@o3co/auth.policy-verifier.builtins 0.8.0 → 0.9.0

package/README.md

@@ -16,14 +16,32 @@ All collectors implement `AttributeCollector`.
 
 | Name | Reads from | Emits | Constructor args |
 | --- | --- | --- | --- |
-| `PayloadScopeCollector` | `subject.scope` (space-separated string) | `ATTR_SCOPES: string[]` | none |
+| `PayloadScopeCollector` | the scope claim — `subject.scope` by default, a space-separated string or an array of strings | `ATTR_SCOPES: string[]` | `{ claim?: string }` (#219: `"scp"` for Okta, `"permissions"` for Auth0) |
 | `PayloadSubjectIdCollector` | `subject.sub`, `subject.azp` | `ATTR_USER_ID`, `ATTR_CLIENT_ID` | none |
 | `StaticPermissionCollector` | — | `ATTR_PERMISSIONS: string[]` | `{ permissions: string[] }` |
 | `StaticRoleCollector` | — | `ATTR_ROLES: Role[]` | `{ roles: Role[] }` |
 | `RequestContextAttributeCollector` | declared fields of `requestContext` | the operator's own keys | `{ attributes: Mapping[] }` |
+| `PayloadClaimAttributeCollector` | declared claims of the verified `subject` | the operator's own keys, or core's five | `{ attributes: Mapping[] }` (#219) |
 
 `StaticPermissionCollector` and `StaticRoleCollector` always emit the values supplied at construction time, regardless of request context.
 
+### PayloadClaimAttributeCollector
+
+Promotes declared claims of the **verified subject** into attributes (#219) — the operator-declared way to turn an external IdP's claims into what the rules read, without a bespoke collector:
+
+```hocon
+{ collector = "PayloadClaimAttributeCollector"
+  attributes = [
+    { from = "o.rol", to = "roles", type = "string[]" }                      # Clerk: org role, by dot path
+    { from = "https://example.com/roles", to = "roles", type = "string[]" }  # Auth0: a namespaced claim is one key, not a path
+    { from = "tid", to = "tenantId" }
+  ] }
+```
+
+Same mapping shape as `RequestContextAttributeCollector` (`{ from, to?, type? }`, an exact key winning over a dot path, own properties only). What differs is the source, and therefore the trust: the subject bag is what the authenticator verified, so a mapping **may** land on core's five keys — `scopes`, `permissions`, `roles`, `userId`, `clientId` — where the request-context collector refuses them. Two collectors writing one list key union it; that is the deployment composing two issuer-derived sources, and it says so in config. A *scalar* key written by two collectors with different values throws `AttributeConflictError` and denies every request — do not map onto `userId` / `clientId` while `PayloadSubjectIdCollector` also writes them. Keys another package reserved (cedar's `request*`) stay refused, because they are derived from the request, not from the subject. And map only claims the IdP populates from its own registration or admin data: a claim minted from user-editable metadata (Clerk's `unsafe_metadata`, Auth0's `user_metadata`) is signed, not trusted.
+
+For the scope claim specifically, prefer `PayloadScopeCollector { claim = "scp" }`, which also reads the space-delimited string form and pairs with `ResourceActionScopeRuleCollector { claim = "scp" }` so both agree about which tokens are scopeless.
+
 ### RequestContextAttributeCollector
 
 Promotes declared fields of `CollectorContext.requestContext` into attributes:
@@ -36,7 +54,7 @@ Promotes declared fields of `CollectorContext.requestContext` into attributes:
   ] }
 ```
 
-Each mapping is `{ from: string; to?: string; type?: "string" | "number" | "boolean" | "string[]" }`, `type` defaulting to `"string"`. A malformed mapping throws at construction; an unusable *value* does not — `requestContext` is caller-supplied request data, so a field that is missing, empty, or not of its declared type is simply not promoted.
+Each mapping is `{ from: string; to?: string; type?: "string" | "number" | "boolean" | "string[]" }`, `type` defaulting to `"string"`. An exact key on `context` wins over walking a dot path: a literal `"tenant.id"` field is read before `tenant` → `id`. A malformed mapping throws at construction; an unusable *value* does not — `requestContext` is caller-supplied request data, so a field that is missing, empty, or not of its declared type is simply not promoted.
