@o3co/auth.policy-verifier.builtins 0.12.0 → 0.14.0

package/README.ja.md

@@ -1,9 +1,23 @@
 # @o3co/auth.policy-verifier.builtins
 
+最終更新: 2026-09-24
+
 auth.policy-verifier 向けの組み込み attribute collector、rule collector、および resource parser です。
 
 **Runtime:** `BigInt` と `Map.groupBy` をサポートするサーバー／エッジ JavaScript ランタイムが対象です — Node.js 22+（`engines.node` で宣言しており、古い Node ではインストール時にブロックされます）、Cloudflare Workers、Vercel Edge、Deno、Bun。ブラウザは設計上対象外です（認可判定はサーバー側で enforcement する必要があるため）。同梱の `server` パッケージは引き続き Node 専用です。
 
+## 責務と役割
+
+core のインターフェースを実装した、小さな既製のセットです: attribute collector、rule、rule collector、resource parser、そしてそれらを server の `createApp` などのホストに登録する `builtinCollectorsModule`。依存は `@o3co/auth.policy-verifier.core` だけです。`templates/standalone` がこれを組み込み、`server` はテストでのみ使います（`devDependencies`）。
+
+- **所有するもの:** これらの実装が何を読み、何を書き、どう照合するか — JWT クレーム（`sub`、`azp`、`scope`、宣言したクレーム）から属性キーへの対応（#170）、`HasScope` / `HasPermission` と比較ルールの照合規則、ドット記法のリソース文法。
+- **所有しないもの:** パイプライン、グルーピング、判定（core）、認証や HTTP（`server`）、ポリシーエンジンや `AsyncRule`（`cedar`）、I/O を行う collector（利用側が書くもの。[docs/extending.ja.md](../../docs/extending.ja.md)）。
+- **core と別パッケージである理由:** core はエンジン中立の契約で、subject のフィールドを一切名指ししません（#170）。クレームの語彙と具体的な照合はその線の反対側、つまりここに置きます（[AGENTS.md — Core Vocabulary Scope](../../AGENTS.md#core-vocabulary-scope)）。また任意導入でもあります: builtins は意図的に基本セットであってカタログではない（[docs/extending.ja.md](../../docs/extending.ja.md)）ので、collector と rule を自前で書くデプロイメントはインストール不要で、core もこれに合わせて肥大化しません。
+
+各ソースディレクトリの責務・役割・不変条件（英語）:
+[`src/collectors/README.md`](src/collectors/README.md)（attribute collector）、
+[`src/rules/README.md`](src/rules/README.md)（rule と rule collector）。
+
 ## インストール
 
 ```bash
@@ -23,7 +37,7 @@ npm install @o3co/auth.policy-verifier.builtins
 | `RequestContextAttributeCollector` | `requestContext` の宣言済みフィールド | 運用者が決めたキー | `{ attributes: Mapping[] }` |
 | `PayloadClaimAttributeCollector` | 検証済み `subject` の宣言済みクレーム | 運用者が決めたキー、または core の 5 キー | `{ attributes: Mapping[] }` (#219) |
 
-`StaticPermissionCollector` と `StaticRoleCollector` は、リクエストのコンテキストに関わらず、コンストラクタに渡した値を常に出力します。
+`StaticPermissionCollector` と `StaticRoleCollector` は、リクエストのコンテキストに関わらず、コンストラクタに渡した値を常に出力します。渡された値は構築時にコピーされます — 配列、そして `StaticRoleCollector` では各 `Role` とその `permissions` も — ので、構築後に config を変更しても出力は変わりません（#255）。`permissions` と `roles` は配列でなければなりません。それ以外の値は、文字列も含めて（`["posts.*"]` のつもりで `permissions = "posts.*"` と書いた場合など）構築時に `TypeError` で拒否され、デプロイは起動時に失敗します（#264）。
 
 ### PayloadClaimAttributeCollector
 
@@ -40,7 +54,7 @@ npm install @o3co/auth.policy-verifier.builtins
 
 マッピングの形は `RequestContextAttributeCollector` と同じです（`{ from, to?, type? }`、完全一致するキーが dot path より優先、own property のみ）。違うのは読み取り元であり、したがって信頼度です: subject バッグは authenticator が検証したものなので、request-context コレクターが拒否する core の 5 キー — `scopes`、`permissions`、`roles`、`userId`、`clientId` — にもマッピングを着地させて**かまいません**。2 つのコレクターが 1 つのリストキーに書けば union されます。それはデプロイが issuer 由来の 2 つのソースを合成しているということであり、config にそう書かれています。一方、2 つのコレクターが異なる値で書いた*スカラー*キーは `AttributeConflictError` を投げ、すべてのリクエストを deny します — `PayloadSubjectIdCollector` も `userId` / `clientId` を書いている間は、そこへマッピングしないでください。別のパッケージが予約したキー（cedar の `request*`）は引き続き拒否されます。それらは subject ではなくリクエストから導出されるものだからです。そして、マッピングするのは IdP が自身の登録データや管理データから埋めるクレームだけにしてください: ユーザーが編集できるメタデータ（Clerk の `unsafe_metadata`、Auth0 の `user_metadata`）から発行されたクレームは、署名されてはいても信頼できるものではありません。
 
-scope クレームについては `PayloadScopeCollector { claim = "scp" }` を優先してください。こちらはスペース区切り文字列の形も読み、`ResourceActionScopeRuleCollector { claim = "scp" }` と組にすることで、どのトークンが scopeless かについて両者の判断が一致します。
+scope クレームについては `PayloadScopeCollector { claim = "scp" }` を優先してください。こちらはスペース区切り文字列の形も読み、`ResourceActionScopeRuleCollector { claim = "scp" }` と組にすることで、両者が同じ claim を見ます（それぞれが自分の `claim` を持ち、一致は検査されないので両方に設定してください）。rule collector は claim の有無だけを見ます — 使える scope リストを持たない claim（`""`、数値）は scope を生まない一方、`scopeless = "skip"` では scope ありとして扱われます。
 
 ### RequestContextAttributeCollector
 
@@ -116,7 +130,7 @@ new HasScope(scope: string, options?: { allowBareScopeRewrite?: boolean })
 
 ### AttrMatchRule
 
-**非推奨。** 代わりに [`AttrPairEqual`](#attrpairequal) を使用してください。`AttrMatchRule` は `AttrPairEqual` を継承した薄いラッパークラスとして残されており、後方互換のため旧来の `ruleType`（`attr_match:${a}:${b}`）と旧来の `message` 文言を保持します。型 `AttrMatchRuleConfig` は `AttrPairEqualConfig` の型エイリアスです。将来のメジャーバージョンで削除されます。
+**非推奨。** 代わりに [`AttrPairEqual`](#attrpairequal) を使用してください。`AttrMatchRule` は `AttrPairEqual` を継承した薄いラッパークラスとして残されており、後方互換のため旧来の `ruleType`（`attr_match:${a}:${b}`）と旧来の `message` 文言を保持します。型 `AttrMatchRuleConfig` は `AttrPairEqualConfig` の型エイリアスです。v0.3 から非推奨で、将来のリリースで削除される可能性があります（変更の可能性あり）。
 
