@o3co/auth.policy-verifier.builtins 0.2.0 → 0.3.0

package/dist/__tests__/rules/_sharedValidation.test.mjs

@@ -0,0 +1,325 @@
+import { describe, expect, it } from "vitest";
+import { applyCompare, COMPARE_OPS, computeValuesKey, requireAttrName, requireCompareOp, requireHomogeneousLiteralArray, requireLiteralValue, requireNumber, requireOptionalGroup, } from "#/rules/_sharedValidation.mjs";
+// ---------------------------------------------------------------------------
+// requireAttrName
+// ---------------------------------------------------------------------------
+describe("requireAttrName", () => {
+    it("returns the input string when value is a valid non-empty string", () => {
+        expect(requireAttrName("MyClass", "a", "role")).toBe("role");
+    });
+    it("returns the input string for fieldName 'b'", () => {
+        expect(requireAttrName("MyClass", "b", "score")).toBe("score");
+    });
+    it("throws with className and fieldName 'a' in message when value is undefined", () => {
+        expect(() => requireAttrName("MyClass", "a", undefined)).toThrow(/MyClass.*'a'.*non-empty string.*got undefined/);
+    });
+    it("throws with className and fieldName 'b' in message when value is undefined", () => {
+        expect(() => requireAttrName("MyClass", "b", undefined)).toThrow(/MyClass.*'b'.*non-empty string.*got undefined/);
+    });
+    it("throws with 'empty string' in message when value is ''", () => {
+        expect(() => requireAttrName("MyClass", "a", "")).toThrow(/MyClass.*'a'.*got empty string/);
+    });
+    it("throws with 'got number' in message when value is 42", () => {
+        expect(() => requireAttrName("MyClass", "a", 42)).toThrow(/MyClass.*'a'.*got number/);
+    });
+    it("throws with 'null' in message when value is null", () => {
+        expect(() => requireAttrName("MyClass", "a", null)).toThrow(/null/);
+    });
+    it("throws when value contains ':' (reserved as ruleType separator)", () => {
+        // Regression guard for an authorization-weakening bug: with ':' allowed,
+        // (a="x:y", b="z") and (a="x", b="y:z") would both produce the same
+        // `attr_pair_equal:x:y:z` default ruleType and be silently OR-combined
+        // by the evaluator. Fail-fast at construction instead.
+        expect(() => requireAttrName("MyClass", "a", "name:space")).toThrow(/must not contain ':'.*got 'name:space'/);
+    });
+});
+// ---------------------------------------------------------------------------
+// requireLiteralValue
+// ---------------------------------------------------------------------------
+describe("requireLiteralValue", () => {
+    it("returns the value when it is a string", () => {
+        expect(requireLiteralValue("MyClass", "v", "hello")).toBe("hello");
+    });
+    it("returns the value when it is a number", () => {
+        expect(requireLiteralValue("MyClass", "v", 42)).toBe(42);
+    });
+    it("returns the value when it is a boolean", () => {
+        expect(requireLiteralValue("MyClass", "v", false)).toBe(false);
+    });
+    it("throws with 'null' in message when value is null", () => {
+        expect(() => requireLiteralValue("MyClass", "v", null)).toThrow(/null/);
+    });
+    it("throws with 'undefined' in message when value is undefined", () => {
+        expect(() => requireLiteralValue("MyClass", "v", undefined)).toThrow(/undefined/);
+    });
+    it("throws with 'object' in message when value is a plain object", () => {
+        expect(() => requireLiteralValue("MyClass", "v", {})).toThrow(/object/);
+    });
+    it("throws with 'object' in message when value is an array (typeof [] === 'object')", () => {
+        expect(() => requireLiteralValue("MyClass", "v", [])).toThrow(/object/);
+    });
+    it("throws on NaN (NaN === NaN is false; would invert Equal/NotEqual rules)", () => {
+        // Regression guard for an authorization-weakening bug: with NaN accepted,
+        // AttrLiteralNotEqual({ v: NaN }) would always pass for any numeric
+        // attribute because `x !== NaN` is always true. Must fail-fast in
+        // construction instead.
+        expect(() => requireLiteralValue("MyClass", "v", Number.NaN)).toThrow(/must not be NaN/);
+    });
+});
+// ---------------------------------------------------------------------------
+// requireNumber
