@o3co/auth.policy-verifier.builtins 0.15.0 → 0.16.0

package/dist/rules/AttrPairEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,aAAc,YAAW,IAAI;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,mBAAmB;IAWvC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}
+{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,aAAc,YAAW,IAAI;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,mBAAmB;IAWvC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairEqual.mjs

@@ -6,11 +6,10 @@ import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
  * strings, and are strictly equal. No type coercion is performed: both
  * attribute values must be non-empty strings.
  *
- * ## Backward compatibility
+ * ## String-only
  *
- * AttrPairEqual deliberately retains the string-only semantic of the legacy
- * AttrMatchRule. Do not widen verify() to accept numbers or booleans — the
- * Phase 4 AttrMatchRule alias depends on this invariant.
+ * The deprecated `AttrMatchRule` inherits verify() from this rule and must stay
+ * string-only: do not widen verify() to accept numbers or booleans.
  *
  * ## Grouping and the default ruleType
  *
@@ -23,11 +22,9 @@ import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrPairEqual {
     ruleType;

package/dist/rules/AttrPairNotEqual.d.mts

@@ -25,11 +25,9 @@ export interface AttrPairNotEqualConfig {
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrPairNotEqual implements Rule {
     readonly ruleType: string;

package/dist/rules/AttrPairNotEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,sBAAsB;IAW1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}
+{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,sBAAsB;IAW1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairNotEqual.mjs

@@ -22,11 +22,9 @@ import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrPairNotEqual {
     ruleType;

package/dist/rules/HasPermission.d.mts

@@ -8,13 +8,11 @@ import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
  *
  * Comparison is **exact and case-sensitive**, the same philosophy `HasScope`
  * applies to scope values and `DotNotationResourceParser` applies to resource
- * identifiers (#116, #117): compare what was written, never a normalized guess
- * at what was meant. This rule matched case-insensitively until #155, which
- * put permissions on the wrong side of the line those two argued —
- * `ResourceActionPermissionRuleCollector` builds `{resource.raw}.perm:{action}`
- * from the case-preserving parser, so `Project:1` and `project:1` were two
- * namespaces to a scope rule and one to a permission rule. One vocabulary, one
- * matching discipline.
+ * identifiers: compare what was written, never a normalized guess at what was
+ * meant. `ResourceActionPermissionRuleCollector` builds
+ * `{resource.raw}.perm:{action}` from the case-preserving parser, so
+ * `Project:1` and `project:1` are two namespaces to a permission rule, as they
+ * are to a scope rule.
  *
  * ## Wildcards
  *
@@ -24,10 +22,11 @@ import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
  * no-normalization rule: a wildcard is match structure the policy author
  * **wrote into the grant**, not a rewrite of both sides behind their back. The
  * literal halves around the `*` still compare exactly and case-sensitively.
- * Multiple wildcards are rejected outright because the two-part split would
- * silently drop segments and over-grant.
+ * A grant with more than one `*` is not read as a pattern (only an exact
+ * match passes it), because the two-part split would silently drop segments
+ * and over-grant.
  *
- * The two halves must not overlap in the required permission (#180): a grant
+ * The two halves must not overlap in the required permission: a grant
  * of `"posts.*.read"` does not match `"posts.read"`, where the single `.`
  * would satisfy `startsWith` and `endsWith` at once. The wildcard may match
  * the empty string, but each character of the required permission counts

package/dist/rules/HasPermission.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAoB1C,OAAO,CAAC,KAAK;CA0Bb"}
+{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAoB1C,OAAO,CAAC,KAAK;CAuBb"}