 ```ts
 new AttrMatchRule({ a: string, b: string, group?: string })
@@ -158,7 +172,7 @@ new AttrLiteralNotEqual({ a: string, v: string | number | boolean, group?: strin
 
 - `code`: `"attr_equal"`。
 - 既定の `ruleType`: `` `attr_literal_not_equal:${a}:${typeof v}:${String(v)}` ``。`typeof v` セグメントは異型リテラル間の衝突を防ぎます（`AttrLiteralEqual` と同じ理由）。
-- `attrs.get(a)` が `v` と同じ型で厳密等価でないときに通過します。欠落または型不一致は `false`（safe-deny）を返します。
+- `attrs.get(a)` が `v` と同じ型で厳密等価でないときに通過します。欠落・型不一致・`NaN` は `false`（safe-deny）を返します。`NaN` はどの数値とも等しくないため、数値でない値で制限が通過しないよう明示的に拒否します（#254）。
 
 ### AttrLiteralIn
 
@@ -178,7 +192,7 @@ new AttrLiteralNotIn({ a: string, values: (string | number | boolean)[], group?:
 
 - `code`: `"attr_in_set"`。
 - 既定の `ruleType`: `` `attr_literal_not_in:${a}:${type}:${count}:${hashPrefix}` `` — `AttrLiteralIn` と同じ、重複除去済みの安定ハッシュ方式。
-- `values` は非空かつ同種の配列。`attrs.get(a)` が集合に含まれないときに通過します。`values` 内の重複要素は Rule の挙動に影響しません。
+- `values` は非空かつ同種の配列。`attrs.get(a)` が `values` と同じ型で、集合に含まれないときに通過します。欠落・型不一致・`NaN` は `false`（safe-deny）を返します — `NaN` はどの集合にも含まれませんが、同様に拒否します（#254）。`values` 内の重複要素は Rule の挙動に影響しません。
 
 ### AttrLiteralCompare
 
@@ -224,6 +238,10 @@ new AttrPairCompare({ a: string, op: "lt" | "le" | "gt" | "ge", b: string, group
 
 属性比較 Rule はすべて、上記 `AttrMatchRule` と同じグルーピング規則に従います。既定では各 Rule の `ruleType` は識別用パラメータから導出されるため、異なる要件は評価器によって AND 結合されます。2 つの Rule に同じ `group` 文字列を渡すと、両者は同じ `ruleType` を持つようになり、評価器は OR 結合します（どちらか一方が成立すれば要件を満たす）。
 
