollector` | `"ResourceActionScopeRuleCollector"` | `() => new ResourceActionScopeRuleCollector()` |

package/dist/__tests__/module.test.mjs

@@ -18,7 +18,6 @@ describe("builtinCollectorsModule", () => {
         });
         expect(attributeCollectorRegistry.has("PayloadScopeCollector")).toBe(true);
         expect(attributeCollectorRegistry.has("PayloadSubjectIdCollector")).toBe(true);
-        expect(attributeCollectorRegistry.has("RequestContextCollector")).toBe(true);
         expect(attributeCollectorRegistry.has("StaticPermissionCollector")).toBe(true);
         expect(attributeCollectorRegistry.has("StaticRoleCollector")).toBe(true);
     });

package/dist/__tests__/rules/AttrMatchRule.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AttrMatchRule.test.d.mts.map

package/dist/__tests__/rules/AttrMatchRule.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrMatchRule.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrMatchRule.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/AttrMatchRule.test.mjs

@@ -0,0 +1,71 @@
+import { describe, expect, it } from "vitest";
+import { AttrMatchRule } from "#/rules/AttrMatchRule.mjs";
+describe("AttrMatchRule", () => {
+    const rule = new AttrMatchRule({ a: "x", b: "y" });
+    it("returns true when both attrs are non-empty strings and equal", () => {
+        const attrs = new Map([
+            ["x", "same"],
+            ["y", "same"],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("returns false when the two attrs differ", () => {
+        const attrs = new Map([
+            ["x", "foo"],
+            ["y", "bar"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when the first attr is missing", () => {
+        const attrs = new Map([["y", "same"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when the second attr is missing", () => {
+        const attrs = new Map([["x", "same"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when either attr is a non-string value", () => {
+        const attrs = new Map([
+            ["x", 42],
+            ["y", 42],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when either attr is an empty string", () => {
+        const attrs = new Map([
+            ["x", ""],
+            ["y", ""],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("derives ruleType from the pair of attribute keys by default", () => {
+        // Distinct pairs must produce distinct ruleType values. Otherwise
+        // evaluate() would OR them together within a single group, which
+        // weakens "require both comparisons to pass" intent.
+        const r1 = new AttrMatchRule({ a: "userId", b: "sub" });
+        const r2 = new AttrMatchRule({ a: "orgId", b: "org" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+        expect(r1.ruleType).toContain("userId");
+        expect(r1.ruleType).toContain("sub");
+    });
+    it("uses the provided group override when set, to enable explicit grouping", () => {
+        // When callers want two comparisons to be OR'd together (e.g. match by
+        // either DID or email), they opt in by passing the same `group`.
+        const r1 = new AttrMatchRule({ a: "x", b: "y", group: "identity" });
+        const r2 = new AttrMatchRule({ a: "e", b: "f", group: "identity" });
+        expect(r1.ruleType).toBe("identity");
+        expect(r2.ruleType).toBe("identity");
+    });
+    it("has code 'attr_mismatch'", () => {
+        expect(rule.code).toBe("attr_mismatch");
+    });
+    it("message describes the contract (both attrs must be non-empty strings and equal)", () => {
+        // The message should make the rule's contract explicit, not just say "do not match",
+        // because verify() fails closed on missing, non-string, and empty inputs too.
+        expect(rule.message).toContain("x");
+        expect(rule.message).toContain("y");
+        expect(rule.message).toMatch(/non-empty/i);
+        expect(rule.message).toMatch(/equal/i);
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/ResourceActionScopeRuleCollector.test.mjs

