@o3co/auth.policy-verifier.builtins 0.2.0 → 0.3.1

package/dist/rules/AttrPairCompare.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAK/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,qBAAqB;IAU1D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}

package/dist/rules/AttrPairCompare.mjs

@@ -0,0 +1,43 @@
+import { applyCompare, requireAttrName, requireCompareOp, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when two named attributes are present, are both numbers,
+ * and satisfy the configured comparison operator. NaN on either side always
+ * returns false (JS native comparison semantics). Missing, null, or non-number
+ * attributes return false (safe-deny).
+ *
+ * Unlike AttrLiteralCompare, the right-hand side comes from the attributes map
+ * at evaluation time rather than from a static config value — so NaN is not
+ * rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `b`:
+ *   `attr_pair_compare:{a}:{op}:{b}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrPairCompare {
+    config;
+    ruleType;
+    code = "attr_compare_violated";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrPairCompare", "a", config.a);
+        requireAttrName("AttrPairCompare", "b", config.b);
+        requireCompareOp("AttrPairCompare", config.op);
+        const group = requireOptionalGroup("AttrPairCompare", config.group);
+        this.ruleType = group ?? `attr_pair_compare:${config.a}:${config.op}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must be ${config.op} ${config.b}.`;
+    }
+    verify(attrs) {
+        const a = attrs.get(this.config.a);
+        const b = attrs.get(this.config.b);
+        if (typeof a !== "number")
+            return false;
+        if (typeof b !== "number")
+            return false;
+        return applyCompare(this.config.op, a, b);
+    }
+}

package/dist/rules/AttrPairEqual.d.mts

@@ -0,0 +1,35 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+export interface AttrPairEqualConfig {
+    a: string;
+    b: string;
+    group?: string;
+}
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly equal. No type coercion is performed: both
+ * attribute values must be non-empty strings.
+ *
+ * ## Backward compatibility
+ *
+ * AttrPairEqual deliberately retains the string-only semantic of the legacy
+ * AttrMatchRule. Do not widen verify() to accept numbers or booleans — the
+ * Phase 4 AttrMatchRule alias depends on this invariant.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b` so that
+ * distinct pair requirements are AND-combined by default:
+ *   `attr_pair_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export declare class AttrPairEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_mismatch";
+    readonly message: string;
+    constructor(config: AttrPairEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrPairEqual.d.mts.map

package/dist/rules/AttrPairEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGxE,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,mBAAmB;IASxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}

package/dist/rules/AttrPairEqual.mjs

@@ -0,0 +1,44 @@
+import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly equal. No type coercion is performed: both
+ * attribute values must be non-empty strings.
+ *
+ * ## Backward compatibility
+ *
+ * AttrPairEqual deliberately retains the string-only semantic of the legacy
+ * AttrMatchRule. Do not widen verify() to accept numbers or booleans — the
+ * Phase 4 AttrMatchRule alias depends on this invariant.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b` so that
+ * distinct pair requirements are AND-combined by default:
+ *   `attr_pair_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export class AttrPairEqual {
+    config;
+    ruleType;
+    code = "attr_mismatch";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrPairEqual", "a", config.a);
+        requireAttrName("AttrPairEqual", "b", config.b);
+        const group = requireOptionalGroup("AttrPairEqual", config.group);
+        this.ruleType = group ?? `attr_pair_equal:${config.a}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must equal ${config.b}.`;
+    }
+    verify(attrs) {
+        const a = attrs.get(this.config.a);
+        const b = attrs.get(this.config.b);
+        if (typeof a !== "string" || a.length === 0)
+            return false;
+        if (typeof b !== "string" || b.length === 0)
+            return false;
+        return a === b;
+    }
+}