+// ---------------------------------------------------------------------------
+describe("requireNumber", () => {
+    it("returns 0 (zero)", () => {
+        expect(requireNumber("MyClass", "v", 0)).toBe(0);
+    });
+    it("returns -0 (negative zero)", () => {
+        expect(requireNumber("MyClass", "v", -0)).toBe(-0);
+    });
+    it("returns a large finite number", () => {
+        expect(requireNumber("MyClass", "v", 1e308)).toBe(1e308);
+    });
+    it("returns Infinity without throwing (Infinity is a valid number per spec)", () => {
+        expect(requireNumber("MyClass", "v", Infinity)).toBe(Infinity);
+    });
+    it("returns -Infinity without throwing", () => {
+        expect(requireNumber("MyClass", "v", -Infinity)).toBe(-Infinity);
+    });
+    it("throws on NaN with message matching /must not be NaN/", () => {
+        expect(() => requireNumber("MyClass", "v", NaN)).toThrow(/must not be NaN/);
+    });
+    it("throws on a string '42' with message containing 'got string'", () => {
+        expect(() => requireNumber("MyClass", "v", "42")).toThrow(/got string/);
+    });
+    it("throws on null with message containing 'null'", () => {
+        expect(() => requireNumber("MyClass", "v", null)).toThrow(/null/);
+    });
+    it("throws on undefined with message containing 'undefined'", () => {
+        expect(() => requireNumber("MyClass", "v", undefined)).toThrow(/undefined/);
+    });
+});
+// ---------------------------------------------------------------------------
+// requireHomogeneousLiteralArray
+// ---------------------------------------------------------------------------
+describe("requireHomogeneousLiteralArray", () => {
+    it("returns a non-empty all-string array", () => {
+        const arr = ["a", "b", "c"];
+        expect(requireHomogeneousLiteralArray("MyClass", arr)).toEqual(arr);
+    });
+    it("returns a non-empty all-number array", () => {
+        const arr = [1, 2, 3];
+        expect(requireHomogeneousLiteralArray("MyClass", arr)).toEqual(arr);
+    });
+    it("returns a non-empty all-boolean array", () => {
+        const arr = [true, false];
+        expect(requireHomogeneousLiteralArray("MyClass", arr)).toEqual(arr);
+    });
+    it("throws with 'got string' when value is not an array", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", "abc")).toThrow(/got string/);
+    });
+    it("throws with 'undefined' when value is undefined", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", undefined)).toThrow(/undefined/);
+    });
+    it("throws with 'null' when value is null", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", null)).toThrow(/null/);
+    });
+    it("throws with 'non-empty array' on empty array", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", [])).toThrow(/non-empty array/);
+    });
+    it("throws with 'null' when an element is null", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", [null])).toThrow(/null/);
+    });
+    it("throws with 'undefined' when an element is undefined", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", [undefined])).toThrow(/undefined/);
+    });
+    it("throws with 'object' when an element is an object", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", [{}])).toThrow(/object/);
+    });
+    it("throws with mixed types message for ['a', 1] (left-to-right Set insertion order)", () => {
+        expect(() => requireHomogeneousLiteralArray("MyClass", ["a", 1])).toThrow(/mixed types \[string, number\]/);
+    });
+    it("throws when an element is NaN (would silently mismatch AttrLiteralIn/NotIn)", () => {
+        // Regression guard: AttrLiteralIn uses strict equality against each element;
+        // a NaN element could never match any attribute value because NaN !== NaN.
+        // Must fail-fast at construction rather than ship an always-false element.
+        expect(() => requireHomogeneousLiteralArray("MyClass", [1, Number.NaN, 3])).toThrow(/must not contain NaN/);
+    });
+});
+// ---------------------------------------------------------------------------
+// requireCompareOp
+// ---------------------------------------------------------------------------
+describe("requireCompareOp", () => {
+    it("returns 'lt' for valid op 'lt'", () => {
+        expect(requireCompareOp("MyClass", "lt")).toBe("lt");