+### config は構築時にコピーされる
+
+属性比較 Rule はすべて、config の各フィールドを一度だけ読んで検証し、自身のコピーとして保持します（#255）。構築後に config オブジェクトを変更しても — `a`、`b`、`op`、`v` の置き換えや `values` の編集 — Rule の応答も `ruleType` と `message` も変わらず、コンストラクタが拒否する値（`NaN` リテラルなど）を後から差し込むこともできません。
+
 ## Rule Collectors
 
 | 名前 | 導出する permission / scope | 返り値 |
@@ -299,6 +317,8 @@ tchar    = %x21 / %x23-2D / %x2F-39 / %x3B-5B / %x5D-7E
 import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
 ```
 
+以下は執筆時点の登録内容です。正は [`src/module.mts`](src/module.mts) です。
+
 | レジストリ | 名前 | ファクトリ |
 | --- | --- | --- |
 | `attributeCollector` | `"PayloadScopeCollector"` | `(config) => new PayloadScopeCollector(config)` |
@@ -313,6 +333,7 @@ import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
 
 ## 関連
 
+- [`src/collectors/README.md`](src/collectors/README.md)、[`src/rules/README.md`](src/rules/README.md) — このパッケージのソースディレクトリの責務・役割・不変条件（英語）
 - [拡張ガイド (`docs/extending.ja.md`)](../../docs/extending.ja.md) — カスタム `Rule` / `AttributeCollector` の書き方と、`builtins` が基本セットとして位置づけられている理由
 - [`@o3co/auth.policy-verifier.core`](../core/README.ja.md) — コアインターフェースと attribute 定数
 - [auth.policy-verifier ルート README](../../README.ja.md) — 完全なセットアップと設定のリファレンス

package/README.md

@@ -1,9 +1,38 @@
 # @o3co/auth.policy-verifier.builtins
 
+Last updated: 2026-09-24
+
 Built-in attribute collectors, rule collectors, and resource parser for auth.policy-verifier.
 
 **Runtime:** Server- and edge-side JavaScript runtimes that support `BigInt` and `Map.groupBy` — Node.js 22+ (declared via `engines.node` so older Node installs are blocked at install time), Cloudflare Workers, Vercel Edge, Deno, Bun. Browsers are out of scope by design: authorization decisions must be enforced server-side. The `server` companion package remains Node-only.
 
+## Responsibility
+
+A small, ready-made set of implementations of core's interfaces: attribute collectors, rules,
+rule collectors, a resource parser, and `builtinCollectorsModule`, which registers them for
+a host such as the server's `createApp`. It depends on `@o3co/auth.policy-verifier.core` alone;
+`templates/standalone` wires it in, and `server` uses it only in its tests
+(`devDependencies`).
+
+- **Owns** what these implementations read, write and match: the mapping from JWT claims
+  (`sub`, `azp`, `scope`, declared claims) to attribute keys (#170), the matching rules of
+  `HasScope` / `HasPermission` and the comparison rules, and the dot-notation resource
+  grammar.
+- **Does not own** the pipelines, the grouping or the decision (core), authentication or HTTP
+  (`server`), policy engines or `AsyncRule`s (`cedar`), or collectors that do I/O — those are
+  the consumer's to write ([docs/extending.md](../../docs/extending.md)).
+- **Why a separate package from core:** core is the engine-neutral contract and names no
+  field of the subject (#170); the claim vocabulary and the concrete matching live here, on
+  the other side of that line ([AGENTS.md — Core Vocabulary Scope](../../AGENTS.md#core-vocabulary-scope)).
+  It is also optional: builtins is a deliberately basic set, not a catalog
+  ([docs/extending.md — Positioning](../../docs/extending.md#positioning-builtins-is-a-basic-set-not-an-exhaustive-catalog)),
+  so a deployment that writes its own collectors and rules does not have to install it, and
+  core does not grow with it.
+
+Responsibility, role and invariants of each source directory:
+[`src/collectors/README.md`](src/collectors/README.md) (attribute collectors) and
+[`src/rules/README.md`](src/rules/README.md) (rules and rule collectors).
+
 ## Install
 
 ```bash
@@ -23,7 +52,7 @@ All collectors implement `AttributeCollector`.
 | `RequestContextAttributeCollector` | declared fields of `requestContext` | the operator's own keys | `{ attributes: Mapping[] }` |
 | `PayloadClaimAttributeCollector` | declared claims of the verified `subject` | the operator's own keys, or core's five | `{ attributes: Mapping[] }` (#219) |
 
-`StaticPermissionCollector` and `StaticRoleCollector` always emit the values supplied at construction time, regardless of request context.
+`StaticPermissionCollector` and `StaticRoleCollector` always emit the values supplied at construction time, regardless of request context. They copy what they were given at construction — the array, and for `StaticRoleCollector` each `Role` and its `permissions` — so mutating the config afterwards changes nothing they emit (#255). `permissions` and `roles` must be arrays: anything else, a string included (`permissions = "posts.*"` where `["posts.*"]` was meant), is refused with a `TypeError` at construction, so the deployment fails at boot (#264).
 
 ### PayloadClaimAttributeCollector
 
@@ -40,7 +69,7 @@ Promotes declared claims of the **verified subject** into attributes (#219) —
 
 Same mapping shape as `RequestContextAttributeCollector` (`{ from, to?, type? }`, an exact key winning over a dot path, own properties only). What differs is the source, and therefore the trust: the subject bag is what the authenticator verified, so a mapping **may** land on core's five keys — `scopes`, `permissions`, `roles`, `userId`, `clientId` — where the request-context collector refuses them. Two collectors writing one list key union it; that is the deployment composing two issuer-derived sources, and it says so in config. A *scalar* key written by two collectors with different values throws `AttributeConflictError` and denies every request — do not map onto `userId` / `clientId` while `PayloadSubjectIdCollector` also writes them. Keys another package reserved (cedar's `request*`) stay refused, because they are derived from the request, not from the subject. And map only claims the IdP populates from its own registration or admin data: a claim minted from user-editable metadata (Clerk's `unsafe_metadata`, Auth0's `user_metadata`) is signed, not trusted.
 
