@o3co/auth.policy-verifier.builtins 0.12.0 → 0.13.0

package/dist/rules/AttrLiteralEqual.mjs

@@ -21,25 +21,34 @@ import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_
  *
  * Pass a shared `group` string to two instances to opt into OR semantics
  * (e.g. "role is admin" OR "role is superuser" under one group).
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrLiteralEqual {
-    config;
     ruleType;
     code = "attr_not_equal";
     message;
+    a;
+    v;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrLiteralEqual", "a", config.a);
-        requireLiteralValue("AttrLiteralEqual", "v", config.v);
+        const a = requireAttrName("AttrLiteralEqual", "a", config.a);
+        const v = requireLiteralValue("AttrLiteralEqual", "v", config.v);
         const group = requireOptionalGroup("AttrLiteralEqual", config.group);
-        this.ruleType =
-            group ?? `attr_literal_equal:${config.a}:${typeof config.v}:${String(config.v)}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must equal ${String(config.v)}.`;
+        this.a = a;
+        this.v = v;
+        this.ruleType = group ?? `attr_literal_equal:${a}:${typeof v}:${String(v)}`;
+        this.message = `Attribute constraint not satisfied: ${a} must equal ${String(v)}.`;
     }
     verify(attrs) {
-        const x = attrs.get(this.config.a);
-        if (typeof x !== typeof this.config.v)
+        const x = attrs.get(this.a);
+        if (typeof x !== typeof this.v)
             return false;
-        return x === this.config.v;
+        return x === this.v;
     }
 }

package/dist/rules/AttrLiteralIn.d.mts

@@ -24,12 +24,20 @@ export interface AttrLiteralInConfig {
  * will share a ruleType and be OR-combined.
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrLiteralIn implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_not_in_set";
     readonly message: string;
+    private readonly a;
     private readonly elementType;
     private readonly valuesSet;
     constructor(config: AttrLiteralInConfig);

package/dist/rules/AttrLiteralIn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAQ7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,mBAAmB;IAaxD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,aAAc,YAAW,IAAI;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,mBAAmB;IAcvC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralIn.mjs

@@ -20,27 +20,35 @@ import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requ
  * will share a ruleType and be OR-combined.
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrLiteralIn {
-    config;
     ruleType;
     code = "attr_not_in_set";
     message;
+    a;
     elementType;
     valuesSet;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrLiteralIn", "a", config.a);
+        const a = requireAttrName("AttrLiteralIn", "a", config.a);
         const values = requireHomogeneousLiteralArray("AttrLiteralIn", config.values);
         const group = requireOptionalGroup("AttrLiteralIn", config.group);
+        this.a = a;
         this.elementType = typeof values[0];
         this.valuesSet = new Set(values);
         const valuesKey = computeValuesKey(values);
-        this.ruleType = group ?? `attr_literal_in:${config.a}:${valuesKey}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must be one of [${values.map(String).join(", ")}].`;
+        this.ruleType = group ?? `attr_literal_in:${a}:${valuesKey}`;
+        this.message = `Attribute constraint not satisfied: ${a} must be one of [${values.map(String).join(", ")}].`;
     }
     verify(attrs) {
-        const x = attrs.get(this.config.a);
+        const x = attrs.get(this.a);
         if (typeof x !== this.elementType)
             return false;
         return this.valuesSet.has(x);

package/dist/rules/AttrLiteralNotEqual.d.mts

@@ -9,7 +9,8 @@ export interface AttrLiteralNotEqualConfig {
  * Rule that passes when a named attribute is present, matches the type of the
  * configured literal value, and is strictly NOT equal to it. No type coercion
  * is performed. If the attribute is missing, null, or of the wrong type the
- * rule returns false (safe-deny).
+ * rule returns false (safe-deny). A `NaN` attribute against a number literal
+ * is an unequal number and passes; whether it should deny is #254.
  *
  * ## Grouping and the default ruleType
  *
@@ -24,12 +25,21 @@ export interface AttrLiteralNotEqualConfig {
  * of two independent constraints. See AttrLiteralEqual for the same rationale.
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrLiteralNotEqual implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_equal";
     readonly message: string;
+    private readonly a;
+    private readonly v;
     constructor(config: AttrLiteralNotEqualConfig);
     verify(attrs: ReadonlyAttributes): boolean;
 }

package/dist/rules/AttrLiteralNotEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAKnC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,yBAAyB;IAU9D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,yBAAyB;IAW7C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralNotEqual.mjs