+    });
+    it("returns 'le' for valid op 'le'", () => {
+        expect(requireCompareOp("MyClass", "le")).toBe("le");
+    });
+    it("returns 'gt' for valid op 'gt'", () => {
+        expect(requireCompareOp("MyClass", "gt")).toBe("gt");
+    });
+    it("returns 'ge' for valid op 'ge'", () => {
+        expect(requireCompareOp("MyClass", "ge")).toBe("ge");
+    });
+    it("throws on invalid string 'eq' with message listing valid ops joined by ' | '", () => {
+        expect(() => requireCompareOp("MyClass", "eq")).toThrow(/lt \| le \| gt \| ge/);
+    });
+    it("throws on empty string '' with message listing valid ops", () => {
+        expect(() => requireCompareOp("MyClass", "")).toThrow(/lt \| le \| gt \| ge/);
+    });
+    it("throws on symbolic string '<' with message listing valid ops", () => {
+        expect(() => requireCompareOp("MyClass", "<")).toThrow(/lt \| le \| gt \| ge/);
+    });
+    it("throws on number 42 with message containing the type label", () => {
+        expect(() => requireCompareOp("MyClass", 42)).toThrow(/got number/);
+    });
+    it("throws on null with message containing the type label", () => {
+        expect(() => requireCompareOp("MyClass", null)).toThrow(/null/);
+    });
+    it("throws on undefined with message containing the type label", () => {
+        expect(() => requireCompareOp("MyClass", undefined)).toThrow(/undefined/);
+    });
+});
+// ---------------------------------------------------------------------------
+// requireOptionalGroup
+// ---------------------------------------------------------------------------
+describe("requireOptionalGroup", () => {
+    it("returns undefined when value is undefined", () => {
+        expect(requireOptionalGroup("MyClass", undefined)).toBeUndefined();
+    });
+    it("returns the input string when value is a non-empty string", () => {
+        expect(requireOptionalGroup("MyClass", "my-group")).toBe("my-group");
+    });
+    it("throws with 'empty string' message on ''", () => {
+        expect(() => requireOptionalGroup("MyClass", "")).toThrow(/empty string/);
+    });
+    it("throws with 'got number' message on 42", () => {
+        expect(() => requireOptionalGroup("MyClass", 42)).toThrow(/got number/);
+    });
+    it("throws with 'null' in message on null", () => {
+        expect(() => requireOptionalGroup("MyClass", null)).toThrow(/null/);
+    });
+});
+// ---------------------------------------------------------------------------
+// computeValuesKey
+// ---------------------------------------------------------------------------
+describe("computeValuesKey", () => {
+    it("returns a string matching /{type}:{count}:{8-hex-chars}/ format", () => {
+        expect(computeValuesKey(["admin"])).toMatch(/^(string|number|boolean):[0-9]+:[0-9a-f]{8}$/);
+    });
+    it("sort determinism: same content in different order produces the same key", () => {
+        expect(computeValuesKey(["b", "a"])).toBe(computeValuesKey(["a", "b"]));
+    });
+    it("count discrimination: ['a'] !== ['a', 'b'] (distinct content → distinct key)", () => {
+        expect(computeValuesKey(["a"])).not.toBe(computeValuesKey(["a", "b"]));
+    });
+    it("dedup parity: ['a'] === ['a', 'a'] (duplicates do not affect the Set-based rule behavior, so they must not affect ruleType either)", () => {
+        // AttrLiteralIn / AttrLiteralNotIn use `new Set(values)` for verify(),
+        // so duplicate elements have no semantic effect. The ruleType must
+        // mirror that — otherwise two logically-equivalent rules would be
+        // placed in different evaluator groups and be AND-combined, when
+        // the caller intended them to be OR-combined (shared ruleType).
+        expect(computeValuesKey(["a"])).toBe(computeValuesKey(["a", "a"]));
+    });
+    it("content discrimination: ['a', 'b'] !== ['a', 'c'] (hash differs)", () => {
+        expect(computeValuesKey(["a", "b"])).not.toBe(computeValuesKey(["a", "c"]));
+    });
+    it("type segment correctness: string array starts with 'string:'", () => {
+        expect(computeValuesKey(["admin"])).toMatch(/^string:/);
+    });
+    it("type segment correctness: number array starts with 'number:'", () => {
+        expect(computeValuesKey([1])).toMatch(/^number:/);
+    });
