@o3co/auth.policy-verifier.builtins 0.2.0 → 0.3.1

package/dist/__tests__/rules/{ResourceActionPermissionRuleCollector.test.mjs → collectors/ResourceActionPermissionRuleCollector.test.mjs}

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { ResourceActionPermissionRuleCollector } from "#/rules/ResourceActionPermissionRuleCollector.mjs";
+import { ResourceActionPermissionRuleCollector } from "#/rules/collectors/ResourceActionPermissionRuleCollector.mjs";
 describe("ResourceActionPermissionRuleCollector", () => {
     const collector = new ResourceActionPermissionRuleCollector();
     it("creates a HasPermission rule with resource.perm:action", async () => {

package/dist/__tests__/rules/collectors/ResourceActionScopeRuleCollector.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceActionScopeRuleCollector.test.d.mts","sourceRoot":"","sources":["../../../../src/__tests__/rules/collectors/ResourceActionScopeRuleCollector.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/{ResourceActionScopeRuleCollector.test.mjs → collectors/ResourceActionScopeRuleCollector.test.mjs}

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { ResourceActionScopeRuleCollector } from "#/rules/ResourceActionScopeRuleCollector.mjs";
+import { ResourceActionScopeRuleCollector } from "#/rules/collectors/ResourceActionScopeRuleCollector.mjs";
 const makeContext = (resourceType, action, scope) => ({
     payload: { ...(scope !== undefined ? { scope } : {}) },
     resource: { raw: `${resourceType}:1`, resourceType, resourceId: "1" },

package/dist/index.d.mts

@@ -4,9 +4,17 @@ export { StaticPermissionCollector } from "./collectors/StaticPermissionCollecto
 export { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 export { builtinCollectorsModule } from "./module.mjs";
 export { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
+export { AttrLiteralCompare, type AttrLiteralCompareConfig } from "./rules/AttrLiteralCompare.mjs";
+export { AttrLiteralEqual, type AttrLiteralEqualConfig } from "./rules/AttrLiteralEqual.mjs";
+export { AttrLiteralIn, type AttrLiteralInConfig } from "./rules/AttrLiteralIn.mjs";
+export { AttrLiteralNotEqual, type AttrLiteralNotEqualConfig, } from "./rules/AttrLiteralNotEqual.mjs";
+export { AttrLiteralNotIn, type AttrLiteralNotInConfig } from "./rules/AttrLiteralNotIn.mjs";
 export { AttrMatchRule, type AttrMatchRuleConfig } from "./rules/AttrMatchRule.mjs";
+export { AttrPairCompare, type AttrPairCompareConfig } from "./rules/AttrPairCompare.mjs";
+export { AttrPairEqual, type AttrPairEqualConfig } from "./rules/AttrPairEqual.mjs";
+export { AttrPairNotEqual, type AttrPairNotEqualConfig } from "./rules/AttrPairNotEqual.mjs";
+export { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
+export { ResourceActionScopeRuleCollector } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";
-export { ResourceActionPermissionRuleCollector } from "./rules/ResourceActionPermissionRuleCollector.mjs";
-export { ResourceActionScopeRuleCollector } from "./rules/ResourceActionScopeRuleCollector.mjs";
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.mjs

@@ -8,8 +8,16 @@ export { builtinCollectorsModule } from "./module.mjs";
 // Resource
 export { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
 // Rules
+export { AttrLiteralCompare } from "./rules/AttrLiteralCompare.mjs";
+export { AttrLiteralEqual } from "./rules/AttrLiteralEqual.mjs";
+export { AttrLiteralIn } from "./rules/AttrLiteralIn.mjs";
+export { AttrLiteralNotEqual, } from "./rules/AttrLiteralNotEqual.mjs";
+export { AttrLiteralNotIn } from "./rules/AttrLiteralNotIn.mjs";
 export { AttrMatchRule } from "./rules/AttrMatchRule.mjs";
+export { AttrPairCompare } from "./rules/AttrPairCompare.mjs";
+export { AttrPairEqual } from "./rules/AttrPairEqual.mjs";
+export { AttrPairNotEqual } from "./rules/AttrPairNotEqual.mjs";
+export { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
+export { ResourceActionScopeRuleCollector } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";
-export { ResourceActionPermissionRuleCollector } from "./rules/ResourceActionPermissionRuleCollector.mjs";
-export { ResourceActionScopeRuleCollector } from "./rules/ResourceActionScopeRuleCollector.mjs";