@@ -5,7 +5,8 @@ import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_
  * Rule that passes when a named attribute is present, matches the type of the
  * configured literal value, and is strictly NOT equal to it. No type coercion
  * is performed. If the attribute is missing, null, or of the wrong type the
- * rule returns false (safe-deny).
+ * rule returns false (safe-deny). A `NaN` attribute against a number literal
+ * is an unequal number and passes; whether it should deny is #254.
  *
  * ## Grouping and the default ruleType
  *
@@ -20,25 +21,34 @@ import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_
  * of two independent constraints. See AttrLiteralEqual for the same rationale.
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrLiteralNotEqual {
-    config;
     ruleType;
     code = "attr_equal";
     message;
+    a;
+    v;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrLiteralNotEqual", "a", config.a);
-        requireLiteralValue("AttrLiteralNotEqual", "v", config.v);
+        const a = requireAttrName("AttrLiteralNotEqual", "a", config.a);
+        const v = requireLiteralValue("AttrLiteralNotEqual", "v", config.v);
         const group = requireOptionalGroup("AttrLiteralNotEqual", config.group);
-        this.ruleType =
-            group ?? `attr_literal_not_equal:${config.a}:${typeof config.v}:${String(config.v)}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must not equal ${String(config.v)}.`;
+        this.a = a;
+        this.v = v;
+        this.ruleType = group ?? `attr_literal_not_equal:${a}:${typeof v}:${String(v)}`;
+        this.message = `Attribute constraint not satisfied: ${a} must not equal ${String(v)}.`;
     }
     verify(attrs) {
-        const x = attrs.get(this.config.a);
-        if (typeof x !== typeof this.config.v)
+        const x = attrs.get(this.a);
+        if (typeof x !== typeof this.v)
             return false;
-        return x !== this.config.v;
+        return x !== this.v;
     }
 }

package/dist/rules/AttrLiteralNotIn.d.mts

@@ -9,7 +9,8 @@ export interface AttrLiteralNotInConfig {
  * Rule that passes when a named attribute is present, matches the element type
  * of the configured values array, and is NOT included in that array. No type
  * coercion is performed. If the attribute is missing, null, or of the wrong
- * type the rule returns false (safe-deny).
+ * type the rule returns false (safe-deny). A `NaN` attribute against number
+ * values is in none of them and passes; whether it should deny is #254.
  *
  * ## Grouping and the default ruleType
  *
@@ -19,12 +20,20 @@ export interface AttrLiteralNotInConfig {
  *   `attr_literal_not_in:{a}:{valuesKey}`
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrLiteralNotIn implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_in_set";
     readonly message: string;
+    private readonly a;
     private readonly elementType;
     private readonly valuesSet;
     constructor(config: AttrLiteralNotInConfig);

package/dist/rules/AttrLiteralNotIn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAQhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,sBAAsB;IAa3D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,sBAAsB;IAc1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralNotIn.mjs