-For the scope claim specifically, prefer `PayloadScopeCollector { claim = "scp" }`, which also reads the space-delimited string form and pairs with `ResourceActionScopeRuleCollector { claim = "scp" }` so both agree about which tokens are scopeless.
+For the scope claim specifically, prefer `PayloadScopeCollector { claim = "scp" }`, which also reads the space-delimited string form and pairs with `ResourceActionScopeRuleCollector { claim = "scp" }` — set on both, since each keeps its own `claim` and nothing checks they match — so both look at the same claim. The rule collector checks only that the claim is present: a claim holding no usable scope list (`""`, a number) yields no scopes but still counts as scoped under `scopeless = "skip"`.
 
 ### RequestContextAttributeCollector
 
@@ -116,7 +145,7 @@ new HasScope(scope: string, options?: { allowBareScopeRewrite?: boolean })
 
 ### AttrMatchRule
 
-**Deprecated.** Use [`AttrPairEqual`](#attrpairequal) instead. `AttrMatchRule` is kept as a thin wrapper class that extends `AttrPairEqual` and preserves the legacy `ruleType` (`attr_match:${a}:${b}`) and legacy `message` wording for backward compatibility. The type `AttrMatchRuleConfig` is a type alias of `AttrPairEqualConfig`. It will be removed in a future major version.
+**Deprecated.** Use [`AttrPairEqual`](#attrpairequal) instead. `AttrMatchRule` is kept as a thin wrapper class that extends `AttrPairEqual` and preserves the legacy `ruleType` (`attr_match:${a}:${b}`) and legacy `message` wording for backward compatibility. The type `AttrMatchRuleConfig` is a type alias of `AttrPairEqualConfig`. Deprecated since v0.3; it may be removed in a future release (subject to change).
 
 ```ts
 new AttrMatchRule({ a: string, b: string, group?: string })
@@ -158,7 +187,7 @@ new AttrLiteralNotEqual({ a: string, v: string | number | boolean, group?: strin
 
 - `code`: `"attr_equal"`.
 - Default `ruleType`: `` `attr_literal_not_equal:${a}:${typeof v}:${String(v)}` ``. The `typeof v` segment prevents silent collisions between distinct-type literals (same rationale as `AttrLiteralEqual`).
-- Passes when `attrs.get(a)` is the same type as `v` and strictly not equal to it. Missing or wrong-type attributes return `false` (safe-deny).
+- Passes when `attrs.get(a)` is the same type as `v` and strictly not equal to it. Missing, wrong-type or `NaN` attributes return `false` (safe-deny): `NaN` is unequal to every number, and a restriction must not pass on a value that is not a number at all (#254).
 
 ### AttrLiteralIn
 
@@ -178,7 +207,7 @@ new AttrLiteralNotIn({ a: string, values: (string | number | boolean)[], group?:
 
 - `code`: `"attr_in_set"`.
 - Default `ruleType`: `` `attr_literal_not_in:${a}:${type}:${count}:${hashPrefix}` `` — same stable, deduplication-aware hash scheme as `AttrLiteralIn`.
-- `values` must be a non-empty, homogeneous array. Passes when `attrs.get(a)` is NOT in the set. Duplicate elements in `values` are ignored.
+- `values` must be a non-empty, homogeneous array. Passes when `attrs.get(a)` is the same type as the values and NOT in the set. Missing, wrong-type or `NaN` attributes return `false` (safe-deny); `NaN` is in no set, so it would otherwise pass (#254). Duplicate elements in `values` are ignored.
 
 ### AttrLiteralCompare
 
@@ -224,6 +253,10 @@ new AttrPairCompare({ a: string, op: "lt" | "le" | "gt" | "ge", b: string, group
 
 All attribute comparison rules follow the same grouping semantics described for `AttrMatchRule` above. By default, each rule's `ruleType` is derived from its distinguishing parameters so that distinct requirements are AND-combined by the evaluator. Pass the same `group` string to two rules to give them the same `ruleType` — the evaluator then OR-combines them (either condition satisfies the requirement).
 
+### Configuration is copied at construction
+
+Every attribute comparison rule reads each field of its config once, validates it, and keeps its own copy (#255). Mutating the config object afterwards — replacing `a`, `b`, `op` or `v`, or editing `values` — changes neither the rule's answers nor its `ruleType` and `message`, and a value the constructor would refuse (such as a `NaN` literal) cannot be installed after it.
+
 ## Rule Collectors
 
 | Name | Derives permission/scope | Returns |
@@ -301,6 +334,8 @@ that syntax.
 import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
 ```
 
