@o3co/auth.policy-verifier.builtins 0.3.1 → 0.4.0

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GAChC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,eAAe,GACpB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.mjs

@@ -1,6 +1,9 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 // Collectors
 export { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
 export { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
+export { RequestContextAttributeCollector, } from "./collectors/RequestContextAttributeCollector.mjs";
 export { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 export { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 // Module
@@ -18,6 +21,6 @@ export { AttrPairCompare } from "./rules/AttrPairCompare.mjs";
 export { AttrPairEqual } from "./rules/AttrPairEqual.mjs";
 export { AttrPairNotEqual } from "./rules/AttrPairNotEqual.mjs";
 export { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
-export { ResourceActionScopeRuleCollector } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
+export { ResourceActionScopeRuleCollector, } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
 export { HasPermission } from "./rules/HasPermission.mjs";
 export { HasScope } from "./rules/HasScope.mjs";

package/dist/module.d.mts

@@ -1,3 +1,8 @@
 import type { Module } from "@o3co/auth.policy-verifier.core";
+/**
+ * `Module` that registers the built-in attribute collectors, rule collectors,
+ * and resource parser with a policy-verifier server. Import and pass to
+ * `createApp({ modules: [builtinCollectorsModule, ...] })`.
+ */
 export declare const builtinCollectorsModule: Module;
 //# sourceMappingURL=module.d.mts.map

package/dist/module.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAS9D,eAAO,MAAM,uBAAuB,EAAE,MAqCrC,CAAC"}
+{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAU9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAyCrC,CAAC"}

package/dist/module.mjs

@@ -1,10 +1,18 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
 import { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
+import { RequestContextAttributeCollector } from "./collectors/RequestContextAttributeCollector.mjs";
 import { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";
 import { StaticRoleCollector } from "./collectors/StaticRoleCollector.mjs";
 import { DotNotationResourceParser } from "./resource/DotNotationResourceParser.mjs";
 import { ResourceActionPermissionRuleCollector } from "./rules/collectors/ResourceActionPermissionRuleCollector.mjs";
 import { ResourceActionScopeRuleCollector } from "./rules/collectors/ResourceActionScopeRuleCollector.mjs";
+/**
+ * `Module` that registers the built-in attribute collectors, rule collectors,
+ * and resource parser with a policy-verifier server. Import and pass to
+ * `createApp({ modules: [builtinCollectorsModule, ...] })`.
+ */
 export const builtinCollectorsModule = {
     name: "builtin-collectors",
     async init(context) {
@@ -13,8 +21,9 @@ export const builtinCollectorsModule = {
         context.attributeCollectorRegistry.register("PayloadSubjectIdCollector", () => new PayloadSubjectIdCollector());
         context.attributeCollectorRegistry.register("StaticPermissionCollector", (config) => new StaticPermissionCollector(config));
         context.attributeCollectorRegistry.register("StaticRoleCollector", (config) => new StaticRoleCollector(config));
+        context.attributeCollectorRegistry.register("RequestContextAttributeCollector", (config) => new RequestContextAttributeCollector(config));
         // Rule collector factories
-        context.ruleCollectorRegistry.register("ResourceActionScopeRuleCollector", () => new ResourceActionScopeRuleCollector());
+        context.ruleCollectorRegistry.register("ResourceActionScopeRuleCollector", (config) => new ResourceActionScopeRuleCollector(config));
         context.ruleCollectorRegistry.register("ResourceActionPermissionRuleCollector", () => new ResourceActionPermissionRuleCollector());
         // Resource parser factories
         context.resourceParserRegistry.register("DotNotationResourceParser", () => new DotNotationResourceParser());

