@o3co/auth.policy-verifier.builtins 0.15.0 → 0.16.0

package/dist/index.d.mts

@@ -1,9 +1,12 @@
+export { DelegationRangeCollector, type DelegationRangeCollectorConfig, } from "./collectors/DelegationRangeCollector.mjs";
 export { PayloadClaimAttributeCollector, type PayloadClaimAttributeCollectorConfig, type PayloadClaimAttributeMapping, type PayloadClaimAttributeType, } from "./collectors/PayloadClaimAttributeCollector.mjs";
 export { PayloadScopeCollector, type PayloadScopeCollectorConfig, } from "./collectors/PayloadScopeCollector.mjs";
 export { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
 export { RequestContextAttributeCollector, type RequestContextAttributeCollectorConfig, type RequestContextAttributeMapping, type RequestContextAttributeType, } from "./collectors/RequestContextAttributeCollector.mjs";
 export { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 export { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
+export { parseRangePath, type RangeElement, rangeContains, } from "./delegation/range.mjs";
+export { ATTR_DELEGATION_RANGE, BUILTINS_ATTRIBUTE_KEY_OWNER } from "./keys.mjs";
 export { builtinCollectorsModule } from "./module.mjs";
 export { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
 export { AttrLiteralCompare, type AttrLiteralCompareConfig } from "./rules/AttrLiteralCompare.mjs";
@@ -15,8 +18,10 @@ export { AttrMatchRule, type AttrMatchRuleConfig } from "./rules/AttrMatchRule.m
 export { AttrPairCompare, type AttrPairCompareConfig } from "./rules/AttrPairCompare.mjs";
 export { AttrPairEqual, type AttrPairEqualConfig } from "./rules/AttrPairEqual.mjs";
 export { AttrPairNotEqual, type AttrPairNotEqualConfig } from "./rules/AttrPairNotEqual.mjs";
+export { DelegationRangeRuleCollector, type DelegationRangeRuleCollectorConfig, } from "./rules/collectors/DelegationRangeRuleCollector.mjs";
 export { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
 export { ResourceActionScopeRuleCollector, type ResourceActionScopeRuleCollectorConfig, type ScopelessPolicy, } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope, type HasScopeOptions } from "./rules/HasScope.mjs";
+export { WithinDelegationRange } from "./rules/WithinDelegationRange.mjs";
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAIA,OAAO,EACN,8BAA8B,EAC9B,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,GAC9B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACN,qBAAqB,EACrB,KAAK,2BAA2B,GAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GAChC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,eAAe,GACpB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAIA,OAAO,EACN,wBAAwB,EACxB,KAAK,8BAA8B,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACN,8BAA8B,EAC9B,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,GAC9B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACN,qBAAqB,EACrB,KAAK,2BAA2B,GAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GAChC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EACN,cAAc,EACd,KAAK,YAAY,EACjB,aAAa,GACb,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAEjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EACN,4BAA4B,EAC5B,KAAK,kCAAkC,GACvC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,eAAe,GACpB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/index.mjs

@@ -1,12 +1,17 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
 // Collectors
+export { DelegationRangeCollector, } from "./collectors/DelegationRangeCollector.mjs";
 export { PayloadClaimAttributeCollector, } from "./collectors/PayloadClaimAttributeCollector.mjs";
 export { PayloadScopeCollector, } from "./collectors/PayloadScopeCollector.mjs";
 export { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
 export { RequestContextAttributeCollector, } from "./collectors/RequestContextAttributeCollector.mjs";
 export { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 export { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
+// Delegation range
+export { parseRangePath, rangeContains, } from "./delegation/range.mjs";
+// Attribute keys
+export { ATTR_DELEGATION_RANGE, BUILTINS_ATTRIBUTE_KEY_OWNER } from "./keys.mjs";
 // Module
 export { builtinCollectorsModule } from "./module.mjs";
 // Resource
@@ -21,7 +26,9 @@ export { AttrMatchRule } from "./rules/AttrMatchRule.mjs";
 export { AttrPairCompare } from "./rules/AttrPairCompare.mjs";
 export { AttrPairEqual } from "./rules/AttrPairEqual.mjs";
 export { AttrPairNotEqual } from "./rules/AttrPairNotEqual.mjs";
+export { DelegationRangeRuleCollector, } from "./rules/collectors/DelegationRangeRuleCollector.mjs";
 export { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
 export { ResourceActionScopeRuleCollector, } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";
+export { WithinDelegationRange } from "./rules/WithinDelegationRange.mjs";