@@ -5,7 +5,8 @@ import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requ
  * Rule that passes when a named attribute is present, matches the element type
  * of the configured values array, and is NOT included in that array. No type
  * coercion is performed. If the attribute is missing, null, or of the wrong
- * type the rule returns false (safe-deny).
+ * type the rule returns false (safe-deny). A `NaN` attribute against number
+ * values is in none of them and passes; whether it should deny is #254.
  *
  * ## Grouping and the default ruleType
  *
@@ -15,27 +16,35 @@ import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requ
  *   `attr_literal_not_in:{a}:{valuesKey}`
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrLiteralNotIn {
-    config;
     ruleType;
     code = "attr_in_set";
     message;
+    a;
     elementType;
     valuesSet;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrLiteralNotIn", "a", config.a);
+        const a = requireAttrName("AttrLiteralNotIn", "a", config.a);
         const values = requireHomogeneousLiteralArray("AttrLiteralNotIn", config.values);
         const group = requireOptionalGroup("AttrLiteralNotIn", config.group);
+        this.a = a;
         this.elementType = typeof values[0];
         this.valuesSet = new Set(values);
         const valuesKey = computeValuesKey(values);
-        this.ruleType = group ?? `attr_literal_not_in:${config.a}:${valuesKey}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must not be one of [${values.map(String).join(", ")}].`;
+        this.ruleType = group ?? `attr_literal_not_in:${a}:${valuesKey}`;
+        this.message = `Attribute constraint not satisfied: ${a} must not be one of [${values.map(String).join(", ")}].`;
     }
     verify(attrs) {
-        const x = attrs.get(this.config.a);
+        const x = attrs.get(this.a);
         if (typeof x !== this.elementType)
             return false;
         return !this.valuesSet.has(x);

package/dist/rules/AttrMatchRule.d.mts

@@ -1,11 +1,12 @@
 import { AttrPairEqual, type AttrPairEqualConfig } from "./AttrPairEqual.mjs";
 export type AttrMatchRuleConfig = AttrPairEqualConfig;
 /**
- * @deprecated Use {@link AttrPairEqual}. Scheduled for removal in a future major version.
+ * @deprecated since v0.3 — use {@link AttrPairEqual}.
  *
  * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
  * and legacy `message` wording. `verify()` semantics are inherited unchanged from
  * `AttrPairEqual`: both named attributes must be non-empty strings and equal.
+ * Its config is validated by `super`, so a refusal names `AttrPairEqual`.
  */
 export declare class AttrMatchRule extends AttrPairEqual {
     readonly ruleType: string;

package/dist/rules/AttrMatchRule.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,aAAa;IAC/C,SAAkB,QAAQ,EAAE,MAAM,CAAC;IACnC,SAAkB,OAAO,EAAE,MAAM,CAAC;gBAEtB,MAAM,EAAE,mBAAmB;CAKvC"}
+{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,aAAa;IAC/C,SAAkB,QAAQ,EAAE,MAAM,CAAC;IACnC,SAAkB,OAAO,EAAE,MAAM,CAAC;gBAEtB,MAAM,EAAE,mBAAmB;CAKvC"}

package/dist/rules/AttrMatchRule.mjs

@@ -1,12 +1,17 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
+/*
+ * The deprecated `AttrMatchRule`: `AttrPairEqual` under its legacy `ruleType`
+ * and message, kept for existing configurations.
+ */
 import { AttrPairEqual } from "./AttrPairEqual.mjs";
 /**
- * @deprecated Use {@link AttrPairEqual}. Scheduled for removal in a future major version.
+ * @deprecated since v0.3 — use {@link AttrPairEqual}.
  *
  * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
  * and legacy `message` wording. `verify()` semantics are inherited unchanged from
  * `AttrPairEqual`: both named attributes must be non-empty strings and equal.
+ * Its config is validated by `super`, so a refusal names `AttrPairEqual`.
  */
 export class AttrMatchRule extends AttrPairEqual {
     ruleType;

package/dist/rules/AttrPairCompare.d.mts

@@ -23,12 +23,22 @@ export interface AttrPairCompareConfig {
  *   `attr_pair_compare:{a}:{op}:{b}`
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrPairCompare implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_compare_violated";
     readonly message: string;
+    private readonly a;
+    private readonly op;
+    private readonly b;
     constructor(config: AttrPairCompareConfig);
     verify(attrs: ReadonlyAttributes): boolean;
 }

package/dist/rules/AttrPairCompare.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAK/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,qBAAqB;IAU1D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}
+{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,qBAAqB;IAazC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairCompare.mjs