package/dist/rules/AttrPairNotEqual.d.mts

@@ -0,0 +1,34 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+export interface AttrPairNotEqualConfig {
+    a: string;
+    b: string;
+    group?: string;
+}
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly NOT equal. No type coercion is performed: both
+ * attribute values must be non-empty strings. Missing, null, empty, or
+ * non-string attributes return false (safe-deny).
+ *
+ * ## Denial code
+ *
+ * The denial code is "attr_match": the rule failed because the pair matched
+ * when it was required to differ.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b`:
+ *   `attr_pair_not_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export declare class AttrPairNotEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_match";
+    readonly message: string;
+    constructor(config: AttrPairNotEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrPairNotEqual.d.mts.map

package/dist/rules/AttrPairNotEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGxE,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAS3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}

package/dist/rules/AttrPairNotEqual.mjs

@@ -0,0 +1,43 @@
+import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly NOT equal. No type coercion is performed: both
+ * attribute values must be non-empty strings. Missing, null, empty, or
+ * non-string attributes return false (safe-deny).
+ *
+ * ## Denial code
+ *
+ * The denial code is "attr_match": the rule failed because the pair matched
+ * when it was required to differ.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b`:
+ *   `attr_pair_not_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export class AttrPairNotEqual {
+    config;
+    ruleType;
+    code = "attr_match";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrPairNotEqual", "a", config.a);
+        requireAttrName("AttrPairNotEqual", "b", config.b);
+        const group = requireOptionalGroup("AttrPairNotEqual", config.group);
+        this.ruleType = group ?? `attr_pair_not_equal:${config.a}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must not equal ${config.b}.`;
+    }
+    verify(attrs) {
+        const a = attrs.get(this.config.a);
+        const b = attrs.get(this.config.b);
+        if (typeof a !== "string" || a.length === 0)
+            return false;
+        if (typeof b !== "string" || b.length === 0)
+            return false;
+        return a !== b;
+    }
+}

package/dist/rules/_sharedValidation.d.mts

@@ -0,0 +1,87 @@
+/**
+ * Shared validation helpers for attribute-based rule constructors.
+ */
+export type LiteralValue = string | number | boolean;
+export type CompareOp = "lt" | "le" | "gt" | "ge";
+export declare const COMPARE_OPS: readonly CompareOp[];
+/**
+ * Validates that a config field used as an attribute name is a non-empty string
+ * that does not contain the `:` separator character used in derived `ruleType`
+ * strings. Allowing `:` would let distinct configs collide on the same
+ * `ruleType` (e.g. `(a="x:y", b="z")` and `(a="x", b="y:z")` both produce
+ * `attr_pair_equal:x:y:z`), which the evaluator would silently OR together
+ * and weaken authorization.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("a" or "b"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated non-empty string.
+ * @throws {Error} If value is not a non-empty string, or contains `:`.
+ */
+export declare function requireAttrName(className: string, fieldName: "a" | "b", value: unknown): string;
+/**
+ * Validates that a config field used as a literal comparison value is a
+ * string, number, or boolean (i.e. a LiteralValue). NaN is rejected because
+ * its comparison semantics (`NaN !== NaN` is always true, `NaN === NaN` is
+ * always false) would silently invert Equal/NotEqual rules — a NotEqual(v=NaN)
+ * would always pass against any numeric attribute, weakening authorization.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("v"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated LiteralValue.
+ * @throws {Error} If value is null, undefined, of any other type, or NaN.
+ */
+export declare function requireLiteralValue(className: string, fieldName: "v", value: unknown): LiteralValue;
+/**
+ * Validates a numeric comparison value. Rejects NaN; accepts Infinity/-Infinity.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("v"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated number.
+ * @throws {Error} If value is not a number, or if value is NaN.
+ */
+export declare function requireNumber(className: string, fieldName: "v", value: unknown): number;
+/**
+ * Validates that a value is a non-empty, homogeneous array of LiteralValues
+ * (no null/undefined elements, no NaN elements, all elements the same typeof).
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated LiteralValue array.
+ * @throws {Error} If not an array, empty, contains invalid elements, has mixed types, or contains NaN.
+ */
+export declare function requireHomogeneousLiteralArray(className: string, value: unknown): LiteralValue[];
+/**
+ * Validates that a value is one of the allowed CompareOp strings.
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated CompareOp.
+ * @throws {Error} If value is not a string or not one of the allowed operators.
+ */
+export declare function requireCompareOp(className: string, value: unknown): CompareOp;
+/**
+ * Validates an optional group string. Returns undefined when value is undefined;
+ * throws when value is a non-string or an empty string; otherwise returns the
+ * non-empty string.
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated non-empty string, or undefined.
+ * @throws {Error} If value is a non-string or an empty string.
+ */
+export declare function requireOptionalGroup(className: string, value: unknown): string | undefined;
+/**
+ * Computes a stable cache/dedup key for an array of LiteralValues.
+ * Format: `{type}:{count}:{hashPrefix}` — SHA-256 over a canonical serialization
+ * of `values`. The canonical form first deduplicates `values` (to mirror the
+ * Set-based semantics of AttrLiteralIn / AttrLiteralNotIn — duplicates do not
+ * change the rule's behavior, so they must not change its `ruleType`), then
+ * applies `JSON.stringify(String(v))` to each remaining element before sorting
+ * and joining with `,`. The per-element quoting prevents separator collisions
+ * across different arrays (e.g. `["a,b", "c"]` vs `["a", "b,c"]`).
+ * The `{count}` segment reflects the post-dedup element count.
+ * Caller must guarantee values is a non-empty homogeneous LiteralValue[].
+ */
+export declare function computeValuesKey(values: LiteralValue[]): string;
+/**
+ * Applies a numeric comparison operator between left and right.
+ */
+export declare function applyCompare<T extends number>(op: CompareOp, left: T, right: T): boolean;
+//# sourceMappingURL=_sharedValidation.d.mts.map