package/dist/keys.d.mts

@@ -0,0 +1,9 @@
+/**
+ * The paths of a delegated token's range, as a `string[]`. The delegation
+ * range is not core vocabulary — its grammar and containment rule are this
+ * stack's, not a standard's — so the builtins own the key.
+ */
+export declare const ATTR_DELEGATION_RANGE: "delegationRange";
+/** The npm package name this vocabulary is reserved under. */
+export declare const BUILTINS_ATTRIBUTE_KEY_OWNER: "@o3co/auth.policy-verifier.builtins";
+//# sourceMappingURL=keys.d.mts.map

package/dist/keys.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.mts","sourceRoot":"","sources":["../src/keys.mts"],"names":[],"mappings":"AAaA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,EAAG,qCAA8C,CAAC"}

package/dist/keys.mjs

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+/*
+ * This package's own attribute keys and their reservation in core's key
+ * registry, made when this module is imported. The builtins write core's keys
+ * (`scopes`, `userId`, …) and the operator's; the keys here are the ones whose
+ * meaning is this package's — not core vocabulary (AGENTS.md "Core Vocabulary
+ * Scope"), and not the operator's to write with a mapping.
+ */
+import { reserveAttributeKeys } from "@o3co/auth.policy-verifier.core";
+/**
+ * The paths of a delegated token's range, as a `string[]`. The delegation
+ * range is not core vocabulary — its grammar and containment rule are this
+ * stack's, not a standard's — so the builtins own the key.
+ */
+export const ATTR_DELEGATION_RANGE = "delegationRange";
+/** The npm package name this vocabulary is reserved under. */
+export const BUILTINS_ATTRIBUTE_KEY_OWNER = "@o3co/auth.policy-verifier.builtins";
+/*
+ * Reserved at module scope, beside the constant, so that the reservation is
+ * in place before any collector can be constructed. With it,
+ * `RequestContextAttributeCollector` and `PayloadClaimAttributeCollector`
+ * refuse a mapping onto the key: `AttributePipeline` unions list keys, so a
+ * mapping would add paths of its own to the range `DelegationRangeCollector`
+ * read, and a narrowing would become a widening.
+ */
+reserveAttributeKeys({
+    owner: BUILTINS_ATTRIBUTE_KEY_OWNER,
+    keys: [ATTR_DELEGATION_RANGE],
+    reason: "a delegated token's range, written by DelegationRangeCollector from the authenticated subject and read by WithinDelegationRange",
+});

package/dist/module.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAW9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MA6CrC,CAAC"}
+{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAa9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAqDrC,CAAC"}