@@ -18,28 +18,40 @@ import { applyCompare, requireAttrName, requireCompareOp, requireOptionalGroup,
  *   `attr_pair_compare:{a}:{op}:{b}`
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrPairCompare {
-    config;
     ruleType;
     code = "attr_compare_violated";
     message;
+    a;
+    op;
+    b;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrPairCompare", "a", config.a);
-        requireAttrName("AttrPairCompare", "b", config.b);
-        requireCompareOp("AttrPairCompare", config.op);
+        const a = requireAttrName("AttrPairCompare", "a", config.a);
+        const b = requireAttrName("AttrPairCompare", "b", config.b);
+        const op = requireCompareOp("AttrPairCompare", config.op);
         const group = requireOptionalGroup("AttrPairCompare", config.group);
-        this.ruleType = group ?? `attr_pair_compare:${config.a}:${config.op}:${config.b}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must be ${config.op} ${config.b}.`;
+        this.a = a;
+        this.op = op;
+        this.b = b;
+        this.ruleType = group ?? `attr_pair_compare:${a}:${op}:${b}`;
+        this.message = `Attribute constraint not satisfied: ${a} must be ${op} ${b}.`;
     }
     verify(attrs) {
-        const a = attrs.get(this.config.a);
-        const b = attrs.get(this.config.b);
+        const a = attrs.get(this.a);
+        const b = attrs.get(this.b);
         if (typeof a !== "number")
             return false;
         if (typeof b !== "number")
             return false;
-        return applyCompare(this.config.op, a, b);
+        return applyCompare(this.op, a, b);
     }
 }

package/dist/rules/AttrPairEqual.d.mts

@@ -23,12 +23,21 @@ export interface AttrPairEqualConfig {
  *   `attr_pair_equal:{a}:{b}`
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrPairEqual implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_mismatch";
     readonly message: string;
+    private readonly a;
+    private readonly b;
     constructor(config: AttrPairEqualConfig);
     verify(attrs: ReadonlyAttributes): boolean;
 }

package/dist/rules/AttrPairEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,mBAAmB;IASxD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}
+{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,aAAc,YAAW,IAAI;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,mBAAmB;IAWvC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairEqual.mjs

@@ -20,23 +20,33 @@ import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
  *   `attr_pair_equal:{a}:{b}`
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrPairEqual {
-    config;
     ruleType;
     code = "attr_mismatch";
     message;
+    a;
+    b;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrPairEqual", "a", config.a);
-        requireAttrName("AttrPairEqual", "b", config.b);
+        const a = requireAttrName("AttrPairEqual", "a", config.a);
+        const b = requireAttrName("AttrPairEqual", "b", config.b);
         const group = requireOptionalGroup("AttrPairEqual", config.group);
-        this.ruleType = group ?? `attr_pair_equal:${config.a}:${config.b}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must equal ${config.b}.`;
+        this.a = a;
+        this.b = b;
+        this.ruleType = group ?? `attr_pair_equal:${a}:${b}`;
+        this.message = `Attribute constraint not satisfied: ${a} must equal ${b}.`;
     }
     verify(attrs) {
-        const a = attrs.get(this.config.a);
-        const b = attrs.get(this.config.b);
+        const a = attrs.get(this.a);
+        const b = attrs.get(this.b);
         if (typeof a !== "string" || a.length === 0)
             return false;
         if (typeof b !== "string" || b.length === 0)

package/dist/rules/AttrPairNotEqual.d.mts

@@ -22,12 +22,21 @@ export interface AttrPairNotEqualConfig {
  *   `attr_pair_not_equal:{a}:{b}`
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrPairNotEqual implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_match";
     readonly message: string;
+    private readonly a;
+    private readonly b;
     constructor(config: AttrPairNotEqualConfig);
     verify(attrs: ReadonlyAttributes): boolean;
 }

package/dist/rules/AttrPairNotEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAS3D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}
+{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,sBAAsB;IAW1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairNotEqual.mjs