package/dist/rules/HasPermission.mjs

@@ -10,13 +10,11 @@ import { ATTR_PERMISSIONS, ATTR_ROLES } from "@o3co/auth.policy-verifier.core";
  *
  * Comparison is **exact and case-sensitive**, the same philosophy `HasScope`
  * applies to scope values and `DotNotationResourceParser` applies to resource
- * identifiers (#116, #117): compare what was written, never a normalized guess
- * at what was meant. This rule matched case-insensitively until #155, which
- * put permissions on the wrong side of the line those two argued —
- * `ResourceActionPermissionRuleCollector` builds `{resource.raw}.perm:{action}`
- * from the case-preserving parser, so `Project:1` and `project:1` were two
- * namespaces to a scope rule and one to a permission rule. One vocabulary, one
- * matching discipline.
+ * identifiers: compare what was written, never a normalized guess at what was
+ * meant. `ResourceActionPermissionRuleCollector` builds
+ * `{resource.raw}.perm:{action}` from the case-preserving parser, so
+ * `Project:1` and `project:1` are two namespaces to a permission rule, as they
+ * are to a scope rule.
  *
  * ## Wildcards
  *
@@ -26,10 +24,11 @@ import { ATTR_PERMISSIONS, ATTR_ROLES } from "@o3co/auth.policy-verifier.core";
  * no-normalization rule: a wildcard is match structure the policy author
  * **wrote into the grant**, not a rewrite of both sides behind their back. The
  * literal halves around the `*` still compare exactly and case-sensitively.
- * Multiple wildcards are rejected outright because the two-part split would
- * silently drop segments and over-grant.
+ * A grant with more than one `*` is not read as a pattern (only an exact
+ * match passes it), because the two-part split would silently drop segments
+ * and over-grant.
  *
- * The two halves must not overlap in the required permission (#180): a grant
+ * The two halves must not overlap in the required permission: a grant
  * of `"posts.*.read"` does not match `"posts.read"`, where the single `.`
  * would satisfy `startsWith` and `endsWith` at once. The wildcard may match
  * the empty string, but each character of the required permission counts
@@ -45,7 +44,7 @@ export class HasPermission {
         this.message = `User does not have required permission: ${permission}`;
     }
     verify(attrs) {
-        // Nothing about these values is taken on the cast's word (#180): both
+        // Nothing about these values is taken on the cast's word: both
         // arrive from collectors, and a store-backed one can hand back anything
         // — a non-array under either key, a role whose `permissions` is missing
         // or not an array, non-string entries. Every malformed shape is ignored
@@ -57,7 +56,7 @@ export class HasPermission {
         const roles = attrs.get(ATTR_ROLES);
         const fromRoles = (Array.isArray(roles) ? roles : []).flatMap((role) => Array.isArray(role?.permissions) ? role.permissions : []);
         const all = [...(Array.isArray(direct) ? direct : []), ...fromRoles];
-        // Non-string entries never match and never throw, as in HasScope (#116).
+        // Non-string entries never match and never throw, as in HasScope.
         return all.some((p) => typeof p === "string" && this.match(p, this.permission));
     }
     match(permission, required) {
@@ -66,17 +65,14 @@ export class HasPermission {
         if (permission === required)
             return true;
         if (permission.includes("*")) {
-            // Reject any granted permission that contains more than one wildcard.
-            // With 2+ wildcards, split("*") produces 3+ parts, but the destructuring
-            // `const [prefix, suffix] = ...` silently drops everything after the second
-            // segment. For example, "a*c*b" is treated as "a*c" (endsWith "c" instead of
-            // "b"), which can grant broader access than intended. Returning false is the
-            // safe default: deny rather than over-grant. Single-wildcard permissions
-            // (e.g. "posts.*" or "*.read") continue to work as before.
+            // A grant with more than one wildcard is not read as a pattern; only
+            // the exact match above passes it. The two-part split below would drop
+            // everything after the second segment ("a*c*b" read as "a*c") and
+            // over-grant.
             if ((permission.match(/\*/g) ?? []).length > 1)
                 return false;
             const [prefix, suffix] = permission.split("*");
-            // The halves must not overlap in `required` (#180): "posts.*.read"
+            // The halves must not overlap in `required`: "posts.*.read"
             // must not match "posts.read", where the single "." satisfies both
             // startsWith and endsWith. Length is the whole check — the wildcard
             // may match the empty string, but a character may only count toward