 
 The declaration is the trust boundary — this collector is the ready-made way to stay on the right side of the one described in [docs/extending.md](../../docs/extending.md#the-trust-boundary-requestcontext-is-the-callers). `requestContext` is free-form and unvalidated, so **nothing undeclared becomes an attribute** and a configured dot path traverses own properties only (`constructor.name` reads nothing). This collector invents no vocabulary of its own: the operator names both the fields and the keys, which is what keeps [AGENTS.md — Core Vocabulary Scope](../../AGENTS.md#core-vocabulary-scope) intact while still shipping something usable. For anything beyond read-check-write — deriving a value, calling out to a store — write a focused project-side `AttributeCollector` as that section describes.
 
@@ -285,11 +303,12 @@ import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
 
 | Registry | Name | Factory |
 | --- | --- | --- |
-| `attributeCollector` | `"PayloadScopeCollector"` | `() => new PayloadScopeCollector()` |
+| `attributeCollector` | `"PayloadScopeCollector"` | `(config) => new PayloadScopeCollector(config)` |
 | `attributeCollector` | `"PayloadSubjectIdCollector"` | `() => new PayloadSubjectIdCollector()` |
 | `attributeCollector` | `"StaticPermissionCollector"` | `(config) => new StaticPermissionCollector(config)` |
 | `attributeCollector` | `"StaticRoleCollector"` | `(config) => new StaticRoleCollector(config)` |
 | `attributeCollector` | `"RequestContextAttributeCollector"` | `(config) => new RequestContextAttributeCollector(config)` |
+| `attributeCollector` | `"PayloadClaimAttributeCollector"` | `(config) => new PayloadClaimAttributeCollector(config)` |
 | `ruleCollector` | `"ResourceActionScopeRuleCollector"` | `(config) => new ResourceActionScopeRuleCollector(config)` |
 | `ruleCollector` | `"ResourceActionPermissionRuleCollector"` | `() => new ResourceActionPermissionRuleCollector()` |
 | `resourceParser` | `"DotNotationResourceParser"` | `() => new DotNotationResourceParser()` |

package/dist/collectors/PayloadClaimAttributeCollector.d.mts

@@ -0,0 +1,58 @@
+import type { AttributeCollector, Attributes, CollectorContext } from "@o3co/auth.policy-verifier.core";
+import { type AttributeMapping, type AttributeMappingCollectorConfig, type AttributeMappingType } from "./_attributeMapping.mjs";
+/** One claim this collector promotes out of the verified subject bag. */
+export type PayloadClaimAttributeMapping = AttributeMapping;
+/** Types a claim may be promoted as. */
+export type PayloadClaimAttributeType = AttributeMappingType;
+/** Config entry accepted by `PayloadClaimAttributeCollector`. */
+export type PayloadClaimAttributeCollectorConfig = AttributeMappingCollectorConfig;
+/**
+ * Promotes declared claims of the verified subject into attributes (#219).
+ *
+ * The builtins read three claims — `scope`, `sub`, `azp` — and an external
+ * IdP puts what a rule needs elsewhere: Clerk's org role under `o.rol`,
+ * Auth0's roles under a namespaced `https://example.com/roles`, Okta's groups
+ * under `groups`. Until now every one of those meant a bespoke collector,
+ * even for the common case of "read this claim, check its type, write it
+ * under this key". This is the same declaration `RequestContextAttributeCollector`
+ * takes, pointed at `CollectorContext.subject` instead of the caller's body:
+ *
+ * ```hocon
+ * { collector = "PayloadClaimAttributeCollector"
+ *   attributes = [
+ *     { from = "o.rol", to = "roles", type = "string[]" }
+ *     { from = "https://example.com/roles", to = "roles", type = "string[]" }
+ *     { from = "tid", to = "tenantId" }
+ *   ] }
+ * ```
+ *
+ * ## Core's vocabulary is a valid destination here
+ *
+ * `RequestContextAttributeCollector` refuses to write `scopes`, `permissions`,
+ * `roles`, `userId` and `clientId`, because its source is the request body
+ * and those keys are what the engine decides from. This collector's source is
+ * the signature-verified token — the same trust `PayloadScopeCollector` writes
+ * `scopes` from — so a verified claim may land on them: `permissions` from
+ * Auth0's `permissions`, `roles` from Clerk's `o.rol`, `scopes` from Okta's
+ * `scp`. Two collectors writing one list key **union** it; that is the
+ * deployment composing two issuer-derived sources, and it says so in config.