package/dist/module.mjs

@@ -3,8 +3,8 @@ import { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollecto
 import { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 import { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 import { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
-import { ResourceActionPermissionRuleCollector } from "./rules/ResourceActionPermissionRuleCollector.mjs";
-import { ResourceActionScopeRuleCollector } from "./rules/ResourceActionScopeRuleCollector.mjs";
+import { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
+import { ResourceActionScopeRuleCollector } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
 export const builtinCollectorsModule = {
     name: "builtin-collectors",
     async init(context) {

package/dist/rules/AttrLiteralCompare.d.mts

@@ -0,0 +1,31 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type CompareOp } from "./_sharedValidation.mjs";
+export interface AttrLiteralCompareConfig {
+    a: string;
+    op: CompareOp;
+    v: number;
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, is a number, and
+ * satisfies the configured comparison operator against the configured literal
+ * number `v`. NaN attributes always return false. Missing, null, or non-number
+ * attributes return false (safe-deny). NaN is rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `v`:
+ *   `attr_literal_compare:{a}:{op}:{String(v)}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrLiteralCompare implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_compare_violated";
+    readonly message: string;
+    constructor(config: AttrLiteralCompareConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralCompare.d.mts.map

package/dist/rules/AttrLiteralCompare.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAKlC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,wBAAwB;IAU7D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralCompare.mjs

@@ -0,0 +1,36 @@
+import { applyCompare, requireAttrName, requireCompareOp, requireNumber, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, is a number, and
+ * satisfies the configured comparison operator against the configured literal
+ * number `v`. NaN attributes always return false. Missing, null, or non-number
+ * attributes return false (safe-deny). NaN is rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `v`:
+ *   `attr_literal_compare:{a}:{op}:{String(v)}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrLiteralCompare {
+    config;
+    ruleType;
+    code = "attr_compare_violated";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralCompare", "a", config.a);
+        requireNumber("AttrLiteralCompare", "v", config.v);
+        requireCompareOp("AttrLiteralCompare", config.op);
+        const group = requireOptionalGroup("AttrLiteralCompare", config.group);
+        this.ruleType = group ?? `attr_literal_compare:${config.a}:${config.op}:${String(config.v)}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must be ${config.op} ${String(config.v)}.`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== "number")
+            return false;
+        return applyCompare(this.config.op, x, this.config.v);
+    }
+}

package/dist/rules/AttrLiteralEqual.d.mts

@@ -0,0 +1,37 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralEqualConfig {
+    a: string;
+    v: LiteralValue;
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present and strictly equal to a
+ * configured literal value (string, number, or boolean). No type coercion is
+ * performed: the attribute value must be the same type and value as `v`.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)` so that distinct literal requirements are AND-combined by default:
+ *   `attr_literal_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment is required because `String(v)` collapses distinct-
+ * type literals that stringify the same way (e.g. `true` vs `"true"`, `1` vs
+ * `"1"`). Without it, two rules on the same attribute with different-type
+ * literals would share a `ruleType` and be OR-combined by the evaluator,
+ * silently weakening authorization.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics
+ * (e.g. "role is admin" OR "role is superuser" under one group).
+ */
+export declare class AttrLiteralEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_not_equal";
+    readonly message: string;
+    constructor(config: AttrLiteralEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralEqual.d.mts.map

package/dist/rules/AttrLiteralEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAU3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralEqual.mjs