package/dist/rules/HasScope.d.mts

@@ -5,10 +5,10 @@ export interface HasScopeOptions {
      * Opt in to treating a bare granted scope (one containing no `:`) as
      * `read:<scope>` in addition to its literal value. Defaults to `false`.
      *
-     * This exists only for deployments whose issuer emits bare resource names
-     * and that relied on the rewrite before it became opt-in. It is off by
-     * default because the rewrite invents an action the issuer never wrote:
-     * a token granted `project` is silently promoted to `read:project`.
+     * This exists only for deployments whose issuer emits bare resource names.
+     * It is off by default because the rewrite invents an action the issuer
+     * never wrote: a token granted `project` is silently promoted to
+     * `read:project`.
      */
     allowBareScopeRewrite?: boolean;
 }
@@ -20,21 +20,18 @@ export interface HasScopeOptions {
  * Comparison is an **exact, case-sensitive string equality** against each value
  * in `ATTR_SCOPES`. OAuth 2.0 scope values are case-sensitive opaque strings
  * (RFC 6749 §3.3), so the verifier compares what the issuer wrote rather than a
- * normalized form of it:
- *
- * - `read:PROJECT` does **not** satisfy a `read:project` requirement.
- * - `read:project:restricted` is a value in its own right. It does not satisfy
- *   `read:project`, and `read:project` does not satisfy it. Nothing is split
- *   off at the second `:`; a scope the issuer deliberately narrowed must not
- *   collapse into the broader one.
+ * normalized form of it: `read:PROJECT` does **not** satisfy `read:project`,
+ * and `read:project:restricted` neither satisfies `read:project` nor is
+ * satisfied by it — a scope the issuer deliberately narrowed must not collapse
+ * into the broader one.
  *
  * ## Bare-scope rewrite
  *
  * A granted scope carrying no `:` is compared literally unless
  * `{ allowBareScopeRewrite: true }` is passed, in which case it also matches
- * `read:<scope>`. Even then, only a scope with **no** `:` is ever rewritten —
- * a value such as `project:restricted` is left alone, because which of its
- * segments is the action is unknowable and guessing would over-grant.
+ * `read:<scope>`. A scope containing `:`, such as `project:restricted`, is
+ * never rewritten: which of its segments is the action is unknowable, and
+ * guessing would over-grant.
  *
  * Non-string entries in `ATTR_SCOPES` never match and never throw: the map is
  * untyped, and a malformed value must produce a denial, not a crash.

package/dist/rules/HasScope.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HasScope.d.mts","sourceRoot":"","sources":["../../src/rules/HasScope.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC/B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,QAAS,YAAW,IAAI;IAQnC,OAAO,CAAC,KAAK;IAPd,QAAQ,CAAC,QAAQ,WAAW;IAC5B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;gBAGvC,KAAK,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,eAAe;IAM1B,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAM1C,OAAO,CAAC,UAAU;CAYlB"}
+{"version":3,"file":"HasScope.d.mts","sourceRoot":"","sources":["../../src/rules/HasScope.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC/B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,QAAS,YAAW,IAAI;IAQnC,OAAO,CAAC,KAAK;IAPd,QAAQ,CAAC,QAAQ,WAAW;IAC5B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;gBAGvC,KAAK,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,eAAe;IAM1B,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAM1C,OAAO,CAAC,UAAU;CAYlB"}

package/dist/rules/HasScope.mjs

@@ -9,21 +9,18 @@ import { ATTR_SCOPES } from "@o3co/auth.policy-verifier.core";
  * Comparison is an **exact, case-sensitive string equality** against each value
  * in `ATTR_SCOPES`. OAuth 2.0 scope values are case-sensitive opaque strings
  * (RFC 6749 §3.3), so the verifier compares what the issuer wrote rather than a
- * normalized form of it:
- *
- * - `read:PROJECT` does **not** satisfy a `read:project` requirement.
- * - `read:project:restricted` is a value in its own right. It does not satisfy
- *   `read:project`, and `read:project` does not satisfy it. Nothing is split
- *   off at the second `:`; a scope the issuer deliberately narrowed must not
- *   collapse into the broader one.
+ * normalized form of it: `read:PROJECT` does **not** satisfy `read:project`,
+ * and `read:project:restricted` neither satisfies `read:project` nor is
+ * satisfied by it — a scope the issuer deliberately narrowed must not collapse
+ * into the broader one.
  *
  * ## Bare-scope rewrite
  *
  * A granted scope carrying no `:` is compared literally unless
  * `{ allowBareScopeRewrite: true }` is passed, in which case it also matches
- * `read:<scope>`. Even then, only a scope with **no** `:` is ever rewritten —
- * a value such as `project:restricted` is left alone, because which of its
- * segments is the action is unknowable and guessing would over-grant.
+ * `read:<scope>`. A scope containing `:`, such as `project:restricted`, is
+ * never rewritten: which of its segments is the action is unknowable, and
+ * guessing would over-grant.
  *
  * Non-string entries in `ATTR_SCOPES` never match and never throw: the map is
  * untyped, and a malformed value must produce a denial, not a crash.
@@ -50,7 +47,7 @@ export class HasScope {
             return true;
         // The rewrite applies to bare scopes only. A granted scope that already
         // contains ":" is never re-interpreted: splitting it to guess an action
-        // is what let "read:project:restricted" pass as "read:project".
+        // would let "read:project:restricted" pass as "read:project".
         if (this.allowBareScopeRewrite && !granted.includes(":")) {
             return `read:${granted}` === required;
         }