+ *
+ * Keys another package reserved — cedar's `request*` — stay refused: those
+ * are derived from the parsed request, not from the subject, and a claim
+ * landing on one would be a second writer with a different meaning.
+ *
+ * Two cautions the trust argument depends on. A signed claim is only as
+ * trustworthy as what the IdP put in it: map claims the IdP populates from
+ * its own registration or admin data, never from user-editable profile
+ * metadata (Clerk's `unsafe_metadata`, Auth0's `user_metadata`) — a mapping
+ * from those hands the end user their own roles. And the union rule is for
+ * lists: a *scalar* key written by two collectors with different values
+ * throws `AttributeConflictError` and denies every request, so do not map
+ * onto `userId` / `clientId` while `PayloadSubjectIdCollector` writes them.
+ */
+export declare class PayloadClaimAttributeCollector implements AttributeCollector {
+    private readonly mappings;
+    constructor(config: PayloadClaimAttributeCollectorConfig);
+    collect(context: CollectorContext): Promise<Attributes>;
+}
+//# sourceMappingURL=PayloadClaimAttributeCollector.d.mts.map

package/dist/collectors/PayloadClaimAttributeCollector.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PayloadClaimAttributeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadClaimAttributeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EAIzB,MAAM,yBAAyB,CAAC;AAEjC,yEAAyE;AACzE,MAAM,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAC5D,wCAAwC;AACxC,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAC7D,iEAAiE;AACjE,MAAM,MAAM,oCAAoC,GAAG,+BAA+B,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,qBAAa,8BAA+B,YAAW,kBAAkB;IACxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAE1C,MAAM,EAAE,oCAAoC;IASlD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAK7D"}

package/dist/collectors/PayloadClaimAttributeCollector.mjs

@@ -0,0 +1,68 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { CORE_ATTRIBUTE_KEY_OWNER, suggestUnreservedAttributeKey, } from "@o3co/auth.policy-verifier.core";
+import { parseAttributeMappings, promoteMappings, } from "./_attributeMapping.mjs";
+/**
+ * Promotes declared claims of the verified subject into attributes (#219).
+ *
+ * The builtins read three claims — `scope`, `sub`, `azp` — and an external
+ * IdP puts what a rule needs elsewhere: Clerk's org role under `o.rol`,
+ * Auth0's roles under a namespaced `https://example.com/roles`, Okta's groups
+ * under `groups`. Until now every one of those meant a bespoke collector,
+ * even for the common case of "read this claim, check its type, write it
+ * under this key". This is the same declaration `RequestContextAttributeCollector`
+ * takes, pointed at `CollectorContext.subject` instead of the caller's body:
+ *
+ * ```hocon
+ * { collector = "PayloadClaimAttributeCollector"
+ *   attributes = [
+ *     { from = "o.rol", to = "roles", type = "string[]" }
+ *     { from = "https://example.com/roles", to = "roles", type = "string[]" }
+ *     { from = "tid", to = "tenantId" }
+ *   ] }
+ * ```
+ *
+ * ## Core's vocabulary is a valid destination here
+ *
+ * `RequestContextAttributeCollector` refuses to write `scopes`, `permissions`,
+ * `roles`, `userId` and `clientId`, because its source is the request body
+ * and those keys are what the engine decides from. This collector's source is
+ * the signature-verified token — the same trust `PayloadScopeCollector` writes
+ * `scopes` from — so a verified claim may land on them: `permissions` from
+ * Auth0's `permissions`, `roles` from Clerk's `o.rol`, `scopes` from Okta's
+ * `scp`. Two collectors writing one list key **union** it; that is the
+ * deployment composing two issuer-derived sources, and it says so in config.