+Registrations as of this writing; the source of truth is [`src/module.mts`](src/module.mts).
+
 | Registry | Name | Factory |
 | --- | --- | --- |
 | `attributeCollector` | `"PayloadScopeCollector"` | `(config) => new PayloadScopeCollector(config)` |
@@ -315,6 +350,7 @@ import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
 
 ## See Also
 
+- [`src/collectors/README.md`](src/collectors/README.md), [`src/rules/README.md`](src/rules/README.md) — responsibility, role and invariants of this package's source directories
 - [Extension guide (`docs/extending.md`)](../../docs/extending.md) — how to write custom `Rule` and `AttributeCollector` implementations; positioning of `builtins` as a basic set
 - [`@o3co/auth.policy-verifier.core`](../core/README.md) — core interfaces and attribute constants
 - [auth.policy-verifier root README](../../README.md) — full setup and configuration reference

package/dist/collectors/PayloadClaimAttributeCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"PayloadClaimAttributeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadClaimAttributeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EAIzB,MAAM,yBAAyB,CAAC;AAEjC,yEAAyE;AACzE,MAAM,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAC5D,wCAAwC;AACxC,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAC7D,iEAAiE;AACjE,MAAM,MAAM,oCAAoC,GAAG,+BAA+B,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,qBAAa,8BAA+B,YAAW,kBAAkB;IACxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAE1C,MAAM,EAAE,oCAAoC;IASlD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAK7D"}
+{"version":3,"file":"PayloadClaimAttributeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadClaimAttributeCollector.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EAIzB,MAAM,yBAAyB,CAAC;AAEjC,yEAAyE;AACzE,MAAM,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAC5D,wCAAwC;AACxC,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAC7D,iEAAiE;AACjE,MAAM,MAAM,oCAAoC,GAAG,+BAA+B,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,qBAAa,8BAA+B,YAAW,kBAAkB;IACxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAE1C,MAAM,EAAE,oCAAoC;IASlD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAK7D"}

package/dist/collectors/PayloadScopeCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"PayloadScopeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadScopeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAIzC,wDAAwD;AACxD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,MAAM,CAAC,EAAE,2BAA2B;IAI1C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAG7D"}
+{"version":3,"file":"PayloadScopeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadScopeCollector.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAIzC,wDAAwD;AACxD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,MAAM,CAAC,EAAE,2BAA2B;IAI1C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAG7D"}

package/dist/collectors/PayloadSubjectIdCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"PayloadSubjectIdCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadSubjectIdCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAC7D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAW7D"}
+{"version":3,"file":"PayloadSubjectIdCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadSubjectIdCollector.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAC7D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAW7D"}

package/dist/collectors/RequestContextAttributeCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"RequestContextAttributeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/RequestContextAttributeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EAIzB,MAAM,yBAAyB,CAAC;AAEjC,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;AAE9D,mEAAmE;AACnE,MAAM,MAAM,sCAAsC,GAAG,+BAA+B,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,qBAAa,gCAAiC,YAAW,kBAAkB;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAE1C,MAAM,EAAE,sCAAsC;IAOpD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAQ7D"}
+{"version":3,"file":"RequestContextAttributeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/RequestContextAttributeCollector.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EAIzB,MAAM,yBAAyB,CAAC;AAEjC,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;AAE9D,mEAAmE;AACnE,MAAM,MAAM,sCAAsC,GAAG,+BAA+B,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,qBAAa,gCAAiC,YAAW,kBAAkB;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAE1C,MAAM,EAAE,sCAAsC;IAOpD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAQ7D"}

package/dist/collectors/StaticPermissionCollector.d.mts

@@ -3,9 +3,23 @@ import type { AttributeCollector, Attributes, CollectorContext } from "@o3co/aut
  * Attribute collector that returns a configured constant permission list under
  * `ATTR_PERMISSIONS`, independent of the JWT payload. Useful for
  * environments where permissions are static per deployment.
+ *
+ * The list is copied at construction (#255): a caller that mutates the config
+ * or its array afterwards changes nothing this collector emits.
+ *
+ * Only an array is accepted (#264). Anything else — a missing field, `null`, a
+ * number, an object, a string — is refused with a `TypeError` naming the
+ * collector and the field, so a misconfigured deployment fails at boot. A
+ * string is the case that matters: it is iterable, so copying it would split
+ * `"posts.*"` into single characters, and `HasPermission` honours a lone `*`
+ * as grant-all.
+ *
+ * The entries are not checked, and a non-string one is copied as it is. It is
+ * inert: `HasPermission` skips every permission that is not a string, so such
+ * an entry matches no requirement and grants nothing.
  */
 export declare class StaticPermissionCollector implements AttributeCollector {
-    private permissions;
+    private readonly permissions;
     constructor(config: {
         permissions: string[];
     });

package/dist/collectors/StaticPermissionCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"StaticPermissionCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/StaticPermissionCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAGzC;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IACnE,OAAO,CAAC,WAAW,CAAW;gBAElB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE;IAIvC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAG9D"}
+{"version":3,"file":"StaticPermissionCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/StaticPermissionCollector.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IACnE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAEpC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE;IAUvC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAG9D"}