package/dist/rules/WithinDelegationRange.d.mts

@@ -0,0 +1,22 @@
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
+/**
+ * Rule that passes when an entry of `ATTR_DELEGATION_RANGE` contains the
+ * requested path, by the claims contract's containment rule (`rangeContains`).
+ * A range that is absent, not a list, or holds no string that contains the
+ * path fails, and so does a requested path outside the grammar, or none at
+ * all — `null`, a request whose action is not one action of the grammar
+ * (`requestedRangePath`). The rule restricts: it narrows what the policies
+ * allow and is no reason to allow, so a request no policy rule applies to goes
+ * to `onEmptyRuleSet` and is never allowed by the range alone (under
+ * `"allow"` it is still held to it).
+ */
+export declare class WithinDelegationRange implements Rule {
+    private readonly path;
+    readonly ruleType = "delegation_range";
+    readonly code = "outside_delegation_range";
+    readonly restricts = true;
+    readonly message: string;
+    constructor(path: string | null);
+    verify(attrs: ReadonlyAttributes): boolean;
+}
+//# sourceMappingURL=WithinDelegationRange.d.mts.map

package/dist/rules/WithinDelegationRange.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WithinDelegationRange.d.mts","sourceRoot":"","sources":["../../src/rules/WithinDelegationRange.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAIhF;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,YAAW,IAAI;IAMrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,QAAQ,CAAC,QAAQ,sBAAsB;IACvC,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,SAAS,QAAQ;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,IAAI,EAAE,MAAM,GAAG,IAAI;IAOhD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/WithinDelegationRange.mjs

@@ -0,0 +1,38 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { rangeContains } from "../delegation/range.mjs";
+import { ATTR_DELEGATION_RANGE } from "../keys.mjs";
+/**
+ * Rule that passes when an entry of `ATTR_DELEGATION_RANGE` contains the
+ * requested path, by the claims contract's containment rule (`rangeContains`).
+ * A range that is absent, not a list, or holds no string that contains the
+ * path fails, and so does a requested path outside the grammar, or none at
+ * all — `null`, a request whose action is not one action of the grammar
+ * (`requestedRangePath`). The rule restricts: it narrows what the policies
+ * allow and is no reason to allow, so a request no policy rule applies to goes
+ * to `onEmptyRuleSet` and is never allowed by the range alone (under
+ * `"allow"` it is still held to it).
+ */
+export class WithinDelegationRange {
+    path;
+    ruleType = "delegation_range";
+    code = "outside_delegation_range";
+    restricts = true;
+    message;
+    constructor(path) {
+        this.path = path;
+        this.message =
+            path === null
+                ? "Request is outside the token's delegation range: its action is not one action of the range grammar"
+                : `Request is outside the token's delegation range: ${path}`;
+    }
+    verify(attrs) {
+        const path = this.path;
+        if (path === null)
+            return false;
+        const range = attrs.get(ATTR_DELEGATION_RANGE);
+        if (!Array.isArray(range))
+            return false;
+        return range.some((entry) => typeof entry === "string" && rangeContains(entry, path));
+    }
+}