@@ -0,0 +1,43 @@
+import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present and strictly equal to a
+ * configured literal value (string, number, or boolean). No type coercion is
+ * performed: the attribute value must be the same type and value as `v`.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)` so that distinct literal requirements are AND-combined by default:
+ *   `attr_literal_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment is required because `String(v)` collapses distinct-
+ * type literals that stringify the same way (e.g. `true` vs `"true"`, `1` vs
+ * `"1"`). Without it, two rules on the same attribute with different-type
+ * literals would share a `ruleType` and be OR-combined by the evaluator,
+ * silently weakening authorization.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics
+ * (e.g. "role is admin" OR "role is superuser" under one group).
+ */
+export class AttrLiteralEqual {
+    config;
+    ruleType;
+    code = "attr_not_equal";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralEqual", "a", config.a);
+        requireLiteralValue("AttrLiteralEqual", "v", config.v);
+        const group = requireOptionalGroup("AttrLiteralEqual", config.group);
+        this.ruleType =
+            group ?? `attr_literal_equal:${config.a}:${typeof config.v}:${String(config.v)}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must equal ${String(config.v)}.`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== typeof this.config.v)
+            return false;
+        return x === this.config.v;
+    }
+}

package/dist/rules/AttrLiteralIn.d.mts

@@ -0,0 +1,38 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralInConfig {
+    a: string;
+    values: LiteralValue[];
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_in:{a}:{valuesKey}`
+ *
+ * Two instances with the same `a` but different `values` will produce distinct
+ * ruleTypes and thus be AND-combined by the evaluator. Two instances with the
+ * same `a` and logically equivalent `values` (regardless of insertion order)
+ * will share a ruleType and be OR-combined.
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrLiteralIn implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_not_in_set";
+    readonly message: string;
+    private readonly elementType;
+    private readonly valuesSet;
+    constructor(config: AttrLiteralInConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralIn.d.mts.map

package/dist/rules/AttrLiteralIn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAQ7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,mBAAmB;IAaxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralIn.mjs

@@ -0,0 +1,46 @@
+import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_in:{a}:{valuesKey}`
+ *
+ * Two instances with the same `a` but different `values` will produce distinct
+ * ruleTypes and thus be AND-combined by the evaluator. Two instances with the
+ * same `a` and logically equivalent `values` (regardless of insertion order)
+ * will share a ruleType and be OR-combined.
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrLiteralIn {
+    config;
+    ruleType;
+    code = "attr_not_in_set";
+    message;
+    elementType;
+    valuesSet;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralIn", "a", config.a);
+        const values = requireHomogeneousLiteralArray("AttrLiteralIn", config.values);
+        const group = requireOptionalGroup("AttrLiteralIn", config.group);
+        this.elementType = typeof values[0];
+        this.valuesSet = new Set(values);
+        const valuesKey = computeValuesKey(values);
+        this.ruleType = group ?? `attr_literal_in:${config.a}:${valuesKey}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must be one of [${values.map(String).join(", ")}].`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== this.elementType)
+            return false;
+        return this.valuesSet.has(x);
+    }
+}

package/dist/rules/AttrLiteralNotEqual.d.mts

@@ -0,0 +1,36 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralNotEqualConfig {
+    a: string;
+    v: LiteralValue;
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, matches the type of the
+ * configured literal value, and is strictly NOT equal to it. No type coercion
+ * is performed. If the attribute is missing, null, or of the wrong type the
+ * rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)`:
+ *   `attr_literal_not_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment prevents silent `ruleType` collisions between
+ * different-type literals that stringify the same way (e.g. `1` vs `"1"`),
+ * which would otherwise be OR-combined by the evaluator against the intent
+ * of two independent constraints. See AttrLiteralEqual for the same rationale.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export declare class AttrLiteralNotEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_equal";
+    readonly message: string;
+    constructor(config: AttrLiteralNotEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralNotEqual.d.mts.map

package/dist/rules/AttrLiteralNotEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAKnC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,yBAAyB;IAU9D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralNotEqual.mjs