package/dist/resource/DotNotationResourceParser.d.mts

@@ -1,4 +1,52 @@
 import type { Resource, ResourceParser } from "@o3co/auth.policy-verifier.core";
+/**
+ * Resource parser for dot-separated, colon-qualified identifiers such as
+ * `"org:123.project:abc.document:42"`.
+ *
+ * ## Grammar
+ *
+ * ```text
+ * resource = segment *( "." segment )
+ * segment  = type [ ":" id ]
+ * type     = 1*tchar
+ * id       = 1*tchar
+ * tchar    = %x21 / %x23-2D / %x2F-39 / %x3B-5B / %x5D-7E
+ *            ; RFC 6749 NQCHAR less "." and ":"
+ * ```
+ *
+ * `resourceType` is the segment types joined with `.`; `resourceId` is the id
+ * of the last segment, if it has one. Anything the grammar does not accept
+ * raises a {@link ResourceParseError} — the parser never repairs its input.
+ *
+ * ## Why nothing is rewritten
+ *
+ * `resourceType` is the authorization namespace: scope rules authorize it, so
+ * two distinct resources that parse to the same type are authorized
+ * identically, and a caller can reach resource A through a grant written for
+ * resource B. Every rewrite the parser could perform is a way for that to
+ * happen, so it performs none:
+ *
+ * - **The `.` separator is preserved.** Joining types with `_` collapsed the
+ *   nested type `a.b` and the flat type literally named `a_b` onto one string.
+ *   `.` is reserved as the separator and cannot occur inside a type, so the
+ *   sequence of types round-trips: distinct type sequences are distinct
+ *   `resourceType`s. `_` is now an ordinary type character.
+ * - **Empty segments are refused.** `a..b` used to parse, and every input with
+ *   a repeated `.` landed in whatever namespace the empty types produced.
+ * - **Extra `:` components are refused, not truncated.** `a:1:2` used to be
+ *   read as `a:1` with the tail silently dropped, so a deliberately narrowed
+ *   identifier widened into the broader one.
+ * - **Whitespace is refused, not trimmed.** Trimming made `project : 1` and
+ *   `project:1` one resource for scope rules while
+ *   `ResourceActionPermissionRuleCollector`, which reads `raw`, still saw two.
+ *
+ * This is the same principle `HasScope` applies to scope values: compare what
+ * was written, never a normalized guess at what was meant.
+ *
+ * An id that needs `.`, `:` or a character outside the set must be encoded by
+ * the caller (percent-encoding round-trips through this grammar) or handled by
+ * a `ResourceParser` written for that syntax.
+ */
 export declare class DotNotationResourceParser implements ResourceParser {
     parse(raw: string): Resource;
 }

package/dist/resource/DotNotationResourceParser.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"DotNotationResourceParser.d.mts","sourceRoot":"","sources":["../../src/resource/DotNotationResourceParser.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEhF,qBAAa,yBAA0B,YAAW,cAAc;IAC/D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;CAc5B"}
+{"version":3,"file":"DotNotationResourceParser.d.mts","sourceRoot":"","sources":["../../src/resource/DotNotationResourceParser.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqBhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,qBAAa,yBAA0B,YAAW,cAAc;IAC/D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;CAY5B"}