+ *
+ * Keys another package reserved — cedar's `request*` — stay refused: those
+ * are derived from the parsed request, not from the subject, and a claim
+ * landing on one would be a second writer with a different meaning.
+ *
+ * Two cautions the trust argument depends on. A signed claim is only as
+ * trustworthy as what the IdP put in it: map claims the IdP populates from
+ * its own registration or admin data, never from user-editable profile
+ * metadata (Clerk's `unsafe_metadata`, Auth0's `user_metadata`) — a mapping
+ * from those hands the end user their own roles. And the union rule is for
+ * lists: a *scalar* key written by two collectors with different values
+ * throws `AttributeConflictError` and denies every request, so do not map
+ * onto `userId` / `clientId` while `PayloadSubjectIdCollector` writes them.
+ */
+export class PayloadClaimAttributeCollector {
+    mappings;
+    constructor(config) {
+        this.mappings = parseAttributeMappings("PayloadClaimAttributeCollector", config, (index, reservation) => reservation.owner === CORE_ATTRIBUTE_KEY_OWNER ? undefined : refusal(index, reservation));
+    }
+    async collect(context) {
+        // The subject bag is what the authenticator verified; nothing here reads
+        // `requestContext`, so a caller cannot steer a mapping with the body.
+        return promoteMappings(this.mappings, context.subject);
+    }
+}
+/** Why a mapping onto another package's key is refused, naming that package. */
+function refusal(index, reservation) {
+    const { key, owner, reason } = reservation;
+    return (`PayloadClaimAttributeCollector: attributes[${index}] maps onto the reserved attribute "${key}", ` +
+        `which belongs to ${owner}${reason === undefined ? "" : ` — ${reason}`}. ` +
+        "That package derives the key from the request, not from the subject, so a verified claim " +
+        "landing on it would be a second writer with a different meaning. " +
+        `Promote the claim under a key of your own (for example "${suggestUnreservedAttributeKey(key)}").`);
+}

package/dist/collectors/PayloadScopeCollector.d.mts

@@ -1,10 +1,22 @@
 import type { AttributeCollector, Attributes, CollectorContext } from "@o3co/auth.policy-verifier.core";
+/** Config entry accepted by `PayloadScopeCollector`. */
+export interface PayloadScopeCollectorConfig {
+    /**
+     * The claim the scopes are read from (#219). Defaults to `scope`, the
+     * space-delimited OAuth claim; `scp` for Okta, `permissions` for Auth0,
+     * both of which are arrays of strings. Either shape is read.
+     */
+    claim?: string;
+}
 /**
- * Attribute collector that splits the OAuth2 `scope` claim (space-delimited)
- * into a `string[]` and exposes it under `ATTR_SCOPES`. Missing or non-string
- * `scope` yields an empty array.
+ * Attribute collector that reads the scope claim — a space-delimited string
+ * or an array of strings — into a `string[]` under `ATTR_SCOPES`. Missing or
+ * malformed yields an empty array, and so does a list carrying a non-string:
+ * a value that is not a scope list asserts no capability.
  */
 export declare class PayloadScopeCollector implements AttributeCollector {
+    private readonly claim;
+    constructor(config?: PayloadScopeCollectorConfig);
     collect(context: CollectorContext): Promise<Attributes>;
 }
 //# sourceMappingURL=PayloadScopeCollector.d.mts.map

package/dist/collectors/PayloadScopeCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"PayloadScopeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadScopeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAGzC;;;;GAIG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IACzD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAK7D"}
+{"version":3,"file":"PayloadScopeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/PayloadScopeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAIzC,wDAAwD;AACxD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,MAAM,CAAC,EAAE,2BAA2B;IAI1C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAG7D"}

package/dist/collectors/PayloadScopeCollector.mjs

@@ -1,15 +1,19 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
 import { ATTR_SCOPES } from "@o3co/auth.policy-verifier.core";
+import { DEFAULT_SCOPE_CLAIM, resolveClaimName, scopesFrom } from "./_claims.mjs";
 /**
- * Attribute collector that splits the OAuth2 `scope` claim (space-delimited)
- * into a `string[]` and exposes it under `ATTR_SCOPES`. Missing or non-string
- * `scope` yields an empty array.