package/dist/rules/_sharedValidation.d.mts

@@ -4,11 +4,9 @@ export type CompareOp = "lt" | "le" | "gt" | "ge";
 export declare const COMPARE_OPS: readonly CompareOp[];
 /**
  * Validates that a config field used as an attribute name is a non-empty string
- * that does not contain the `:` separator character used in derived `ruleType`
- * strings. Allowing `:` would let distinct configs collide on the same
- * `ruleType` (e.g. `(a="x:y", b="z")` and `(a="x", b="y:z")` both produce
- * `attr_pair_equal:x:y:z`), which the evaluator would silently OR together
- * and weaken authorization.
+ * without `:`, the separator of derived `ruleType` strings. With `:` allowed,
+ * `(a="x:y", b="z")` and `(a="x", b="y:z")` would both produce
+ * `attr_pair_equal:x:y:z`, which the evaluator would silently OR together.
  * @param className - The rule class name, used in error messages.
  * @param fieldName - The config field name ("a" or "b"), used in error messages.
  * @param value - The raw value to validate.
@@ -18,10 +16,9 @@ export declare const COMPARE_OPS: readonly CompareOp[];
 export declare function requireAttrName(className: string, fieldName: "a" | "b", value: unknown): string;
 /**
  * Validates that a config field used as a literal comparison value is a
- * string, number, or boolean (i.e. a LiteralValue). NaN is rejected because
- * its comparison semantics (`NaN !== NaN` is always true, `NaN === NaN` is
- * always false) would silently invert Equal/NotEqual rules — a NotEqual(v=NaN)
- * would always pass against any numeric attribute, weakening authorization.
+ * string, number, or boolean (i.e. a LiteralValue). NaN is rejected: `x !== NaN`
+ * is always true and `x === NaN` always false, so a NotEqual(v=NaN) would pass
+ * against any numeric attribute and an Equal(v=NaN) against none.
  * @param className - The rule class name, used in error messages.
  * @param fieldName - The config field name ("v"), used in error messages.
  * @param value - The raw value to validate.
@@ -67,20 +64,16 @@ export declare function requireCompareOp(className: string, value: unknown): Com
 export declare function requireOptionalGroup(className: string, value: unknown): string | undefined;
 /**
  * Computes a stable cache/dedup key for an array of LiteralValues.
- * Format: `{type}:{count}:{hashPrefix}` — `hashPrefix` is a 16-hex-character
- * FNV-1a 64-bit hash over a canonical serialization of `values`. The canonical
- * form first deduplicates `values` (to mirror the Set-based semantics of
- * AttrLiteralIn / AttrLiteralNotIn — duplicates do not change the rule's
- * behavior, so they must not change its `ruleType`), then applies
+ * Format: `{type}:{count}:{hashPrefix}` — `hashPrefix` is `fnv1a64` over a
+ * canonical serialization of `values`. The canonical form first deduplicates
+ * `values` (AttrLiteralIn / AttrLiteralNotIn test membership through a `Set`,
+ * so duplicates must not change the `ruleType`), then applies
  * `JSON.stringify(String(v))` to each remaining element before sorting and
  * joining with `,`. The per-element quoting prevents separator collisions
  * across different arrays (e.g. `["a,b", "c"]` vs `["a", "b,c"]`).
- * The `{count}` segment reflects the post-dedup element count.
+ * `{count}` is the post-dedup element count.
  * Caller must guarantee values is a non-empty homogeneous LiteralValue[].
- *
- * The hash is non-cryptographic by design, but uses 64-bit output to keep
- * the birthday-collision bound (~2^32) far above any realistic policy size
- * and to resist deliberate collision construction.
+ * The hash is non-cryptographic by design (see `fnv1a64`).
  */
 export declare function computeValuesKey(values: LiteralValue[]): string;
 /**

package/dist/rules/_sharedValidation.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_sharedValidation.d.mts","sourceRoot":"","sources":["../../src/rules/_sharedValidation.mts"],"names":[],"mappings":"AA4BA,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAOzC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAarD,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAA6B,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAe/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,GAAG,EACd,KAAK,EAAE,OAAO,GACZ,YAAY,CAad;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAQvF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAU7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe1F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAQ/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAWxF"}
+{"version":3,"file":"_sharedValidation.d.mts","sourceRoot":"","sources":["../../src/rules/_sharedValidation.mts"],"names":[],"mappings":"AA2BA,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAOzC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAarD,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAA6B,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAe/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,GAAG,EACd,KAAK,EAAE,OAAO,GACZ,YAAY,CAad;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAQvF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAU7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAQ/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAWxF"}