package/dist/resource/DotNotationResourceParser.mjs

@@ -1,14 +1,98 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { ResourceParseError } from "@o3co/auth.policy-verifier.core";
+/**
+ * Characters a segment type or id may carry.
+ *
+ * The set is RFC 6749 §3.3 `NQCHAR` (`%x21 / %x23-5B / %x5D-7E` — printable
+ * ASCII minus space, `"` and `\`) less the two structural characters `.` and
+ * `:`. Anchoring it there is not arbitrary: `resourceType` is concatenated into
+ * the `{action}:{resourceType}` scope that `ResourceActionScopeRuleCollector`
+ * requires, so a type that cannot appear in a scope value is a type no issuer
+ * could ever grant.
+ */
+const SEGMENT_TOKEN = /^[\x21\x23-\x2D\x2F-\x39\x3B-\x5B\x5D-\x7E]+$/;
+/**
+ * Resource parser for dot-separated, colon-qualified identifiers such as
+ * `"org:123.project:abc.document:42"`.
+ *
+ * ## Grammar
+ *
+ * ```text
+ * resource = segment *( "." segment )
+ * segment  = type [ ":" id ]
+ * type     = 1*tchar
+ * id       = 1*tchar
+ * tchar    = %x21 / %x23-2D / %x2F-39 / %x3B-5B / %x5D-7E
+ *            ; RFC 6749 NQCHAR less "." and ":"
+ * ```
+ *
+ * `resourceType` is the segment types joined with `.`; `resourceId` is the id
+ * of the last segment, if it has one. Anything the grammar does not accept
+ * raises a {@link ResourceParseError} — the parser never repairs its input.
+ *
+ * ## Why nothing is rewritten
+ *
+ * `resourceType` is the authorization namespace: scope rules authorize it, so
+ * two distinct resources that parse to the same type are authorized
+ * identically, and a caller can reach resource A through a grant written for
+ * resource B. Every rewrite the parser could perform is a way for that to
+ * happen, so it performs none:
+ *
+ * - **The `.` separator is preserved.** Joining types with `_` collapsed the
+ *   nested type `a.b` and the flat type literally named `a_b` onto one string.
+ *   `.` is reserved as the separator and cannot occur inside a type, so the
+ *   sequence of types round-trips: distinct type sequences are distinct
+ *   `resourceType`s. `_` is now an ordinary type character.
+ * - **Empty segments are refused.** `a..b` used to parse, and every input with
+ *   a repeated `.` landed in whatever namespace the empty types produced.
+ * - **Extra `:` components are refused, not truncated.** `a:1:2` used to be
+ *   read as `a:1` with the tail silently dropped, so a deliberately narrowed
+ *   identifier widened into the broader one.
+ * - **Whitespace is refused, not trimmed.** Trimming made `project : 1` and
+ *   `project:1` one resource for scope rules while
+ *   `ResourceActionPermissionRuleCollector`, which reads `raw`, still saw two.
+ *
+ * This is the same principle `HasScope` applies to scope values: compare what
+ * was written, never a normalized guess at what was meant.
+ *
+ * An id that needs `.`, `:` or a character outside the set must be encoded by
+ * the caller (percent-encoding round-trips through this grammar) or handled by
+ * a `ResourceParser` written for that syntax.
+ */
 export class DotNotationResourceParser {
     parse(raw) {
-        const segments = raw
-            .trim()
-            .split(".")
-            .map((part) => {
-            const [type, id] = part.split(":").map((s) => s.trim());
-            return { type, id: id || undefined };
-        });
-        const resourceType = segments.map((s) => s.type).join("_");
-        const resourceId = segments[segments.length - 1].id;
-        return { raw, resourceType, resourceId };
+        const segments = raw.split(".").map((segment, index) => parseSegment(raw, segment, index + 1));
+        return {
+            raw,
+            // Safe because `.` cannot occur inside a type: the join is injective
+            // over the sequence of types.
+            resourceType: segments.map((segment) => segment.type).join("."),
+            // `split` always yields at least one element, so there is a last segment.
+            resourceId: segments[segments.length - 1].id,
+        };
+    }
+}
+/** Validates one `type[:id]` segment, or explains why it is not one. */
+function parseSegment(raw, segment, position) {
+    const parts = segment.split(":");
+    if (parts.length > 2) {
+        throw new ResourceParseError(raw, `segment ${position} has more than one ":"; a segment is "type" or "type:id"`);
+    }
+    const [type, id] = parts;
+    assertToken(raw, type, position, "type");
+    if (id !== undefined) {
+        assertToken(raw, id, position, "id");
+    }
+    return id === undefined ? { type } : { type, id };
+}
+/** Rejects an empty or out-of-grammar type/id, naming which part of which segment. */
+function assertToken(raw, value, position, part) {
+    if (value === "") {
+        throw new ResourceParseError(raw, `segment ${position} has an empty ${part}`);
+    }
+    if (!SEGMENT_TOKEN.test(value)) {
+        throw new ResourceParseError(raw, `segment ${position} ${part} carries a character outside the allowed set ` +
+            `(printable ASCII except space, '"', "\\", "." and ":")`);
     }
 }

package/dist/rules/AttrLiteralCompare.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 import { type CompareOp } from "./_sharedValidation.mjs";
 export interface AttrLiteralCompareConfig {
     a: string;
@@ -26,6 +26,6 @@ export declare class AttrLiteralCompare implements Rule {
     readonly code = "attr_compare_violated";
     readonly message: string;
     constructor(config: AttrLiteralCompareConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrLiteralCompare.d.mts.map

package/dist/rules/AttrLiteralCompare.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAKlC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,wBAAwB;IAU7D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}
+{"version":3,"file":"AttrLiteralCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralCompare.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAKd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,wBAAwB;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,IAAI;IAKlC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,wBAAwB;IAU7D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralCompare.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { applyCompare, requireAttrName, requireCompareOp, requireNumber, requireOptionalGroup, } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when a named attribute is present, is a number, and

package/dist/rules/AttrLiteralEqual.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 import { type LiteralValue } from "./_sharedValidation.mjs";
 export interface AttrLiteralEqualConfig {
     a: string;
@@ -32,6 +32,6 @@ export declare class AttrLiteralEqual implements Rule {
     readonly code = "attr_not_equal";
     readonly message: string;
     constructor(config: AttrLiteralEqualConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrLiteralEqual.d.mts.map

package/dist/rules/AttrLiteralEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAU3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}
+{"version":3,"file":"AttrLiteralEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAU3D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralEqual.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when a named attribute is present and strictly equal to a