package/dist/rules/_sharedValidation.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_sharedValidation.d.mts","sourceRoot":"","sources":["../../src/rules/_sharedValidation.mts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAarD,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAA6B,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAe/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,GAAG,EACd,KAAK,EAAE,OAAO,GACZ,YAAY,CAad;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAQvF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAU7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAS/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAWxF"}

package/dist/rules/_sharedValidation.mjs

@@ -0,0 +1,189 @@
+import { createHash } from "node:crypto";
+/**
+ * Returns a human-readable type label for use in error messages.
+ * Distinguishes null and undefined from other types instead of returning
+ * "object" or "undefined" from typeof.
+ */
+function describeType(value) {
+    if (value === null)
+        return "null";
+    if (value === undefined)
+        return "undefined";
+    return typeof value;
+}
+export const COMPARE_OPS = ["lt", "le", "gt", "ge"];
+/**
+ * Validates that a config field used as an attribute name is a non-empty string
+ * that does not contain the `:` separator character used in derived `ruleType`
+ * strings. Allowing `:` would let distinct configs collide on the same
+ * `ruleType` (e.g. `(a="x:y", b="z")` and `(a="x", b="y:z")` both produce
+ * `attr_pair_equal:x:y:z`), which the evaluator would silently OR together
+ * and weaken authorization.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("a" or "b"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated non-empty string.
+ * @throws {Error} If value is not a non-empty string, or contains `:`.
+ */
+export function requireAttrName(className, fieldName, value) {
+    if (typeof value !== "string") {
+        throw new Error(`${className}: '${fieldName}' must be a non-empty string, got ${describeType(value)}`);
+    }
+    if (value.length === 0) {
+        throw new Error(`${className}: '${fieldName}' must be a non-empty string, got empty string`);
+    }
+    if (value.includes(":")) {
+        throw new Error(`${className}: '${fieldName}' must not contain ':' (reserved as ruleType separator), got '${value}'`);
+    }
+    return value;
+}
+/**
+ * Validates that a config field used as a literal comparison value is a
+ * string, number, or boolean (i.e. a LiteralValue). NaN is rejected because
+ * its comparison semantics (`NaN !== NaN` is always true, `NaN === NaN` is
+ * always false) would silently invert Equal/NotEqual rules — a NotEqual(v=NaN)
+ * would always pass against any numeric attribute, weakening authorization.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("v"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated LiteralValue.
+ * @throws {Error} If value is null, undefined, of any other type, or NaN.
+ */
+export function requireLiteralValue(className, fieldName, value) {
+    if (typeof value === "string" || typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (Number.isNaN(value)) {
+            throw new Error(`${className}: '${fieldName}' must not be NaN`);
+        }
+        return value;
+    }
+    throw new Error(`${className}: '${fieldName}' must be string | number | boolean, got ${describeType(value)}`);
+}
+/**
+ * Validates a numeric comparison value. Rejects NaN; accepts Infinity/-Infinity.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("v"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated number.
+ * @throws {Error} If value is not a number, or if value is NaN.
+ */
+export function requireNumber(className, fieldName, value) {
+    if (typeof value !== "number") {
+        throw new Error(`${className}: '${fieldName}' must be a number, got ${describeType(value)}`);
+    }
+    if (Number.isNaN(value)) {
+        throw new Error(`${className}: '${fieldName}' must not be NaN`);
+    }
+    return value;
+}
+/**
+ * Validates that a value is a non-empty, homogeneous array of LiteralValues
+ * (no null/undefined elements, no NaN elements, all elements the same typeof).
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated LiteralValue array.