+ * Attribute collector that reads the scope claim — a space-delimited string
+ * or an array of strings — into a `string[]` under `ATTR_SCOPES`. Missing or
+ * malformed yields an empty array, and so does a list carrying a non-string:
+ * a value that is not a scope list asserts no capability.
  */
 export class PayloadScopeCollector {
+    claim;
+    constructor(config) {
+        this.claim = resolveClaimName("PayloadScopeCollector", config?.claim, DEFAULT_SCOPE_CLAIM);
+    }
     async collect(context) {
-        const scope = context.subject.scope;
-        const scopes = typeof scope === "string" && scope ? scope.split(" ").filter(Boolean) : [];
-        return new Map([[ATTR_SCOPES, scopes]]);
+        return new Map([[ATTR_SCOPES, scopesFrom(context.subject[this.claim])]]);
     }
 }

package/dist/collectors/RequestContextAttributeCollector.d.mts

@@ -1,26 +1,16 @@
 import type { AttributeCollector, Attributes, CollectorContext } from "@o3co/auth.policy-verifier.core";
+import { type AttributeMapping, type AttributeMappingCollectorConfig, type AttributeMappingType } from "./_attributeMapping.mjs";
 /** Types a `requestContext` field may be promoted as. */
-export type RequestContextAttributeType = "string" | "number" | "boolean" | "string[]";
-/** One field this collector promotes out of `requestContext`. */
-export interface RequestContextAttributeMapping {
-    /** Field to read, as a dot path (`"tenant.id"`) into `requestContext`. */
-    from: string;
-    /**
-     * Attribute key to write. Defaults to `from`.
-     *
-     * May not name a reserved key — core's five, plus whatever the packages a
-     * composition loaded reserved for themselves. See the class doc comment for
-     * why the caller's body may not land on vocabulary a deployment writes.
-     */
-    to?: string;
-    /** Expected type; a value of any other shape is not promoted. Defaults to `"string"`. */
-    type?: RequestContextAttributeType;
-}
+export type RequestContextAttributeType = AttributeMappingType;
+/**
+ * One field this collector promotes out of `requestContext`. `to` may not
+ * name a reserved key — core's five, plus whatever the packages a composition
+ * loaded reserved for themselves. See the class doc comment for why the
+ * caller's body may not land on vocabulary a deployment writes.
+ */
+export type RequestContextAttributeMapping = AttributeMapping;
 /** Config entry accepted by `RequestContextAttributeCollector`. */
-export interface RequestContextAttributeCollectorConfig {
-    /** The fields to promote. Must declare at least one. */
-    attributes: RequestContextAttributeMapping[];
-}
+export type RequestContextAttributeCollectorConfig = AttributeMappingCollectorConfig;
 /**
  * Promotes declared fields of `CollectorContext.requestContext` into attributes.