package/dist/rules/AttrLiteralIn.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 import { type LiteralValue } from "./_sharedValidation.mjs";
 export interface AttrLiteralInConfig {
     a: string;
@@ -33,6 +33,6 @@ export declare class AttrLiteralIn implements Rule {
     private readonly elementType;
     private readonly valuesSet;
     constructor(config: AttrLiteralInConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrLiteralIn.d.mts.map

package/dist/rules/AttrLiteralIn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAQ7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,mBAAmB;IAaxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}
+{"version":3,"file":"AttrLiteralIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralIn.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAQ7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,mBAAmB;IAaxD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralIn.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requireOptionalGroup, } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when a named attribute is present, matches the element type

package/dist/rules/AttrLiteralNotEqual.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 import { type LiteralValue } from "./_sharedValidation.mjs";
 export interface AttrLiteralNotEqualConfig {
     a: string;
@@ -31,6 +31,6 @@ export declare class AttrLiteralNotEqual implements Rule {
     readonly code = "attr_equal";
     readonly message: string;
     constructor(config: AttrLiteralNotEqualConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrLiteralNotEqual.d.mts.map

package/dist/rules/AttrLiteralNotEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAKnC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,yBAAyB;IAU9D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}
+{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAKnC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,yBAAyB;IAU9D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralNotEqual.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when a named attribute is present, matches the type of the

package/dist/rules/AttrLiteralNotIn.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 import { type LiteralValue } from "./_sharedValidation.mjs";
 export interface AttrLiteralNotInConfig {
     a: string;
@@ -28,6 +28,6 @@ export declare class AttrLiteralNotIn implements Rule {
     private readonly elementType;
     private readonly valuesSet;
     constructor(config: AttrLiteralNotInConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrLiteralNotIn.d.mts.map

package/dist/rules/AttrLiteralNotIn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAQhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,sBAAsB;IAa3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}
+{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAQhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,sBAAsB;IAa3D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}

package/dist/rules/AttrLiteralNotIn.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requireOptionalGroup, } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when a named attribute is present, matches the element type

package/dist/rules/AttrMatchRule.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,aAAa;IAC/C,SAAkB,QAAQ,EAAE,MAAM,CAAC;IACnC,SAAkB,OAAO,EAAE,MAAM,CAAC;gBAEtB,MAAM,EAAE,mBAAmB;CAKvC"}
+{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,aAAa;IAC/C,SAAkB,QAAQ,EAAE,MAAM,CAAC;IACnC,SAAkB,OAAO,EAAE,MAAM,CAAC;gBAEtB,MAAM,EAAE,mBAAmB;CAKvC"}

package/dist/rules/AttrMatchRule.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { AttrPairEqual } from "./AttrPairEqual.mjs";
 /**
  * @deprecated Use {@link AttrPairEqual}. Scheduled for removal in a future major version.

package/dist/rules/AttrPairCompare.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 import { type CompareOp } from "./_sharedValidation.mjs";
 export interface AttrPairCompareConfig {
     a: string;
@@ -30,6 +30,6 @@ export declare class AttrPairCompare implements Rule {
     readonly code = "attr_compare_violated";
     readonly message: string;
     constructor(config: AttrPairCompareConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrPairCompare.d.mts.map

package/dist/rules/AttrPairCompare.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAK/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,qBAAqB;IAU1D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}
+{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAK/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,qBAAqB;IAU1D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairCompare.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { applyCompare, requireAttrName, requireCompareOp, requireOptionalGroup, } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when two named attributes are present, are both numbers,

package/dist/rules/AttrPairEqual.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 export interface AttrPairEqualConfig {
     a: string;
     b: string;
@@ -30,6 +30,6 @@ export declare class AttrPairEqual implements Rule {
     readonly code = "attr_mismatch";
     readonly message: string;
     constructor(config: AttrPairEqualConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrPairEqual.d.mts.map

package/dist/rules/AttrPairEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGxE,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,mBAAmB;IASxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}
+{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,mBAAmB;IASxD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairEqual.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when two named attributes are present, are non-empty

package/dist/rules/AttrPairNotEqual.d.mts

@@ -1,4 +1,4 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
 export interface AttrPairNotEqualConfig {
     a: string;
     b: string;
@@ -29,6 +29,6 @@ export declare class AttrPairNotEqual implements Rule {
     readonly code = "attr_match";
     readonly message: string;
     constructor(config: AttrPairNotEqualConfig);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
 }
 //# sourceMappingURL=AttrPairNotEqual.d.mts.map