package/dist/rules/_sharedValidation.mjs

@@ -9,12 +9,11 @@
  * lowercase hex characters, zero-padded.
  *
  * Used by `computeValuesKey` to build a stable grouping suffix for `ruleType`.
- * The 64-bit output gives ~2^32 birthday-collision bound, which is
- * effectively non-colliding for any realistic policy size and resists
- * deliberate collision construction by a hostile policy author or supply
- * chain. (A 32-bit variant was rejected during review because random short
- * strings can be made to collide within seconds, weakening evaluator
- * grouping when two distinct rules on the same attribute share a `ruleType`.)
+ * The 64-bit output puts the birthday-collision bound at ~2^32, far above any
+ * realistic policy size, so distinct value sets do not collide by accident.
+ * It is not collision-resistant: a birthday search of about 2^32 hashes,
+ * within reach of commodity hardware, finds one on purpose, and two distinct
+ * rules on the same attribute that share a `ruleType` are OR-combined.
  *
  * Iterates UTF-16 code units via `charCodeAt`. BigInt is used because
  * 64-bit multiplication overflows IEEE-754 doubles; `Math.imul` only
@@ -47,11 +46,9 @@ function describeType(value) {
 export const COMPARE_OPS = ["lt", "le", "gt", "ge"];
 /**
  * Validates that a config field used as an attribute name is a non-empty string
- * that does not contain the `:` separator character used in derived `ruleType`
- * strings. Allowing `:` would let distinct configs collide on the same
- * `ruleType` (e.g. `(a="x:y", b="z")` and `(a="x", b="y:z")` both produce
- * `attr_pair_equal:x:y:z`), which the evaluator would silently OR together
- * and weaken authorization.
+ * without `:`, the separator of derived `ruleType` strings. With `:` allowed,
+ * `(a="x:y", b="z")` and `(a="x", b="y:z")` would both produce
+ * `attr_pair_equal:x:y:z`, which the evaluator would silently OR together.
  * @param className - The rule class name, used in error messages.
  * @param fieldName - The config field name ("a" or "b"), used in error messages.
  * @param value - The raw value to validate.
@@ -72,10 +69,9 @@ export function requireAttrName(className, fieldName, value) {
 }
 /**
  * Validates that a config field used as a literal comparison value is a
- * string, number, or boolean (i.e. a LiteralValue). NaN is rejected because
- * its comparison semantics (`NaN !== NaN` is always true, `NaN === NaN` is
- * always false) would silently invert Equal/NotEqual rules — a NotEqual(v=NaN)
- * would always pass against any numeric attribute, weakening authorization.
+ * string, number, or boolean (i.e. a LiteralValue). NaN is rejected: `x !== NaN`
+ * is always true and `x === NaN` always false, so a NotEqual(v=NaN) would pass
+ * against any numeric attribute and an Equal(v=NaN) against none.
  * @param className - The rule class name, used in error messages.
  * @param fieldName - The config field name ("v"), used in error messages.
  * @param value - The raw value to validate.
@@ -185,20 +181,16 @@ export function requireOptionalGroup(className, value) {
 }
 /**
  * Computes a stable cache/dedup key for an array of LiteralValues.
- * Format: `{type}:{count}:{hashPrefix}` — `hashPrefix` is a 16-hex-character
- * FNV-1a 64-bit hash over a canonical serialization of `values`. The canonical
- * form first deduplicates `values` (to mirror the Set-based semantics of
- * AttrLiteralIn / AttrLiteralNotIn — duplicates do not change the rule's
- * behavior, so they must not change its `ruleType`), then applies
+ * Format: `{type}:{count}:{hashPrefix}` — `hashPrefix` is `fnv1a64` over a
+ * canonical serialization of `values`. The canonical form first deduplicates
+ * `values` (AttrLiteralIn / AttrLiteralNotIn test membership through a `Set`,
+ * so duplicates must not change the `ruleType`), then applies
  * `JSON.stringify(String(v))` to each remaining element before sorting and
  * joining with `,`. The per-element quoting prevents separator collisions
  * across different arrays (e.g. `["a,b", "c"]` vs `["a", "b,c"]`).
- * The `{count}` segment reflects the post-dedup element count.
+ * `{count}` is the post-dedup element count.
  * Caller must guarantee values is a non-empty homogeneous LiteralValue[].
- *
- * The hash is non-cryptographic by design, but uses 64-bit output to keep
- * the birthday-collision bound (~2^32) far above any realistic policy size
- * and to resist deliberate collision construction.
+ * The hash is non-cryptographic by design (see `fnv1a64`).
  */
 export function computeValuesKey(values) {
     const elementType = typeof values[0];