  *

package/dist/collectors/RequestContextAttributeCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"RequestContextAttributeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/RequestContextAttributeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAQzC,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AASvF,iEAAiE;AACjE,MAAM,WAAW,8BAA8B;IAC9C,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,IAAI,CAAC,EAAE,2BAA2B,CAAC;CACnC;AAED,mEAAmE;AACnE,MAAM,WAAW,sCAAsC;IACtD,wDAAwD;IACxD,UAAU,EAAE,8BAA8B,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,qBAAa,gCAAiC,YAAW,kBAAkB;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;gBAE1D,MAAM,EAAE,sCAAsC;IAoCpD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAgB7D"}
+{"version":3,"file":"RequestContextAttributeCollector.d.mts","sourceRoot":"","sources":["../../src/collectors/RequestContextAttributeCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EAIzB,MAAM,yBAAyB,CAAC;AAEjC,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;AAE9D,mEAAmE;AACnE,MAAM,MAAM,sCAAsC,GAAG,+BAA+B,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,qBAAa,gCAAiC,YAAW,kBAAkB;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAE1C,MAAM,EAAE,sCAAsC;IAOpD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAQ7D"}

package/dist/collectors/RequestContextAttributeCollector.mjs

@@ -1,12 +1,7 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
-import { attributeKeyReservation, CORE_ATTRIBUTE_KEY_OWNER, readUntrustedRequestContext, suggestUnreservedAttributeKey, } from "@o3co/auth.policy-verifier.core";
-const ATTRIBUTE_TYPES = [
-    "string",
-    "number",
-    "boolean",
-    "string[]",
-];
+import { CORE_ATTRIBUTE_KEY_OWNER, readUntrustedRequestContext, suggestUnreservedAttributeKey, } from "@o3co/auth.policy-verifier.core";
+import { parseAttributeMappings, promoteMappings, } from "./_attributeMapping.mjs";
 /**
  * Promotes declared fields of `CollectorContext.requestContext` into attributes.
  *
@@ -76,47 +71,19 @@ const ATTRIBUTE_TYPES = [
 export class RequestContextAttributeCollector {
     mappings;
     constructor(config) {
-        const attributes = config?.attributes;
-        if (!Array.isArray(attributes) || attributes.length === 0) {
-            throw new Error("RequestContextAttributeCollector: attributes must be a non-empty array of mappings");
-        }
-        this.mappings = attributes.map((mapping, index) => {
-            const { from, to, type = "string" } = mapping ?? {};
-            if (typeof from !== "string" || from === "") {
-                throw new Error(`RequestContextAttributeCollector: attributes[${index}].from must be a non-empty string`);
-            }
-            if (to !== undefined && (typeof to !== "string" || to === "")) {
-                throw new Error(`RequestContextAttributeCollector: attributes[${index}].to must be a non-empty string`);
-            }
-            if (!ATTRIBUTE_TYPES.includes(type)) {
-                throw new Error(`RequestContextAttributeCollector: attributes[${index}].type must be one of ${ATTRIBUTE_TYPES.join(", ")}, got "${type}"`);
-            }
-            // Checked on the resolved key, not on `to`: `to` defaults to `from`,
-            // so `{ from = "scopes" }` reaches the reserved key without ever
-            // spelling it out. See the class doc comment for why this is refused.
-            const key = to ?? from;
-            const reservation = attributeKeyReservation(key);
-            if (reservation !== undefined) {
-                throw new Error(refusal(index, reservation));
-            }
-            return { from, to: key, type };
-        });
+        // Every reserved destination is refused here — the source is the caller's
+        // body. The declaration parsing is shared with the collector that reads
+        // verified claims (#219); the policy is this collector's own.
+        this.mappings = parseAttributeMappings("RequestContextAttributeCollector", config, refusal);
     }
     async collect(context) {
-        const attrs = new Map();
         // The unwrap is the acknowledgement `UntrustedRequestContext` asks for:
         // everything below this line is the caller's own data, which is why the
         // mapping list — not the request — decides what becomes an attribute.
         const requestContext = readUntrustedRequestContext(context.requestContext);
         if (requestContext === undefined)
-            return attrs;
-        for (const mapping of this.mappings) {
-            const raw = readPath(requestContext, mapping.from);
-            if (matchesType(raw, mapping.type)) {
-                attrs.set(mapping.to, Array.isArray(raw) ? [...raw] : raw);
-            }
-        }
-        return attrs;
+            return new Map();
+        return promoteMappings(this.mappings, requestContext);
     }
 }
 /**
@@ -149,32 +116,3 @@ function refusal(index, reservation) {
             "the one the deployment was supposed to supply. ";
     return `${head}Promote the field under a key of your own (for example "${suggestUnreservedAttributeKey(key)}").`;
 }
-/**
- * Reads a dot path, traversing own properties only. `requestContext` is
- * caller-supplied, so inherited members (`constructor`, `toString`, …) must not
- * be reachable through a configured path.