package/dist/rules/AttrPairNotEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGxE,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAS3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}
+{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAS3D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAO1C"}

package/dist/rules/AttrPairNotEqual.mjs

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
 /**
  * Rule that passes when two named attributes are present, are non-empty

package/dist/rules/HasPermission.d.mts

@@ -1,11 +1,39 @@
-import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
+/**
+ * Rule that passes when the subject holds the required permission, either
+ * directly via `ATTR_PERMISSIONS` or transitively through a role in
+ * `ATTR_ROLES`.
+ *
+ * ## Matching
+ *
+ * Comparison is **exact and case-sensitive**, the same philosophy `HasScope`
+ * applies to scope values and `DotNotationResourceParser` applies to resource
+ * identifiers (#116, #117): compare what was written, never a normalized guess
+ * at what was meant. This rule matched case-insensitively until #155, which
+ * put permissions on the wrong side of the line those two argued —
+ * `ResourceActionPermissionRuleCollector` builds `{resource.raw}.perm:{action}`
+ * from the case-preserving parser, so `Project:1` and `project:1` were two
+ * namespaces to a scope rule and one to a permission rule. One vocabulary, one
+ * matching discipline.
+ *
+ * ## Wildcards
+ *
+ * A granted permission of `"*"` matches everything, and a granted permission
+ * may contain a single `*` as prefix, suffix, or middle separator (e.g.
+ * `"posts.*"`, `"*.read"`, `"posts.*.read"`). This is not an exception to the
+ * no-normalization rule: a wildcard is match structure the policy author
+ * **wrote into the grant**, not a rewrite of both sides behind their back. The
+ * literal halves around the `*` still compare exactly and case-sensitively.
+ * Multiple wildcards are rejected outright because the two-part split would
+ * silently drop segments and over-grant.
+ */
 export declare class HasPermission implements Rule {
     private permission;
     readonly ruleType = "permission";
     readonly code = "no_permission";
     readonly message: string;
     constructor(permission: string);
-    verify(attrs: Attributes): boolean;
+    verify(attrs: ReadonlyAttributes): boolean;
     private match;
 }
 //# sourceMappingURL=HasPermission.d.mts.map

package/dist/rules/HasPermission.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAG9E,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;IAUlC,OAAO,CAAC,KAAK;CAuBb"}
+{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAU1C,OAAO,CAAC,KAAK;CAoBb"}

package/dist/rules/HasPermission.mjs

@@ -1,4 +1,34 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
 import { ATTR_PERMISSIONS, ATTR_ROLES } from "@o3co/auth.policy-verifier.core";
+/**
+ * Rule that passes when the subject holds the required permission, either
+ * directly via `ATTR_PERMISSIONS` or transitively through a role in
+ * `ATTR_ROLES`.
+ *
+ * ## Matching
+ *
+ * Comparison is **exact and case-sensitive**, the same philosophy `HasScope`
+ * applies to scope values and `DotNotationResourceParser` applies to resource
+ * identifiers (#116, #117): compare what was written, never a normalized guess
+ * at what was meant. This rule matched case-insensitively until #155, which
+ * put permissions on the wrong side of the line those two argued —
+ * `ResourceActionPermissionRuleCollector` builds `{resource.raw}.perm:{action}`
+ * from the case-preserving parser, so `Project:1` and `project:1` were two
+ * namespaces to a scope rule and one to a permission rule. One vocabulary, one
+ * matching discipline.
+ *
+ * ## Wildcards
+ *
+ * A granted permission of `"*"` matches everything, and a granted permission
+ * may contain a single `*` as prefix, suffix, or middle separator (e.g.
+ * `"posts.*"`, `"*.read"`, `"posts.*.read"`). This is not an exception to the
+ * no-normalization rule: a wildcard is match structure the policy author
+ * **wrote into the grant**, not a rewrite of both sides behind their back. The
+ * literal halves around the `*` still compare exactly and case-sensitively.
+ * Multiple wildcards are rejected outright because the two-part split would
+ * silently drop segments and over-grant.
+ */
 export class HasPermission {
     permission;
     ruleType = "permission";
@@ -15,8 +45,6 @@ export class HasPermission {
         return all.some((p) => this.match(p, this.permission));
     }
     match(permission, required) {
-        permission = permission.toLowerCase();
-        required = required.toLowerCase();
         if (permission === "*")
             return true;
         if (permission === required)