@@ -0,0 +1,42 @@
+import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, matches the type of the
+ * configured literal value, and is strictly NOT equal to it. No type coercion
+ * is performed. If the attribute is missing, null, or of the wrong type the
+ * rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)`:
+ *   `attr_literal_not_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment prevents silent `ruleType` collisions between
+ * different-type literals that stringify the same way (e.g. `1` vs `"1"`),
+ * which would otherwise be OR-combined by the evaluator against the intent
+ * of two independent constraints. See AttrLiteralEqual for the same rationale.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export class AttrLiteralNotEqual {
+    config;
+    ruleType;
+    code = "attr_equal";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralNotEqual", "a", config.a);
+        requireLiteralValue("AttrLiteralNotEqual", "v", config.v);
+        const group = requireOptionalGroup("AttrLiteralNotEqual", config.group);
+        this.ruleType =
+            group ?? `attr_literal_not_equal:${config.a}:${typeof config.v}:${String(config.v)}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must not equal ${String(config.v)}.`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== typeof this.config.v)
+            return false;
+        return x !== this.config.v;
+    }
+}

package/dist/rules/AttrLiteralNotIn.d.mts

@@ -0,0 +1,33 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralNotInConfig {
+    a: string;
+    values: LiteralValue[];
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is NOT included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_not_in:{a}:{valuesKey}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrLiteralNotIn implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_in_set";
+    readonly message: string;
+    private readonly elementType;
+    private readonly valuesSet;
+    constructor(config: AttrLiteralNotInConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralNotIn.d.mts.map

package/dist/rules/AttrLiteralNotIn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAQhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,sBAAsB;IAa3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralNotIn.mjs

@@ -0,0 +1,41 @@
+import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is NOT included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_not_in:{a}:{valuesKey}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrLiteralNotIn {
+    config;
+    ruleType;
+    code = "attr_in_set";
+    message;
+    elementType;
+    valuesSet;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralNotIn", "a", config.a);
+        const values = requireHomogeneousLiteralArray("AttrLiteralNotIn", config.values);
+        const group = requireOptionalGroup("AttrLiteralNotIn", config.group);
+        this.elementType = typeof values[0];
+        this.valuesSet = new Set(values);
+        const valuesKey = computeValuesKey(values);
+        this.ruleType = group ?? `attr_literal_not_in:${config.a}:${valuesKey}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must not be one of [${values.map(String).join(", ")}].`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== this.elementType)
+            return false;
+        return !this.valuesSet.has(x);
+    }
+}

package/dist/rules/AttrMatchRule.d.mts

@@ -1,42 +1,15 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
-export interface AttrMatchRuleConfig {
-    a: string;
-    b: string;
-    /**
-     * Optional grouping key used as `ruleType`. See the class comment for
-     * how this interacts with the evaluator's OR-within-group /
-     * AND-across-groups semantics.
-     */
-    group?: string;
-}
+import { AttrPairEqual, type AttrPairEqualConfig } from "./AttrPairEqual.mjs";
+export type AttrMatchRuleConfig = AttrPairEqualConfig;
 /**
- * Rule that passes when two named attributes are present, are non-empty
- * strings, and are equal. A pure predicate over the attributes map —
- * `verify(attrs)` does not touch `CollectorContext` and does not close
- * over request state.
- *
- * ## Grouping and the default ruleType
- *
- * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
- * across groups. If every `AttrMatchRule` shared one fixed `ruleType`,
- * two instances collected for different comparisons (e.g. subject vs.
- * subscriber AND tenant vs. request-tenant) would be OR'd together and
- * authorization would weaken silently.
- *
- * To default to the safe reading of "each distinct pair of attributes
- * is a separate AND-combined requirement", `ruleType` is derived from
- * `a` and `b` when `group` is not given: `attr_match:{a}:{b}`.
+ * @deprecated Use {@link AttrPairEqual}. Scheduled for removal in a future major version.
  *
- * When callers actually want two comparisons to be OR-combined
- * (alternative identities, for example), they opt in explicitly by
- * passing the same `group` to both rule instances.
+ * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
+ * and legacy `message` wording. `verify()` semantics are inherited unchanged from
+ * `AttrPairEqual`: both named attributes must be non-empty strings and equal.
  */
-export declare class AttrMatchRule implements Rule {
-    private readonly config;
+export declare class AttrMatchRule extends AttrPairEqual {
     readonly ruleType: string;
-    readonly code = "attr_mismatch";
     readonly message: string;
     constructor(config: AttrMatchRuleConfig);
-    verify(attrs: Attributes): boolean;
 }
 //# sourceMappingURL=AttrMatchRule.d.mts.map