package/dist/collectors/StaticPermissionCollector.mjs

@@ -5,11 +5,29 @@ import { ATTR_PERMISSIONS } from "@o3co/auth.policy-verifier.core";
  * Attribute collector that returns a configured constant permission list under
  * `ATTR_PERMISSIONS`, independent of the JWT payload. Useful for
  * environments where permissions are static per deployment.
+ *
+ * The list is copied at construction (#255): a caller that mutates the config
+ * or its array afterwards changes nothing this collector emits.
+ *
+ * Only an array is accepted (#264). Anything else — a missing field, `null`, a
+ * number, an object, a string — is refused with a `TypeError` naming the
+ * collector and the field, so a misconfigured deployment fails at boot. A
+ * string is the case that matters: it is iterable, so copying it would split
+ * `"posts.*"` into single characters, and `HasPermission` honours a lone `*`
+ * as grant-all.
+ *
+ * The entries are not checked, and a non-string one is copied as it is. It is
+ * inert: `HasPermission` skips every permission that is not a string, so such
+ * an entry matches no requirement and grants nothing.
  */
 export class StaticPermissionCollector {
     permissions;
     constructor(config) {
-        this.permissions = config.permissions;
+        const { permissions } = config;
+        if (!Array.isArray(permissions)) {
+            throw new TypeError(`StaticPermissionCollector: permissions must be an array (got ${permissions === null ? "null" : typeof permissions})`);
+        }
+        this.permissions = [...permissions];
     }
     async collect(_context) {
         return new Map([[ATTR_PERMISSIONS, [...this.permissions]]]);

package/dist/collectors/StaticRoleCollector.d.mts

@@ -3,9 +3,25 @@ import type { AttributeCollector, Attributes, CollectorContext, Role } from "@o3
  * Attribute collector that returns a configured constant role list under
  * `ATTR_ROLES`, independent of the JWT payload. Each role bundles a name and
  * the permissions it implies.
+ *
+ * The list is copied at construction, and so is each role in it and each
+ * role's `permissions` array (#255): a caller that mutates the config, its
+ * array or a `Role` in it afterwards changes nothing this collector emits.
+ *
+ * Only an array is accepted (#264). Anything else — a missing field, `null`, a
+ * number, an object, a string — is refused with a `TypeError` naming the
+ * collector and the field, so a misconfigured deployment fails at boot. A
+ * string is iterable and would otherwise be split into single characters, as
+ * it would be in `StaticPermissionCollector`.
+ *
+ * The entries are not checked: a malformed `Role` entry is copied as it is
+ * (see `copyRole`). It is inert: `HasPermission` ignores a role that is not an
+ * object or whose `permissions` is not an array, and a non-string permission
+ * inside a role. Each collect returns a shallow copy of the list, so its `Role`
+ * copies are shared between the outputs of different collects.
  */
 export declare class StaticRoleCollector implements AttributeCollector {
-    private roles;
+    private readonly roles;
     constructor(config: {
         roles: Role[];
     });

package/dist/collectors/StaticRoleCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"StaticRoleCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/StaticRoleCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,IAAI,EACJ,MAAM,iCAAiC,CAAC;AAGzC;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,kBAAkB;IAC7D,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE;QAAE,KAAK,EAAE,IAAI,EAAE,CAAA;KAAE;IAI/B,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAG9D"}
+{"version":3,"file":"StaticRoleCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/StaticRoleCollector.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,IAAI,EACJ,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,mBAAoB,YAAW,kBAAkB;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;gBAE5B,MAAM,EAAE;QAAE,KAAK,EAAE,IAAI,EAAE,CAAA;KAAE;IAU/B,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAG9D"}

package/dist/collectors/StaticRoleCollector.mjs

@@ -5,13 +5,52 @@ import { ATTR_ROLES } from "@o3co/auth.policy-verifier.core";
  * Attribute collector that returns a configured constant role list under
  * `ATTR_ROLES`, independent of the JWT payload. Each role bundles a name and
  * the permissions it implies.
+ *
+ * The list is copied at construction, and so is each role in it and each
+ * role's `permissions` array (#255): a caller that mutates the config, its
+ * array or a `Role` in it afterwards changes nothing this collector emits.
+ *
+ * Only an array is accepted (#264). Anything else — a missing field, `null`, a
+ * number, an object, a string — is refused with a `TypeError` naming the
+ * collector and the field, so a misconfigured deployment fails at boot. A
+ * string is iterable and would otherwise be split into single characters, as
+ * it would be in `StaticPermissionCollector`.
+ *
+ * The entries are not checked: a malformed `Role` entry is copied as it is
+ * (see `copyRole`). It is inert: `HasPermission` ignores a role that is not an
+ * object or whose `permissions` is not an array, and a non-string permission
+ * inside a role. Each collect returns a shallow copy of the list, so its `Role`
+ * copies are shared between the outputs of different collects.
  */
 export class StaticRoleCollector {
     roles;
     constructor(config) {
-        this.roles = config.roles;
+        const { roles } = config;
+        if (!Array.isArray(roles)) {
+            throw new TypeError(`StaticRoleCollector: roles must be an array (got ${roles === null ? "null" : typeof roles})`);
+        }
+        this.roles = [...roles].map(copyRole);
     }
     async collect(_context) {
         return new Map([[ATTR_ROLES, [...this.roles]]]);
     }
 }
+/**
+ * Copies one configured role: the object, and its `permissions` array.
+ *
+ * Nothing about the entry is validated here, and a malformed one keeps its
+ * shape rather than being coerced — `HasPermission` ignores a role that is not
+ * an object or whose `permissions` is not an array (#180), and spreading a bare
+ * string under `permissions` would splay it into characters it then honours.
+ */
+function copyRole(role) {
+    if (typeof role !== "object" || role === null)
+        return role;
+    // An array is an object too: spreading it into `{ ...role }` would turn it
+    // into an index-keyed object, so it is copied as an array.
+    if (Array.isArray(role))
+        return [...role];
+    return Array.isArray(role.permissions)
+        ? { ...role, permissions: [...role.permissions] }
+        : { ...role };
+}