+    it("type segment correctness: boolean array starts with 'boolean:'", () => {
+        expect(computeValuesKey([true])).toMatch(/^boolean:/);
+    });
+    it("type divergence: computeValuesKey(['1']) !== computeValuesKey([1]) (type segment differs)", () => {
+        expect(computeValuesKey(["1"])).not.toBe(computeValuesKey([1]));
+    });
+    it("separator collision guard: ['a,b', 'c'] !== ['a', 'b,c'] (values containing commas do not collide)", () => {
+        // Regression guard: a naive implementation of the form
+        //   values.map(String).sort().join(",")
+        // would produce the same string "a,b,c" for both inputs and thus the
+        // same ruleType. That would cause the evaluator to OR what the caller
+        // meant as two independent set constraints, weakening authorization.
+        // The canonical form JSON.stringify-es each element before joining,
+        // so quotes/escapes disambiguate the element boundary.
+        expect(computeValuesKey(["a,b", "c"])).not.toBe(computeValuesKey(["a", "b,c"]));
+    });
+    it("pure / referentially transparent: two calls with the same input return the same string", () => {
+        const input = ["x", "y", "z"];
+        expect(computeValuesKey(input)).toBe(computeValuesKey(input));
+    });
+});
+// ---------------------------------------------------------------------------
+// applyCompare
+// ---------------------------------------------------------------------------
+describe("applyCompare", () => {
+    describe("op=lt", () => {
+        it("returns true when left < right (1 < 2)", () => {
+            expect(applyCompare("lt", 1, 2)).toBe(true);
+        });
+        it("returns false when left === right (2 < 2 is false)", () => {
+            expect(applyCompare("lt", 2, 2)).toBe(false);
+        });
+        it("returns false when left > right (3 < 2 is false)", () => {
+            expect(applyCompare("lt", 3, 2)).toBe(false);
+        });
+        it("edge: -Infinity < 0 returns true", () => {
+            expect(applyCompare("lt", -Infinity, 0)).toBe(true);
+        });
+    });
+    describe("op=le", () => {
+        it("returns true when left < right (1 <= 2)", () => {
+            expect(applyCompare("le", 1, 2)).toBe(true);
+        });
+        it("returns true when left === right (2 <= 2)", () => {
+            expect(applyCompare("le", 2, 2)).toBe(true);
+        });
+        it("returns false when left > right (3 <= 2 is false)", () => {
+            expect(applyCompare("le", 3, 2)).toBe(false);
+        });
+        it("edge: 0 >= -0 returns true (ge symmetry check; 0 <= -0 also true)", () => {
+            expect(applyCompare("le", 0, -0)).toBe(true);
+        });
+    });
+    describe("op=gt", () => {
+        it("returns true when left > right (3 > 2)", () => {
+            expect(applyCompare("gt", 3, 2)).toBe(true);
+        });
+        it("returns false when left === right (2 > 2 is false)", () => {
+            expect(applyCompare("gt", 2, 2)).toBe(false);
+        });
+        it("returns false when left < right (1 > 2 is false)", () => {
+            expect(applyCompare("gt", 1, 2)).toBe(false);
+        });
+        it("edge: Infinity > 1e308 returns true", () => {
+            expect(applyCompare("gt", Infinity, 1e308)).toBe(true);
+        });
+    });
+    describe("op=ge", () => {
+        it("returns true when left > right (3 >= 2)", () => {
+            expect(applyCompare("ge", 3, 2)).toBe(true);
+        });
+        it("returns true when left === right (2 >= 2)", () => {
+            expect(applyCompare("ge", 2, 2)).toBe(true);
+        });
+        it("returns false when left < right (1 >= 2 is false)", () => {
+            expect(applyCompare("ge", 1, 2)).toBe(false);
+        });
+        it("edge: 0 >= -0 returns true", () => {
+            expect(applyCompare("ge", 0, -0)).toBe(true);
+        });
+    });
+});
+// ---------------------------------------------------------------------------
+// COMPARE_OPS
+// ---------------------------------------------------------------------------
+describe("COMPARE_OPS", () => {
+    it("exposes exactly 4 values", () => {
+        expect(COMPARE_OPS).toHaveLength(4);
+    });
+    it("contains 'lt', 'le', 'gt', 'ge' in order", () => {
+        expect(COMPARE_OPS).toEqual(["lt", "le", "gt", "ge"]);
+    });
+});