package/dist/module.mjs

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
+import { DelegationRangeCollector } from "./collectors/DelegationRangeCollector.mjs";
 import { PayloadClaimAttributeCollector } from "./collectors/PayloadClaimAttributeCollector.mjs";
 import { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
 import { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
@@ -7,6 +8,7 @@ import { RequestContextAttributeCollector } from "./collectors/RequestContextAtt
 import { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 import { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 import { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
+import { DelegationRangeRuleCollector } from "./rules/collectors/DelegationRangeRuleCollector.mjs";
 import { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
 import { ResourceActionScopeRuleCollector } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
 /**
@@ -24,9 +26,11 @@ export const builtinCollectorsModule = {
         context.attributeCollectorRegistry.register("StaticRoleCollector", (config) => new StaticRoleCollector(config));
         context.attributeCollectorRegistry.register("RequestContextAttributeCollector", (config) => new RequestContextAttributeCollector(config));
         context.attributeCollectorRegistry.register("PayloadClaimAttributeCollector", (config) => new PayloadClaimAttributeCollector(config));
+        context.attributeCollectorRegistry.register("DelegationRangeCollector", (config) => new DelegationRangeCollector(config));
         // Rule collector factories
         context.ruleCollectorRegistry.register("ResourceActionScopeRuleCollector", (config) => new ResourceActionScopeRuleCollector(config));
         context.ruleCollectorRegistry.register("ResourceActionPermissionRuleCollector", () => new ResourceActionPermissionRuleCollector());
+        context.ruleCollectorRegistry.register("DelegationRangeRuleCollector", (config) => new DelegationRangeRuleCollector(config));
         // Resource parser factories
         context.resourceParserRegistry.register("DotNotationResourceParser", () => new DotNotationResourceParser());
     },

package/dist/resource/DotNotationResourceParser.d.mts

@@ -23,25 +23,22 @@ import type { Resource, ResourceParser } from "@o3co/auth.policy-verifier.core";
  * `resourceType` is the authorization namespace: scope rules authorize it, so
  * two distinct resources that parse to the same type are authorized
  * identically, and a caller can reach resource A through a grant written for
- * resource B. Every rewrite the parser could perform is a way for that to
- * happen, so it performs none:
- *
- * - **The `.` separator is preserved.** Joining types with `_` collapsed the
- *   nested type `a.b` and the flat type literally named `a_b` onto one string.
- *   `.` is reserved as the separator and cannot occur inside a type, so the
- *   sequence of types round-trips: distinct type sequences are distinct
- *   `resourceType`s. `_` is now an ordinary type character.
- * - **Empty segments are refused.** `a..b` used to parse, and every input with
- *   a repeated `.` landed in whatever namespace the empty types produced.
- * - **Extra `:` components are refused, not truncated.** `a:1:2` used to be
- *   read as `a:1` with the tail silently dropped, so a deliberately narrowed
- *   identifier widened into the broader one.
- * - **Whitespace is refused, not trimmed.** Trimming made `project : 1` and
- *   `project:1` one resource for scope rules while
- *   `ResourceActionPermissionRuleCollector`, which reads `raw`, still saw two.
- *
- * This is the same principle `HasScope` applies to scope values: compare what
- * was written, never a normalized guess at what was meant.
+ * resource B. Every rewrite is a way for that to happen, so the parser
+ * performs none:
+ *
+ * - **The `.` separator is preserved.** `.` cannot occur inside a type, so
+ *   distinct type sequences are distinct `resourceType`s; `_` is an ordinary
+ *   type character, and the nested type `a.b` stays apart from `a_b`.
+ * - **Empty segments are refused** (`a..b`): no input lands in a namespace
+ *   produced by empty types.
+ * - **Extra `:` components are refused, not truncated:** `a:1:2` read as
+ *   `a:1` would widen a deliberately narrowed identifier.
+ * - **Whitespace is refused, not trimmed:** trimmed, `project : 1` and
+ *   `project:1` would be one resource for scope rules while
+ *   `ResourceActionPermissionRuleCollector`, which reads `raw`, sees two.
+ *
+ * This is the principle `HasScope` applies to scope values: compare what was
+ * written, never a normalized guess at what was meant.
  *
  * An id that needs `.`, `:` or a character outside the set must be encoded by
  * the caller (percent-encoding round-trips through this grammar) or handled by

package/dist/resource/DotNotationResourceParser.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"DotNotationResourceParser.d.mts","sourceRoot":"","sources":["../../src/resource/DotNotationResourceParser.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqBhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,qBAAa,yBAA0B,YAAW,cAAc;IAC/D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;CAY5B"}
+{"version":3,"file":"DotNotationResourceParser.d.mts","sourceRoot":"","sources":["../../src/resource/DotNotationResourceParser.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAmBhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,qBAAa,yBAA0B,YAAW,cAAc;IAC/D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;CAY5B"}