package/dist/collectors/_attributeMapping.d.mts

@@ -38,8 +38,16 @@ export declare function parseAttributeMappings(collector: string, config: Attrib
  * through a configured name.
  */
 export declare function readPath(root: Record<string, unknown>, path: string): unknown;
-/** Whether `value` is usable as the declared type. Empty strings count as absent. */
+/**
+ * Whether `value` is usable as the declared type. Empty strings count as
+ * absent, so one empty entry disqualifies a whole `string[]`. A `number` must
+ * be finite: `NaN` and `±Infinity` are dropped here, while a rule's comparand
+ * (`requireNumber` in `../rules/_sharedValidation.mts`) may be `Infinity`.
+ */
 export declare function matchesType(value: unknown, type: AttributeMappingType): boolean;
-/** Promotes every declared field whose value matches its declared type. */
+/**
+ * Promotes every declared field whose value matches its declared type, into a
+ * fresh map; a promoted list is a copy, not the source's array.
+ */
 export declare function promoteMappings(mappings: readonly ResolvedAttributeMapping[], source: Record<string, unknown>): Attributes;
 //# sourceMappingURL=_attributeMapping.d.mts.map

package/dist/collectors/_attributeMapping.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_attributeMapping.d.mts","sourceRoot":"","sources":["../../src/collectors/_attributeMapping.mts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG3F,wCAAwC;AACxC,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAEhF,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAKlE,CAAC;AAEF,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,IAAI,CAAC,EAAE,oBAAoB,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,+BAA+B;IAC/C,wDAAwD;IACxD,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC/B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,uBAAuB,KAChC,MAAM,GAAG,SAAS,CAAC;AAExB;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,+BAA+B,GAAG,SAAS,EACnD,iBAAiB,EAAE,iBAAiB,GAClC,wBAAwB,EAAE,CA4B5B;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAS7E;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAW/E;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,SAAS,wBAAwB,EAAE,EAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,UAAU,CASZ"}
+{"version":3,"file":"_attributeMapping.d.mts","sourceRoot":"","sources":["../../src/collectors/_attributeMapping.mts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG3F,wCAAwC;AACxC,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAEhF,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAKlE,CAAC;AAEF,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,IAAI,CAAC,EAAE,oBAAoB,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,+BAA+B;IAC/C,wDAAwD;IACxD,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC/B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,uBAAuB,KAChC,MAAM,GAAG,SAAS,CAAC;AAExB;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,+BAA+B,GAAG,SAAS,EACnD,iBAAiB,EAAE,iBAAiB,GAClC,wBAAwB,EAAE,CA4B5B;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAW/E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,SAAS,wBAAwB,EAAE,EAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,UAAU,CASZ"}

package/dist/collectors/_attributeMapping.mjs

@@ -58,7 +58,12 @@ export function readPath(root, path) {
     }
     return current;
 }
-/** Whether `value` is usable as the declared type. Empty strings count as absent. */
+/**
+ * Whether `value` is usable as the declared type. Empty strings count as
+ * absent, so one empty entry disqualifies a whole `string[]`. A `number` must
+ * be finite: `NaN` and `±Infinity` are dropped here, while a rule's comparand
+ * (`requireNumber` in `../rules/_sharedValidation.mts`) may be `Infinity`.
+ */
 export function matchesType(value, type) {
     switch (type) {
         case "string":
@@ -71,7 +76,10 @@ export function matchesType(value, type) {
             return Array.isArray(value) && value.every((item) => typeof item === "string" && item !== "");
     }
 }
-/** Promotes every declared field whose value matches its declared type. */
+/**
+ * Promotes every declared field whose value matches its declared type, into a
+ * fresh map; a promoted list is a copy, not the source's array.
+ */
 export function promoteMappings(mappings, source) {
     const attrs = new Map();
     for (const mapping of mappings) {

package/dist/collectors/_claims.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_claims.d.mts","sourceRoot":"","sources":["../../src/collectors/_claims.mts"],"names":[],"mappings":"AASA,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM1F;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAMnD"}
+{"version":3,"file":"_claims.d.mts","sourceRoot":"","sources":["../../src/collectors/_claims.mts"],"names":[],"mappings":"AAaA,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM1F;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAMnD"}