package/dist/index.d.mts

@@ -4,7 +4,15 @@ export { StaticPermissionCollector } from "./collectors/StaticPermissionCollecto
 export { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 export { builtinCollectorsModule } from "./module.mjs";
 export { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
+export { AttrLiteralCompare, type AttrLiteralCompareConfig } from "./rules/AttrLiteralCompare.mjs";
+export { AttrLiteralEqual, type AttrLiteralEqualConfig } from "./rules/AttrLiteralEqual.mjs";
+export { AttrLiteralIn, type AttrLiteralInConfig } from "./rules/AttrLiteralIn.mjs";
+export { AttrLiteralNotEqual, type AttrLiteralNotEqualConfig, } from "./rules/AttrLiteralNotEqual.mjs";
+export { AttrLiteralNotIn, type AttrLiteralNotInConfig } from "./rules/AttrLiteralNotIn.mjs";
 export { AttrMatchRule, type AttrMatchRuleConfig } from "./rules/AttrMatchRule.mjs";
+export { AttrPairCompare, type AttrPairCompareConfig } from "./rules/AttrPairCompare.mjs";
+export { AttrPairEqual, type AttrPairEqualConfig } from "./rules/AttrPairEqual.mjs";
+export { AttrPairNotEqual, type AttrPairNotEqualConfig } from "./rules/AttrPairNotEqual.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";
 export { ResourceActionPermissionRuleCollector } from "./rules/ResourceActionPermissionRuleCollector.mjs";

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC"}

package/dist/index.mjs

@@ -8,7 +8,15 @@ export { builtinCollectorsModule } from "./module.mjs";
 // Resource
 export { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
 // Rules
+export { AttrLiteralCompare } from "./rules/AttrLiteralCompare.mjs";
+export { AttrLiteralEqual } from "./rules/AttrLiteralEqual.mjs";
+export { AttrLiteralIn } from "./rules/AttrLiteralIn.mjs";
+export { AttrLiteralNotEqual, } from "./rules/AttrLiteralNotEqual.mjs";
+export { AttrLiteralNotIn } from "./rules/AttrLiteralNotIn.mjs";
 export { AttrMatchRule } from "./rules/AttrMatchRule.mjs";
+export { AttrPairCompare } from "./rules/AttrPairCompare.mjs";
+export { AttrPairEqual } from "./rules/AttrPairEqual.mjs";
+export { AttrPairNotEqual } from "./rules/AttrPairNotEqual.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";
 export { ResourceActionPermissionRuleCollector } from "./rules/ResourceActionPermissionRuleCollector.mjs";

package/dist/rules/AttrLiteralCompare.d.mts

@@ -0,0 +1,31 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type CompareOp } from "./_sharedValidation.mjs";
+export interface AttrLiteralCompareConfig {
+    a: string;
+    op: CompareOp;
+    v: number;
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, is a number, and
+ * satisfies the configured comparison operator against the configured literal
+ * number `v`. NaN attributes always return false. Missing, null, or non-number
+ * attributes return false (safe-deny). NaN is rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `v`:
+ *   `attr_literal_compare:{a}:{op}:{String(v)}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrLiteralCompare implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_compare_violated";
+    readonly message: string;
+    constructor(config: AttrLiteralCompareConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralCompare.d.mts.map

package/dist/rules/AttrLiteralCompare.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAKlC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,wBAAwB;IAU7D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralCompare.mjs

@@ -0,0 +1,36 @@
+import { applyCompare, requireAttrName, requireCompareOp, requireNumber, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, is a number, and
+ * satisfies the configured comparison operator against the configured literal
+ * number `v`. NaN attributes always return false. Missing, null, or non-number
+ * attributes return false (safe-deny). NaN is rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `v`:
+ *   `attr_literal_compare:{a}:{op}:{String(v)}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrLiteralCompare {
+    config;
+    ruleType;
+    code = "attr_compare_violated";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralCompare", "a", config.a);
+        requireNumber("AttrLiteralCompare", "v", config.v);
+        requireCompareOp("AttrLiteralCompare", config.op);
+        const group = requireOptionalGroup("AttrLiteralCompare", config.group);
+        this.ruleType = group ?? `attr_literal_compare:${config.a}:${config.op}:${String(config.v)}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must be ${config.op} ${String(config.v)}.`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== "number")
+            return false;
+        return applyCompare(this.config.op, x, this.config.v);
+    }
+}

package/dist/rules/AttrLiteralEqual.d.mts

@@ -0,0 +1,37 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralEqualConfig {
+    a: string;
+    v: LiteralValue;
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present and strictly equal to a
+ * configured literal value (string, number, or boolean). No type coercion is
+ * performed: the attribute value must be the same type and value as `v`.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)` so that distinct literal requirements are AND-combined by default:
+ *   `attr_literal_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment is required because `String(v)` collapses distinct-
+ * type literals that stringify the same way (e.g. `true` vs `"true"`, `1` vs
+ * `"1"`). Without it, two rules on the same attribute with different-type
+ * literals would share a `ruleType` and be OR-combined by the evaluator,
+ * silently weakening authorization.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics
+ * (e.g. "role is admin" OR "role is superuser" under one group).
+ */
+export declare class AttrLiteralEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_not_equal";
+    readonly message: string;
+    constructor(config: AttrLiteralEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralEqual.d.mts.map

package/dist/rules/AttrLiteralEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAU3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralEqual.mjs