package/dist/resource/DotNotationResourceParser.mjs

@@ -2,14 +2,12 @@
 // SPDX-License-Identifier: Apache-2.0
 import { ResourceParseError } from "@o3co/auth.policy-verifier.core";
 /**
- * Characters a segment type or id may carry.
- *
- * The set is RFC 6749 §3.3 `NQCHAR` (`%x21 / %x23-5B / %x5D-7E` — printable
- * ASCII minus space, `"` and `\`) less the two structural characters `.` and
- * `:`. Anchoring it there is not arbitrary: `resourceType` is concatenated into
- * the `{action}:{resourceType}` scope that `ResourceActionScopeRuleCollector`
- * requires, so a type that cannot appear in a scope value is a type no issuer
- * could ever grant.
+ * Characters a segment type or id may carry: those of an RFC 6749 §3.3
+ * `scope-token` (`%x21 / %x23-5B / %x5D-7E`, which its Appendix A names
+ * `NQCHAR` — printable ASCII minus space, `"` and `\`) less the structural `.`
+ * and `:`. `resourceType` is concatenated into the `{action}:{resourceType}`
+ * scope `ResourceActionScopeRuleCollector` requires, so a type that cannot
+ * appear in a scope value is one no issuer could grant.
  */
 const SEGMENT_TOKEN = /^[\x21\x23-\x2D\x2F-\x39\x3B-\x5B\x5D-\x7E]+$/;
 /**
@@ -36,25 +34,22 @@ const SEGMENT_TOKEN = /^[\x21\x23-\x2D\x2F-\x39\x3B-\x5B\x5D-\x7E]+$/;
  * `resourceType` is the authorization namespace: scope rules authorize it, so
  * two distinct resources that parse to the same type are authorized
  * identically, and a caller can reach resource A through a grant written for
- * resource B. Every rewrite the parser could perform is a way for that to
- * happen, so it performs none:
+ * resource B. Every rewrite is a way for that to happen, so the parser
+ * performs none:
  *
- * - **The `.` separator is preserved.** Joining types with `_` collapsed the
- *   nested type `a.b` and the flat type literally named `a_b` onto one string.
- *   `.` is reserved as the separator and cannot occur inside a type, so the
- *   sequence of types round-trips: distinct type sequences are distinct
- *   `resourceType`s. `_` is now an ordinary type character.
- * - **Empty segments are refused.** `a..b` used to parse, and every input with
- *   a repeated `.` landed in whatever namespace the empty types produced.
- * - **Extra `:` components are refused, not truncated.** `a:1:2` used to be
- *   read as `a:1` with the tail silently dropped, so a deliberately narrowed
- *   identifier widened into the broader one.
- * - **Whitespace is refused, not trimmed.** Trimming made `project : 1` and
- *   `project:1` one resource for scope rules while
- *   `ResourceActionPermissionRuleCollector`, which reads `raw`, still saw two.
+ * - **The `.` separator is preserved.** `.` cannot occur inside a type, so
+ *   distinct type sequences are distinct `resourceType`s; `_` is an ordinary
+ *   type character, and the nested type `a.b` stays apart from `a_b`.
+ * - **Empty segments are refused** (`a..b`): no input lands in a namespace
+ *   produced by empty types.
+ * - **Extra `:` components are refused, not truncated:** `a:1:2` read as
+ *   `a:1` would widen a deliberately narrowed identifier.
+ * - **Whitespace is refused, not trimmed:** trimmed, `project : 1` and
+ *   `project:1` would be one resource for scope rules while
+ *   `ResourceActionPermissionRuleCollector`, which reads `raw`, sees two.
  *
- * This is the same principle `HasScope` applies to scope values: compare what
- * was written, never a normalized guess at what was meant.
+ * This is the principle `HasScope` applies to scope values: compare what was
+ * written, never a normalized guess at what was meant.
  *
  * An id that needs `.`, `:` or a character outside the set must be encoded by
  * the caller (percent-encoding round-trips through this grammar) or handled by

package/dist/rules/AttrLiteralCompare.d.mts

@@ -22,11 +22,9 @@ export interface AttrLiteralCompareConfig {
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrLiteralCompare implements Rule {
     readonly ruleType: string;

package/dist/rules/AttrLiteralCompare.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,wBAAwB;IAa5C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,wBAAwB;IAa5C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralCompare.mjs