package/dist/collectors/_claims.mjs

@@ -1,9 +1,13 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
 /*
- * Which claim carries the scopes, and how its value is read (#219). Shared by
- * the collector that promotes scopes and the rule collector that has to know
- * whether a token asserted any, so the two cannot disagree about a token.
+ * Which claim carries the scopes, and how its value is read (#219).
+ * `PayloadScopeCollector` and `ResourceActionScopeRuleCollector` share the
+ * default claim name and refuse the same bad `claim` option; only
+ * `PayloadScopeCollector` reads the value (`scopesFrom`), while the rule
+ * collector checks only whether the claim is present. Each keeps its own
+ * `claim` option, and nothing checks that both were given the same name. Not
+ * exported from the package.
  */
 /** The claim RFC 8693 §4.2 / RFC 9068 §2.2.3 name, and the default. */
 export const DEFAULT_SCOPE_CLAIM = "scope";

package/dist/module.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAW9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MA6CrC,CAAC"}
+{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAW9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MA6CrC,CAAC"}

package/dist/resource/DotNotationResourceParser.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"DotNotationResourceParser.d.mts","sourceRoot":"","sources":["../../src/resource/DotNotationResourceParser.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqBhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,qBAAa,yBAA0B,YAAW,cAAc;IAC/D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;CAY5B"}
+{"version":3,"file":"DotNotationResourceParser.d.mts","sourceRoot":"","sources":["../../src/resource/DotNotationResourceParser.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqBhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,qBAAa,yBAA0B,YAAW,cAAc;IAC/D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;CAY5B"}

package/dist/rules/AttrLiteralCompare.d.mts

@@ -19,12 +19,22 @@ export interface AttrLiteralCompareConfig {
  *   `attr_literal_compare:{a}:{op}:{String(v)}`
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrLiteralCompare implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_compare_violated";
     readonly message: string;
+    private readonly a;
+    private readonly op;
+    private readonly v;
     constructor(config: AttrLiteralCompareConfig);
     verify(attrs: ReadonlyAttributes): boolean;
 }

package/dist/rules/AttrLiteralCompare.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAKlC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,wBAAwB;IAU7D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,wBAAwB;IAa5C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralCompare.mjs

@@ -14,25 +14,37 @@ import { applyCompare, requireAttrName, requireCompareOp, requireNumber, require
  *   `attr_literal_compare:{a}:{op}:{String(v)}`
  *
  * Pass an explicit `group` string to override the default ruleType entirely.
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export class AttrLiteralCompare {
-    config;
     ruleType;
     code = "attr_compare_violated";
     message;
+    a;
+    op;
+    v;
     constructor(config) {
-        this.config = config;
-        requireAttrName("AttrLiteralCompare", "a", config.a);
-        requireNumber("AttrLiteralCompare", "v", config.v);
-        requireCompareOp("AttrLiteralCompare", config.op);
+        const a = requireAttrName("AttrLiteralCompare", "a", config.a);
+        const v = requireNumber("AttrLiteralCompare", "v", config.v);
+        const op = requireCompareOp("AttrLiteralCompare", config.op);
         const group = requireOptionalGroup("AttrLiteralCompare", config.group);
-        this.ruleType = group ?? `attr_literal_compare:${config.a}:${config.op}:${String(config.v)}`;
-        this.message = `Attribute constraint not satisfied: ${config.a} must be ${config.op} ${String(config.v)}.`;
+        this.a = a;
+        this.op = op;
+        this.v = v;
+        this.ruleType = group ?? `attr_literal_compare:${a}:${op}:${String(v)}`;
+        this.message = `Attribute constraint not satisfied: ${a} must be ${op} ${String(v)}.`;
     }
     verify(attrs) {
-        const x = attrs.get(this.config.a);
+        const x = attrs.get(this.a);
         if (typeof x !== "number")
             return false;
-        return applyCompare(this.config.op, x, this.config.v);
+        return applyCompare(this.op, x, this.v);
     }
 }

package/dist/rules/AttrLiteralEqual.d.mts

@@ -25,12 +25,21 @@ export interface AttrLiteralEqualConfig {
  *
  * Pass a shared `group` string to two instances to opt into OR semantics
  * (e.g. "role is admin" OR "role is superuser" under one group).
+ *
+ * ## Configuration is copied at construction
+ *
+ * The constructor reads each field of `config` once, validates it, and keeps
+ * the validated value in a field of its own; the object is not retained (#255).
+ * A caller that mutates the config afterwards changes nothing: the rule answers
+ * from the values it validated, and `ruleType` and `message` keep describing
+ * them.
  */
 export declare class AttrLiteralEqual implements Rule {
-    private readonly config;
     readonly ruleType: string;
     readonly code = "attr_not_equal";
     readonly message: string;
+    private readonly a;
+    private readonly v;
     constructor(config: AttrLiteralEqualConfig);
     verify(attrs: ReadonlyAttributes): boolean;
 }

package/dist/rules/AttrLiteralEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAU3D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,sBAAsB;IAW1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}