+ * @throws {Error} If not an array, empty, contains invalid elements, has mixed types, or contains NaN.
+ */
+export function requireHomogeneousLiteralArray(className, value) {
+    if (!Array.isArray(value)) {
+        throw new Error(`${className}: 'values' must be a non-empty array of string | number | boolean, got ${describeType(value)}`);
+    }
+    if (value.length === 0) {
+        throw new Error(`${className}: 'values' must be a non-empty array`);
+    }
+    const seenTypes = new Set();
+    for (const element of value) {
+        if (element === null || element === undefined) {
+            throw new Error(`${className}: 'values' elements must be string | number | boolean, got ${describeType(element)}`);
+        }
+        const t = typeof element;
+        if (t !== "string" && t !== "number" && t !== "boolean") {
+            throw new Error(`${className}: 'values' elements must be string | number | boolean, got ${t}`);
+        }
+        if (t === "number" && Number.isNaN(element)) {
+            throw new Error(`${className}: 'values' must not contain NaN`);
+        }
+        seenTypes.add(t);
+    }
+    if (seenTypes.size > 1) {
+        const typeList = [...seenTypes].join(", ");
+        throw new Error(`${className}: 'values' must be a homogeneous array of string | number | boolean; got mixed types [${typeList}]`);
+    }
+    return value;
+}
+/**
+ * Validates that a value is one of the allowed CompareOp strings.
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated CompareOp.
+ * @throws {Error} If value is not a string or not one of the allowed operators.
+ */
+export function requireCompareOp(className, value) {
+    if (typeof value !== "string") {
+        throw new Error(`${className}: 'op' must be one of ${COMPARE_OPS.join(" | ")}, got ${describeType(value)}`);
+    }
+    if (!COMPARE_OPS.includes(value)) {
+        throw new Error(`${className}: 'op' must be one of ${COMPARE_OPS.join(" | ")}, got '${value}'`);
+    }
+    return value;
+}
+/**
+ * Validates an optional group string. Returns undefined when value is undefined;
+ * throws when value is a non-string or an empty string; otherwise returns the
+ * non-empty string.
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated non-empty string, or undefined.
+ * @throws {Error} If value is a non-string or an empty string.
+ */
+export function requireOptionalGroup(className, value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new Error(`${className}: 'group' must be a non-empty string or undefined, got ${describeType(value)}`);
+    }
+    if (value.length === 0) {
+        throw new Error(`${className}: 'group' must be a non-empty string or undefined, got empty string`);
+    }
+    return value;
+}
+/**
+ * Computes a stable cache/dedup key for an array of LiteralValues.
+ * Format: `{type}:{count}:{hashPrefix}` — SHA-256 over a canonical serialization
+ * of `values`. The canonical form first deduplicates `values` (to mirror the
+ * Set-based semantics of AttrLiteralIn / AttrLiteralNotIn — duplicates do not
+ * change the rule's behavior, so they must not change its `ruleType`), then
+ * applies `JSON.stringify(String(v))` to each remaining element before sorting
+ * and joining with `,`. The per-element quoting prevents separator collisions
+ * across different arrays (e.g. `["a,b", "c"]` vs `["a", "b,c"]`).
+ * The `{count}` segment reflects the post-dedup element count.
+ * Caller must guarantee values is a non-empty homogeneous LiteralValue[].
+ */
+export function computeValuesKey(values) {
+    const elementType = typeof values[0];
+    const unique = [...new Set(values)];
+    const joined = unique
+        .map((v) => JSON.stringify(String(v)))
+        .sort()
+        .join(",");
+    const hash = createHash("sha256").update(joined).digest("hex").slice(0, 8);
+    return `${elementType}:${unique.length}:${hash}`;
+}
+/**
+ * Applies a numeric comparison operator between left and right.
+ */
+export function applyCompare(op, left, right) {
+    switch (op) {
+        case "lt":
+            return left < right;
+        case "le":
+            return left <= right;
+        case "gt":
+            return left > right;
+        case "ge":
+            return left >= right;
+    }
+}