package/dist/rules/AttrMatchRule.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAExE,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,mBAAmB;IAKxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}
+{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,aAAa;IAC/C,SAAkB,QAAQ,EAAE,MAAM,CAAC;IACnC,SAAkB,OAAO,EAAE,MAAM,CAAC;gBAEtB,MAAM,EAAE,mBAAmB;CAKvC"}

package/dist/rules/AttrMatchRule.mjs

@@ -1,42 +1,17 @@
+import { AttrPairEqual } from "./AttrPairEqual.mjs";
 /**
- * Rule that passes when two named attributes are present, are non-empty
- * strings, and are equal. A pure predicate over the attributes map —
- * `verify(attrs)` does not touch `CollectorContext` and does not close
- * over request state.
+ * @deprecated Use {@link AttrPairEqual}. Scheduled for removal in a future major version.
  *
- * ## Grouping and the default ruleType
- *
- * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
- * across groups. If every `AttrMatchRule` shared one fixed `ruleType`,
- * two instances collected for different comparisons (e.g. subject vs.
- * subscriber AND tenant vs. request-tenant) would be OR'd together and
- * authorization would weaken silently.
- *
- * To default to the safe reading of "each distinct pair of attributes
- * is a separate AND-combined requirement", `ruleType` is derived from
- * `a` and `b` when `group` is not given: `attr_match:{a}:{b}`.
- *
- * When callers actually want two comparisons to be OR-combined
- * (alternative identities, for example), they opt in explicitly by
- * passing the same `group` to both rule instances.
+ * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
+ * and legacy `message` wording. `verify()` semantics are inherited unchanged from
+ * `AttrPairEqual`: both named attributes must be non-empty strings and equal.
  */
-export class AttrMatchRule {
-    config;
+export class AttrMatchRule extends AttrPairEqual {
     ruleType;
-    code = "attr_mismatch";
     message;
     constructor(config) {
-        this.config = config;
+        super(config);
         this.ruleType = config.group ?? `attr_match:${config.a}:${config.b}`;
         this.message = `Attribute constraint not satisfied: ${config.a} and ${config.b} must both be non-empty strings and equal.`;
     }
-    verify(attrs) {
-        const a = attrs.get(this.config.a);
-        const b = attrs.get(this.config.b);
-        if (typeof a !== "string" || a.length === 0)
-            return false;
-        if (typeof b !== "string" || b.length === 0)
-            return false;
-        return a === b;
-    }
 }

package/dist/rules/AttrPairCompare.d.mts

@@ -0,0 +1,35 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type CompareOp } from "./_sharedValidation.mjs";
+export interface AttrPairCompareConfig {
+    a: string;
+    op: CompareOp;
+    b: string;
+    group?: string;
+}
+/**
+ * Rule that passes when two named attributes are present, are both numbers,
+ * and satisfy the configured comparison operator. NaN on either side always
+ * returns false (JS native comparison semantics). Missing, null, or non-number
+ * attributes return false (safe-deny).
+ *
+ * Unlike AttrLiteralCompare, the right-hand side comes from the attributes map
+ * at evaluation time rather than from a static config value — so NaN is not
+ * rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `b`:
+ *   `attr_pair_compare:{a}:{op}:{b}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrPairCompare implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_compare_violated";
+    readonly message: string;
+    constructor(config: AttrPairCompareConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrPairCompare.d.mts.map