@@ -17,11 +17,9 @@ import { applyCompare, requireAttrName, requireCompareOp, requireNumber, require
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrLiteralCompare {
     ruleType;

package/dist/rules/AttrLiteralEqual.d.mts

@@ -28,11 +28,9 @@ export interface AttrLiteralEqualConfig {
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrLiteralEqual implements Rule {
     readonly ruleType: string;

package/dist/rules/AttrLiteralEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,sBAAsB;IAW1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,sBAAsB;IAW1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralEqual.mjs

@@ -24,11 +24,9 @@ import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrLiteralEqual {
     ruleType;

package/dist/rules/AttrLiteralIn.d.mts

@@ -27,11 +27,9 @@ export interface AttrLiteralInConfig {
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrLiteralIn implements Rule {
     readonly ruleType: string;

package/dist/rules/AttrLiteralIn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,aAAc,YAAW,IAAI;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,mBAAmB;IAcvC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,aAAc,YAAW,IAAI;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,mBAAmB;IAcvC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralIn.mjs

@@ -23,11 +23,9 @@ import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requ
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrLiteralIn {
     ruleType;

package/dist/rules/AttrLiteralNotEqual.d.mts

@@ -11,8 +11,8 @@ export interface AttrLiteralNotEqualConfig {
  * is performed. If the attribute is missing, null, of the wrong type, or
  * `NaN` the rule returns false (safe-deny). `NaN` is unequal to every number,
  * so `!==` alone would pass it: a restriction that allows on an attribute
- * that is not a number at all (#254). Construction refuses a `NaN` literal
- * for the mirror reason.
+ * that is not a number at all. Construction refuses a `NaN` literal for the
+ * mirror reason.
  *
  * ## Grouping and the default ruleType
  *
@@ -24,17 +24,15 @@ export interface AttrLiteralNotEqualConfig {
  * The `typeof v` segment prevents silent `ruleType` collisions between
  * different-type literals that stringify the same way (e.g. `1` vs `"1"`),
  * which would otherwise be OR-combined by the evaluator against the intent
- * of two independent constraints. See AttrLiteralEqual for the same rationale.
+ * of two independent constraints.
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrLiteralNotEqual implements Rule {
     readonly ruleType: string;

package/dist/rules/AttrLiteralNotEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,yBAAyB;IAW7C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAM1C"}
+{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,yBAAyB;IAW7C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAM1C"}

package/dist/rules/AttrLiteralNotEqual.mjs

@@ -7,8 +7,8 @@ import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_
  * is performed. If the attribute is missing, null, of the wrong type, or
  * `NaN` the rule returns false (safe-deny). `NaN` is unequal to every number,
  * so `!==` alone would pass it: a restriction that allows on an attribute
- * that is not a number at all (#254). Construction refuses a `NaN` literal
- * for the mirror reason.
+ * that is not a number at all. Construction refuses a `NaN` literal for the
+ * mirror reason.
  *
  * ## Grouping and the default ruleType
  *
@@ -20,17 +20,15 @@ import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_
  * The `typeof v` segment prevents silent `ruleType` collisions between
  * different-type literals that stringify the same way (e.g. `1` vs `"1"`),
  * which would otherwise be OR-combined by the evaluator against the intent
- * of two independent constraints. See AttrLiteralEqual for the same rationale.
+ * of two independent constraints.
  *
  * Pass a shared `group` string to two instances to opt into OR semantics.
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrLiteralNotEqual {
     ruleType;