package/dist/rules/collectors/ResourceActionPermissionRuleCollector.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceActionPermissionRuleCollector.d.mts","sourceRoot":"","sources":["../../../src/rules/collectors/ResourceActionPermissionRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F,qBAAa,qCAAsC,YAAW,aAAa;IACpE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAIzD"}

package/dist/rules/{ResourceActionPermissionRuleCollector.mjs → collectors/ResourceActionPermissionRuleCollector.mjs}

@@ -1,4 +1,4 @@
-import { HasPermission } from "./HasPermission.mjs";
+import { HasPermission } from "../HasPermission.mjs";
 export class ResourceActionPermissionRuleCollector {
     async collect(context) {
         const permission = `${context.resource.raw}.perm:${context.action}`;

package/dist/rules/collectors/ResourceActionScopeRuleCollector.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../../src/rules/collectors/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,YAAW,aAAa;IAC/D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAOzD"}

package/dist/rules/{ResourceActionScopeRuleCollector.mjs → collectors/ResourceActionScopeRuleCollector.mjs}

@@ -1,4 +1,4 @@
-import { HasScope } from "./HasScope.mjs";
+import { HasScope } from "../HasScope.mjs";
 /**
  * Generates a HasScope rule derived from the request action and resource type.
  *

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@o3co/auth.policy-verifier.builtins",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "license": "Apache-2.0",
   "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.mts",
   "exports": {
@@ -28,7 +31,7 @@
     }
   },
   "dependencies": {
-    "@o3co/auth.policy-verifier.core": "0.2.0"
+    "@o3co/auth.policy-verifier.core": "0.3.1"
   },
   "devDependencies": {
     "@types/node": "^25.1.0",

package/dist/__tests__/rules/ResourceActionPermissionRuleCollector.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ResourceActionPermissionRuleCollector.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/ResourceActionPermissionRuleCollector.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/ResourceActionScopeRuleCollector.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ResourceActionScopeRuleCollector.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/ResourceActionScopeRuleCollector.test.mts"],"names":[],"mappings":""}

package/dist/rules/ResourceActionPermissionRuleCollector.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ResourceActionPermissionRuleCollector.d.mts","sourceRoot":"","sources":["../../src/rules/ResourceActionPermissionRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F,qBAAa,qCAAsC,YAAW,aAAa;IACpE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAIzD"}

package/dist/rules/ResourceActionScopeRuleCollector.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../src/rules/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,YAAW,aAAa;IAC/D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAOzD"}