@@ -0,0 +1,43 @@
+import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present and strictly equal to a
+ * configured literal value (string, number, or boolean). No type coercion is
+ * performed: the attribute value must be the same type and value as `v`.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)` so that distinct literal requirements are AND-combined by default:
+ *   `attr_literal_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment is required because `String(v)` collapses distinct-
+ * type literals that stringify the same way (e.g. `true` vs `"true"`, `1` vs
+ * `"1"`). Without it, two rules on the same attribute with different-type
+ * literals would share a `ruleType` and be OR-combined by the evaluator,
+ * silently weakening authorization.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics
+ * (e.g. "role is admin" OR "role is superuser" under one group).
+ */
+export class AttrLiteralEqual {
+    config;
+    ruleType;
+    code = "attr_not_equal";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralEqual", "a", config.a);
+        requireLiteralValue("AttrLiteralEqual", "v", config.v);
+        const group = requireOptionalGroup("AttrLiteralEqual", config.group);
+        this.ruleType =
+            group ?? `attr_literal_equal:${config.a}:${typeof config.v}:${String(config.v)}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must equal ${String(config.v)}.`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== typeof this.config.v)
+            return false;
+        return x === this.config.v;
+    }
+}

package/dist/rules/AttrLiteralIn.d.mts

@@ -0,0 +1,38 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralInConfig {
+    a: string;
+    values: LiteralValue[];
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_in:{a}:{valuesKey}`
+ *
+ * Two instances with the same `a` but different `values` will produce distinct
+ * ruleTypes and thus be AND-combined by the evaluator. Two instances with the
+ * same `a` and logically equivalent `values` (regardless of insertion order)
+ * will share a ruleType and be OR-combined.
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrLiteralIn implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_not_in_set";
+    readonly message: string;
+    private readonly elementType;
+    private readonly valuesSet;
+    constructor(config: AttrLiteralInConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralIn.d.mts.map

package/dist/rules/AttrLiteralIn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAQ7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,mBAAmB;IAaxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralIn.mjs

@@ -0,0 +1,46 @@
+import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_in:{a}:{valuesKey}`
+ *
+ * Two instances with the same `a` but different `values` will produce distinct
+ * ruleTypes and thus be AND-combined by the evaluator. Two instances with the
+ * same `a` and logically equivalent `values` (regardless of insertion order)
+ * will share a ruleType and be OR-combined.
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrLiteralIn {
+    config;
+    ruleType;
+    code = "attr_not_in_set";
+    message;
+    elementType;
+    valuesSet;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralIn", "a", config.a);
+        const values = requireHomogeneousLiteralArray("AttrLiteralIn", config.values);
+        const group = requireOptionalGroup("AttrLiteralIn", config.group);
+        this.elementType = typeof values[0];
+        this.valuesSet = new Set(values);
+        const valuesKey = computeValuesKey(values);
+        this.ruleType = group ?? `attr_literal_in:${config.a}:${valuesKey}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must be one of [${values.map(String).join(", ")}].`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== this.elementType)
+            return false;
+        return this.valuesSet.has(x);
+    }
+}

package/dist/rules/AttrLiteralNotEqual.d.mts

@@ -0,0 +1,36 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralNotEqualConfig {
+    a: string;
+    v: LiteralValue;
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, matches the type of the
+ * configured literal value, and is strictly NOT equal to it. No type coercion
+ * is performed. If the attribute is missing, null, or of the wrong type the
+ * rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)`:
+ *   `attr_literal_not_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment prevents silent `ruleType` collisions between
+ * different-type literals that stringify the same way (e.g. `1` vs `"1"`),
+ * which would otherwise be OR-combined by the evaluator against the intent
+ * of two independent constraints. See AttrLiteralEqual for the same rationale.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export declare class AttrLiteralNotEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_equal";
+    readonly message: string;
+    constructor(config: AttrLiteralNotEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralNotEqual.d.mts.map