package/dist/rules/collectors/DelegationRangeRuleCollector.d.mts

@@ -0,0 +1,36 @@
+import type { CollectorContext, Rule, RuleCollector } from "@o3co/auth.policy-verifier.core";
+/** Config entry accepted by `DelegationRangeRuleCollector`. */
+export interface DelegationRangeRuleCollectorConfig {
+    /**
+     * The `authorization_details` type the delegation range is carried under.
+     * Required — the same value `DelegationRangeCollector` is given.
+     */
+    type: string;
+    /** The claim the entries are read from. Defaults to `authorization_details`. */
+    claim?: string;
+}
+/**
+ * Emits one `WithinDelegationRange` rule for the requested path — the raw
+ * resource, then the action, joined by `.` (`requestedRangePath`, which
+ * refuses an action that is not one action of the grammar, so the rule
+ * fails) — when the token carries a range (`entriesOfType`: an entry of the
+ * configured type, or the claim in another shape), and none otherwise.
+ * The rule is a group of its own and restricts, so it is decided together
+ * with the policies and never instead of them: a delegated token is allowed
+ * only what both allow, one no policy rule applies to goes to
+ * `onEmptyRuleSet`, and a token without a range is decided as it would be
+ * without this collector.
+ *
+ * The range itself is read by `DelegationRangeCollector`, which must be
+ * configured with the same `type` and `claim`; nothing checks that they agree.
+ * Where only this collector finds the token's entries, the rule finds no
+ * range and the request is denied; where only that one does, no rule is
+ * emitted and the range is not enforced.
+ */
+export declare class DelegationRangeRuleCollector implements RuleCollector {
+    private readonly type;
+    private readonly claim;
+    constructor(config: DelegationRangeRuleCollectorConfig);
+    collect(context: CollectorContext): Promise<Rule[]>;
+}
+//# sourceMappingURL=DelegationRangeRuleCollector.d.mts.map

package/dist/rules/collectors/DelegationRangeRuleCollector.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DelegationRangeRuleCollector.d.mts","sourceRoot":"","sources":["../../../src/rules/collectors/DelegationRangeRuleCollector.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAU7F,+DAA+D;AAC/D,MAAM,WAAW,kCAAkC;IAClD;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA6B,YAAW,aAAa;IACjE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,MAAM,EAAE,kCAAkC;IAShD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAIzD"}

package/dist/rules/collectors/DelegationRangeRuleCollector.mjs

@@ -0,0 +1,36 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { resolveClaimName } from "../../collectors/_claims.mjs";
+import { DEFAULT_AUTHORIZATION_DETAILS_CLAIM, entriesOfType, requestedRangePath, resolveRangeType, } from "../../delegation/range.mjs";
+import { WithinDelegationRange } from "../WithinDelegationRange.mjs";
+/**
+ * Emits one `WithinDelegationRange` rule for the requested path — the raw
+ * resource, then the action, joined by `.` (`requestedRangePath`, which
+ * refuses an action that is not one action of the grammar, so the rule
+ * fails) — when the token carries a range (`entriesOfType`: an entry of the
+ * configured type, or the claim in another shape), and none otherwise.
+ * The rule is a group of its own and restricts, so it is decided together
+ * with the policies and never instead of them: a delegated token is allowed
+ * only what both allow, one no policy rule applies to goes to
+ * `onEmptyRuleSet`, and a token without a range is decided as it would be
+ * without this collector.
+ *
+ * The range itself is read by `DelegationRangeCollector`, which must be
+ * configured with the same `type` and `claim`; nothing checks that they agree.
+ * Where only this collector finds the token's entries, the rule finds no
+ * range and the request is denied; where only that one does, no rule is
+ * emitted and the range is not enforced.
+ */
+export class DelegationRangeRuleCollector {
+    type;
+    claim;
+    constructor(config) {
+        this.type = resolveRangeType("DelegationRangeRuleCollector", config?.type);
+        this.claim = resolveClaimName("DelegationRangeRuleCollector", config?.claim, DEFAULT_AUTHORIZATION_DETAILS_CLAIM);
+    }
+    async collect(context) {
+        if (entriesOfType(context.subject[this.claim], this.type) === null)
+            return [];
+        return [new WithinDelegationRange(requestedRangePath(context.resource.raw, context.action))];
+    }
+}