package/dist/rules/AttrLiteralNotIn.d.mts

@@ -12,7 +12,7 @@ export interface AttrLiteralNotInConfig {
  * type, or `NaN` the rule returns false (safe-deny). `NaN` is in no set of
  * numbers — construction refuses one that holds it — so the membership test
  * alone would pass it: a restriction that allows on an attribute that is not
- * a number at all (#254).
+ * a number at all.
  *
  * ## Grouping and the default ruleType
  *
@@ -25,11 +25,9 @@ export interface AttrLiteralNotInConfig {
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrLiteralNotIn implements Rule {
     readonly ruleType: string;

package/dist/rules/AttrLiteralNotIn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,sBAAsB;IAc1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAM1C"}
+{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,sBAAsB;IAc1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAM1C"}

package/dist/rules/AttrLiteralNotIn.mjs

@@ -8,7 +8,7 @@ import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requ
  * type, or `NaN` the rule returns false (safe-deny). `NaN` is in no set of
  * numbers — construction refuses one that holds it — so the membership test
  * alone would pass it: a restriction that allows on an attribute that is not
- * a number at all (#254).
+ * a number at all.
  *
  * ## Grouping and the default ruleType
  *
@@ -21,11 +21,9 @@ import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requ
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrLiteralNotIn {
     ruleType;

package/dist/rules/AttrMatchRule.d.mts

@@ -1,7 +1,7 @@
 import { AttrPairEqual, type AttrPairEqualConfig } from "./AttrPairEqual.mjs";
 export type AttrMatchRuleConfig = AttrPairEqualConfig;
 /**
- * @deprecated since v0.3 — use {@link AttrPairEqual}.
+ * @deprecated Use {@link AttrPairEqual}.
  *
  * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
  * and legacy `message` wording. `verify()` semantics are inherited unchanged from

package/dist/rules/AttrMatchRule.mjs

@@ -6,7 +6,7 @@
  */
 import { AttrPairEqual } from "./AttrPairEqual.mjs";
 /**
- * @deprecated since v0.3 — use {@link AttrPairEqual}.
+ * @deprecated Use {@link AttrPairEqual}.
  *
  * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
  * and legacy `message` wording. `verify()` semantics are inherited unchanged from

package/dist/rules/AttrPairCompare.d.mts

@@ -26,11 +26,9 @@ export interface AttrPairCompareConfig {
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrPairCompare implements Rule {
     readonly ruleType: string;

package/dist/rules/AttrPairCompare.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,qBAAqB;IAazC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}
+{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;gBAEf,MAAM,EAAE,qBAAqB;IAazC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairCompare.mjs

@@ -21,11 +21,9 @@ import { applyCompare, requireAttrName, requireCompareOp, requireOptionalGroup,
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export class AttrPairCompare {
     ruleType;

package/dist/rules/AttrPairEqual.d.mts

@@ -9,11 +9,10 @@ export interface AttrPairEqualConfig {
  * strings, and are strictly equal. No type coercion is performed: both
  * attribute values must be non-empty strings.
  *
- * ## Backward compatibility
+ * ## String-only
  *
- * AttrPairEqual deliberately retains the string-only semantic of the legacy
- * AttrMatchRule. Do not widen verify() to accept numbers or booleans — the
- * Phase 4 AttrMatchRule alias depends on this invariant.
+ * The deprecated `AttrMatchRule` inherits verify() from this rule and must stay
+ * string-only: do not widen verify() to accept numbers or booleans.
  *
  * ## Grouping and the default ruleType
  *
@@ -26,11 +25,9 @@ export interface AttrPairEqualConfig {
  *
  * ## Configuration is copied at construction
  *
- * The constructor reads each field of `config` once, validates it, and keeps
- * the validated value in a field of its own; the object is not retained (#255).
- * A caller that mutates the config afterwards changes nothing: the rule answers
- * from the values it validated, and `ruleType` and `message` keep describing
- * them.
+ * The constructor validates each field of `config` once and keeps the
+ * validated value; the object is not retained, so mutating it afterwards
+ * changes neither the rule's answers nor its `ruleType` and `message`.
  */
 export declare class AttrPairEqual implements Rule {
     readonly ruleType: string;