@@ -1,14 +1,14 @@
 import { describe, expect, it } from "vitest";
 import { ResourceActionScopeRuleCollector } from "#/rules/ResourceActionScopeRuleCollector.mjs";
-const makeContext = (resourceType, action) => ({
-    payload: {},
+const makeContext = (resourceType, action, scope) => ({
+    payload: { ...(scope !== undefined ? { scope } : {}) },
     resource: { raw: `${resourceType}:1`, resourceType, resourceId: "1" },
     action,
 });
 describe("ResourceActionScopeRuleCollector", () => {
     const collector = new ResourceActionScopeRuleCollector();
     it("creates a HasScope rule with action:resourceType", async () => {
-        const rules = await collector.collect(makeContext("document", "read"));
+        const rules = await collector.collect(makeContext("document", "read", "read:document"));
         expect(rules).toHaveLength(1);
         expect(rules[0].ruleType).toBe("scope");
         const attrs = new Map([["scopes", ["read:document"]]]);
@@ -16,12 +16,33 @@ describe("ResourceActionScopeRuleCollector", () => {
     });
     it("creates correct scope for nested resource types", async () => {
         const ctx = {
-            payload: {},
+            payload: { scope: "update:project_member" },
             resource: { raw: "project:1.member:2", resourceType: "project_member", resourceId: "2" },
             action: "update",
         };
         const rules = await collector.collect(ctx);
+        expect(rules).toHaveLength(1);
         const attrs = new Map([["scopes", ["update:project_member"]]]);
         expect(rules[0].verify(attrs)).toBe(true);
     });
+    it("returns no rules when payload has no scope claim", async () => {
+        const ctx = makeContext("document", "read");
+        // payload has no scope — simulates DID JWT
+        const rules = await collector.collect(ctx);
+        expect(rules).toHaveLength(0);
+    });
+    it("returns HasScope rule when payload has scope claim", async () => {
+        const ctx = {
+            payload: { scope: "read:document" },
+            resource: { raw: "document:1", resourceType: "document", resourceId: "1" },
+            action: "read",
+        };
+        const rules = await collector.collect(ctx);
+        expect(rules).toHaveLength(1);
+        expect(rules[0].ruleType).toBe("scope");
+    });
+    it("still generates HasScope rule when scope is empty string", async () => {
+        const rules = await collector.collect(makeContext("document", "read", ""));
+        expect(rules).toHaveLength(1);
+    });
 });

package/dist/index.d.mts

@@ -1,10 +1,10 @@
 export { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
 export { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
-export { RequestContextCollector } from "./collectors/RequestContextCollector.mjs";
 export { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 export { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 export { builtinCollectorsModule } from "./module.mjs";
 export { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
+export { AttrMatchRule, type AttrMatchRuleConfig } from "./rules/AttrMatchRule.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";
 export { ResourceActionPermissionRuleCollector } from "./rules/ResourceActionPermissionRuleCollector.mjs";

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC"}

package/dist/index.mjs

@@ -1,7 +1,6 @@
 // Collectors
 export { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
 export { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
-export { RequestContextCollector } from "./collectors/RequestContextCollector.mjs";
 export { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 export { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 // Module
@@ -9,6 +8,7 @@ export { builtinCollectorsModule } from "./module.mjs";
 // Resource
 export { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
 // Rules
+export { AttrMatchRule } from "./rules/AttrMatchRule.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";
 export { ResourceActionPermissionRuleCollector } from "./rules/ResourceActionPermissionRuleCollector.mjs";

package/dist/module.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAU9D,eAAO,MAAM,uBAAuB,EAAE,MAyCrC,CAAC"}
+{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAS9D,eAAO,MAAM,uBAAuB,EAAE,MAqCrC,CAAC"}

package/dist/module.mjs

@@ -1,6 +1,5 @@
 import { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
 import { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
-import { RequestContextCollector } from "./collectors/RequestContextCollector.mjs";
 import { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 import { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 import { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
@@ -12,7 +11,6 @@ export const builtinCollectorsModule = {
         // Attribute collector factories
         context.attributeCollectorRegistry.register("PayloadScopeCollector", () => new PayloadScopeCollector());
         context.attributeCollectorRegistry.register("PayloadSubjectIdCollector", () => new PayloadSubjectIdCollector());
-        context.attributeCollectorRegistry.register("RequestContextCollector", () => new RequestContextCollector());
         context.attributeCollectorRegistry.register("StaticPermissionCollector", (config) => new StaticPermissionCollector(config));
         context.attributeCollectorRegistry.register("StaticRoleCollector", (config) => new StaticRoleCollector(config));
         // Rule collector factories