@@ -19,23 +19,33 @@ import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
  *   `attr_pair_not_equal:{a}:{b}`
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrPairNotEqual {
-    config;
     ruleType;
     code = "attr_match";
     message;
+    a;
+    b;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrPairNotEqual", "a", config.a);
-        requireAttrName("AttrPairNotEqual", "b", config.b);
+        const a = requireAttrName("AttrPairNotEqual", "a", config.a);
+        const b = requireAttrName("AttrPairNotEqual", "b", config.b);
         const group = requireOptionalGroup("AttrPairNotEqual", config.group);
-        this.ruleType = group ?? `attr_pair_not_equal:${config.a}:${config.b}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must not equal ${config.b}.`;
+        this.a = a;
+        this.b = b;
+        this.ruleType = group ?? `attr_pair_not_equal:${a}:${b}`;
+        this.message = `Attribute constraint not satisfied: ${a} must not equal ${b}.`;
     }
     verify(attrs) {
-        const a = attrs.get(this.config.a);
-        const b = attrs.get(this.config.b);
+        const a = attrs.get(this.a);
+        const b = attrs.get(this.b);
         if (typeof a !== "string" || a.length === 0)
             return false;
         if (typeof b !== "string" || b.length === 0)

package/dist/rules/HasPermission.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAoB1C,OAAO,CAAC,KAAK;CA0Bb"}
+{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAoB1C,OAAO,CAAC,KAAK;CA0Bb"}

package/dist/rules/HasScope.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HasScope.d.mts","sourceRoot":"","sources":["../../src/rules/HasScope.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC/B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,QAAS,YAAW,IAAI;IAQnC,OAAO,CAAC,KAAK;IAPd,QAAQ,CAAC,QAAQ,WAAW;IAC5B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;gBAGvC,KAAK,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,eAAe;IAM1B,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAM1C,OAAO,CAAC,UAAU;CAYlB"}
+{"version":3,"file":"HasScope.d.mts","sourceRoot":"","sources":["../../src/rules/HasScope.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC/B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,QAAS,YAAW,IAAI;IAQnC,OAAO,CAAC,KAAK;IAPd,QAAQ,CAAC,QAAQ,WAAW;IAC5B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;gBAGvC,KAAK,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,eAAe;IAM1B,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAM1C,OAAO,CAAC,UAAU;CAYlB"}

package/dist/rules/collectors/ResourceActionPermissionRuleCollector.d.mts

@@ -1,7 +1,7 @@
 import type { CollectorContext, Rule, RuleCollector } from "@o3co/auth.policy-verifier.core";
 /**
  * Rule collector that emits a single `HasPermission` rule for the
- * `{resource}.perm:{action}` permission string. Use when the effective
+ * `{resource.raw}.perm:{action}` permission string. Use when the effective
  * permission is encoded directly into the token's permission attribute rather
  * than derived from scopes.
  */

package/dist/rules/collectors/ResourceActionPermissionRuleCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ResourceActionPermissionRuleCollector.d.mts","sourceRoot":"","sources":["../../../src/rules/collectors/ResourceActionPermissionRuleCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;GAKG;AACH,qBAAa,qCAAsC,YAAW,aAAa;IACpE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAIzD"}
+{"version":3,"file":"ResourceActionPermissionRuleCollector.d.mts","sourceRoot":"","sources":["../../../src/rules/collectors/ResourceActionPermissionRuleCollector.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;GAKG;AACH,qBAAa,qCAAsC,YAAW,aAAa;IACpE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAIzD"}

package/dist/rules/collectors/ResourceActionPermissionRuleCollector.mjs

@@ -3,7 +3,7 @@
 import { HasPermission } from "../HasPermission.mjs";
 /**
  * Rule collector that emits a single `HasPermission` rule for the
- * `{resource}.perm:{action}` permission string. Use when the effective
+ * `{resource.raw}.perm:{action}` permission string. Use when the effective
  * permission is encoded directly into the token's permission attribute rather
  * than derived from scopes.
  */

package/dist/rules/collectors/ResourceActionScopeRuleCollector.d.mts

@@ -18,7 +18,11 @@ export interface ResourceActionScopeRuleCollectorConfig {
     /**
      * The claim whose presence says the token asserted scopes (#219). Defaults
      * to `scope`; set it to what `PayloadScopeCollector` reads (`scp` for Okta)
-     * so the two agree about which tokens are scopeless.
+     * so the two look at the same claim — each keeps its own option, and
+     * nothing checks that both were given the same name. Only presence is
+     * checked here: a claim holding no usable scope list (`""`, a number)
+     * yields no scopes from `PayloadScopeCollector` but still counts as scoped
+     * under `scopeless: "skip"`.
      */
     claim?: string;
 }