package/dist/rules/AttrMatchRule.d.mts

@@ -0,0 +1,42 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+export interface AttrMatchRuleConfig {
+    a: string;
+    b: string;
+    /**
+     * Optional grouping key used as `ruleType`. See the class comment for
+     * how this interacts with the evaluator's OR-within-group /
+     * AND-across-groups semantics.
+     */
+    group?: string;
+}
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are equal. A pure predicate over the attributes map —
+ * `verify(attrs)` does not touch `CollectorContext` and does not close
+ * over request state.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. If every `AttrMatchRule` shared one fixed `ruleType`,
+ * two instances collected for different comparisons (e.g. subject vs.
+ * subscriber AND tenant vs. request-tenant) would be OR'd together and
+ * authorization would weaken silently.
+ *
+ * To default to the safe reading of "each distinct pair of attributes
+ * is a separate AND-combined requirement", `ruleType` is derived from
+ * `a` and `b` when `group` is not given: `attr_match:{a}:{b}`.
+ *
+ * When callers actually want two comparisons to be OR-combined
+ * (alternative identities, for example), they opt in explicitly by
+ * passing the same `group` to both rule instances.
+ */
+export declare class AttrMatchRule implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_mismatch";
+    readonly message: string;
+    constructor(config: AttrMatchRuleConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrMatchRule.d.mts.map

package/dist/rules/AttrMatchRule.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAExE,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,mBAAmB;IAKxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}

package/dist/rules/AttrMatchRule.mjs

@@ -0,0 +1,42 @@
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are equal. A pure predicate over the attributes map —
+ * `verify(attrs)` does not touch `CollectorContext` and does not close
+ * over request state.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. If every `AttrMatchRule` shared one fixed `ruleType`,
+ * two instances collected for different comparisons (e.g. subject vs.
+ * subscriber AND tenant vs. request-tenant) would be OR'd together and
+ * authorization would weaken silently.
+ *
+ * To default to the safe reading of "each distinct pair of attributes
+ * is a separate AND-combined requirement", `ruleType` is derived from
+ * `a` and `b` when `group` is not given: `attr_match:{a}:{b}`.
+ *
+ * When callers actually want two comparisons to be OR-combined
+ * (alternative identities, for example), they opt in explicitly by
+ * passing the same `group` to both rule instances.
+ */
+export class AttrMatchRule {
+    config;
+    ruleType;
+    code = "attr_mismatch";
+    message;
+    constructor(config) {
+        this.config = config;
+        this.ruleType = config.group ?? `attr_match:${config.a}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} and ${config.b} must both be non-empty strings and equal.`;
+    }
+    verify(attrs) {
+        const a = attrs.get(this.config.a);
+        const b = attrs.get(this.config.b);
+        if (typeof a !== "string" || a.length === 0)
+            return false;
+        if (typeof b !== "string" || b.length === 0)
+            return false;
+        return a === b;
+    }
+}

package/dist/rules/ResourceActionScopeRuleCollector.d.mts

@@ -1,4 +1,13 @@
 import type { CollectorContext, Rule, RuleCollector } from "@o3co/auth.policy-verifier.core";
+/**
+ * Generates a HasScope rule derived from the request action and resource type.
+ *
+ * When the JWT payload has no `scope` claim (e.g. DID-grant tokens), no rules
+ * are generated. The scope rule group is therefore absent from AND-evaluation,
+ * allowing other rule groups to decide independently.
+ *
+ * OAuth JWTs that carry a `scope` claim are validated as before.
+ */
 export declare class ResourceActionScopeRuleCollector implements RuleCollector {
     collect(context: CollectorContext): Promise<Rule[]>;
 }

package/dist/rules/ResourceActionScopeRuleCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../src/rules/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F,qBAAa,gCAAiC,YAAW,aAAa;IAC/D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAIzD"}
+{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../src/rules/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,YAAW,aAAa;IAC/D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAOzD"}

package/dist/rules/ResourceActionScopeRuleCollector.mjs

@@ -1,6 +1,18 @@
 import { HasScope } from "./HasScope.mjs";
+/**
+ * Generates a HasScope rule derived from the request action and resource type.
+ *
+ * When the JWT payload has no `scope` claim (e.g. DID-grant tokens), no rules
+ * are generated. The scope rule group is therefore absent from AND-evaluation,
+ * allowing other rule groups to decide independently.
+ *
+ * OAuth JWTs that carry a `scope` claim are validated as before.
+ */
 export class ResourceActionScopeRuleCollector {
     async collect(context) {
+        if (context.payload.scope === undefined) {
+            return [];
+        }
         const scope = `${context.action}:${context.resource.resourceType}`;
         return [new HasScope(scope)];
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.builtins",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -28,7 +28,7 @@
     }
   },
   "dependencies": {
-    "@o3co/auth.policy-verifier.core": "0.1.1"
+    "@o3co/auth.policy-verifier.core": "0.2.0"
   },
   "devDependencies": {
     "@types/node": "^25.1.0",

package/dist/__tests__/collectors/RequestContextCollector.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=RequestContextCollector.test.d.mts.map

package/dist/__tests__/collectors/RequestContextCollector.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RequestContextCollector.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/collectors/RequestContextCollector.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/collectors/RequestContextCollector.test.mjs

@@ -1,42 +0,0 @@
-// Copyright 2026 1o1 Co. Ltd.
-// SPDX-License-Identifier: Apache-2.0
-import { ATTR_CLIENT_IP } from "@o3co/auth.policy-verifier.core";
-import { describe, expect, it } from "vitest";
-import { RequestContextCollector } from "#/collectors/RequestContextCollector.mjs";
-const makeContext = (requestContext) => ({
-    payload: {},
-    resource: { raw: "test:1", resourceType: "test", resourceId: "1" },
-    action: "read",
-    requestContext,
-});
-describe("RequestContextCollector", () => {
-    const collector = new RequestContextCollector();
-    it("extracts clientIp from requestContext.ip", async () => {
-        const attrs = await collector.collect(makeContext({ ip: "203.0.113.1" }));
-        expect(attrs.get(ATTR_CLIENT_IP)).toBe("203.0.113.1");
-    });
-    it("returns empty when requestContext is undefined", async () => {
-        const attrs = await collector.collect(makeContext());
-        expect(attrs.size).toBe(0);
-    });
-    it("returns empty when ip is not a string", async () => {
-        const attrs = await collector.collect(makeContext({ ip: 12345 }));
-        expect(attrs.size).toBe(0);
-    });
-    it("returns empty when ip is missing from requestContext", async () => {
-        const attrs = await collector.collect(makeContext({ other: "value" }));
-        expect(attrs.size).toBe(0);
-    });
-    it("returns empty when ip is empty string", async () => {
-        const attrs = await collector.collect(makeContext({ ip: "" }));
-        expect(attrs.size).toBe(0);
-    });
-    it("returns empty when ip is whitespace only", async () => {
-        const attrs = await collector.collect(makeContext({ ip: "   " }));
-        expect(attrs.size).toBe(0);
-    });
-    it("trims whitespace from ip", async () => {
-        const attrs = await collector.collect(makeContext({ ip: " 10.0.0.1 " }));
-        expect(attrs.get(ATTR_CLIENT_IP)).toBe("10.0.0.1");
-    });
-});

package/dist/collectors/RequestContextCollector.d.mts

@@ -1,5 +0,0 @@
-import type { AttributeCollector, Attributes, CollectorContext } from "@o3co/auth.policy-verifier.core";
-export declare class RequestContextCollector implements AttributeCollector {
-    collect(context: CollectorContext): Promise<Attributes>;
-}
-//# sourceMappingURL=RequestContextCollector.d.mts.map

package/dist/collectors/RequestContextCollector.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RequestContextCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/RequestContextCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAGzC,qBAAa,uBAAwB,YAAW,kBAAkB;IAC3D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAS7D"}

package/dist/collectors/RequestContextCollector.mjs

@@ -1,15 +0,0 @@
-// Copyright 2026 1o1 Co. Ltd.
-// SPDX-License-Identifier: Apache-2.0
-import { ATTR_CLIENT_IP } from "@o3co/auth.policy-verifier.core";
-export class RequestContextCollector {
-    async collect(context) {
-        const attrs = new Map();
-        const raw = context.requestContext?.ip;
-        if (typeof raw === "string") {
-            const ip = raw.trim();
-            if (ip)
-                attrs.set(ATTR_CLIENT_IP, ip);
-        }
-        return attrs;
-    }
-}