- */
-function readPath(root, path) {
-    let current = root;
-    for (const segment of path.split(".")) {
-        if (typeof current !== "object" || current === null)
-            return undefined;
-        if (!Object.hasOwn(current, segment))
-            return undefined;
-        current = current[segment];
-    }
-    return current;
-}
-/** Whether `value` is usable as the declared type. Empty strings count as absent. */
-function matchesType(value, type) {
-    switch (type) {
-        case "string":
-            return typeof value === "string" && value !== "";
-        case "number":
-            return typeof value === "number" && Number.isFinite(value);
-        case "boolean":
-            return typeof value === "boolean";
-        case "string[]":
-            return Array.isArray(value) && value.every((item) => typeof item === "string" && item !== "");
-    }
-}

package/dist/collectors/_attributeMapping.d.mts

@@ -0,0 +1,45 @@
+import type { AttributeKeyReservation, Attributes } from "@o3co/auth.policy-verifier.core";
+/** Types a field may be promoted as. */
+export type AttributeMappingType = "string" | "number" | "boolean" | "string[]";
+export declare const ATTRIBUTE_MAPPING_TYPES: readonly AttributeMappingType[];
+/** One field to promote. */
+export interface AttributeMapping {
+    /**
+     * Field to read. An exact key on the source wins; otherwise a dot path
+     * (`"tenant.id"`) is walked — so a claim whose *name* carries dots, such as
+     * Auth0's `https://example.com/roles`, is one key, not a path.
+     */
+    from: string;
+    /** Attribute key to write. Defaults to `from`. */
+    to?: string;
+    /** Expected type; a value of any other shape is not promoted. Defaults to `"string"`. */
+    type?: AttributeMappingType;
+}
+/** Config entry shape shared by the mapping collectors. */
+export interface AttributeMappingCollectorConfig {
+    /** The fields to promote. Must declare at least one. */
+    attributes: AttributeMapping[];
+}
+export type ResolvedAttributeMapping = Required<AttributeMapping>;
+/**
+ * What a collector decides about a mapping onto a reserved key: the refusal
+ * to throw, or `undefined` to allow it. Called only for reserved destinations.
+ */
+export type ReservedKeyPolicy = (index: number, reservation: AttributeKeyReservation) => string | undefined;
+/**
+ * Validates the declaration at construction — boot, not first request — so a
+ * deployment that wrote a malformed or refused mapping never serves a decision.
+ */
+export declare function parseAttributeMappings(collector: string, config: AttributeMappingCollectorConfig | undefined, reservedKeyPolicy: ReservedKeyPolicy): ResolvedAttributeMapping[];
+/**
+ * Reads a field: the exact own key when the source has one, else a dot path
+ * traversing own properties only. Both sources this serves can carry anything,
+ * so inherited members (`constructor`, `toString`, …) must not be reachable
+ * through a configured name.
+ */
+export declare function readPath(root: Record<string, unknown>, path: string): unknown;
+/** Whether `value` is usable as the declared type. Empty strings count as absent. */
+export declare function matchesType(value: unknown, type: AttributeMappingType): boolean;
+/** Promotes every declared field whose value matches its declared type. */
+export declare function promoteMappings(mappings: readonly ResolvedAttributeMapping[], source: Record<string, unknown>): Attributes;
+//# sourceMappingURL=_attributeMapping.d.mts.map

package/dist/collectors/_attributeMapping.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_attributeMapping.d.mts","sourceRoot":"","sources":["../../src/collectors/_attributeMapping.mts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG3F,wCAAwC;AACxC,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAEhF,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAKlE,CAAC;AAEF,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,IAAI,CAAC,EAAE,oBAAoB,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,+BAA+B;IAC/C,wDAAwD;IACxD,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC/B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,uBAAuB,KAChC,MAAM,GAAG,SAAS,CAAC;AAExB;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,+BAA+B,GAAG,SAAS,EACnD,iBAAiB,EAAE,iBAAiB,GAClC,wBAAwB,EAAE,CA4B5B;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAS7E;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAW/E;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,SAAS,wBAAwB,EAAE,EAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,UAAU,CASZ"}

package/dist/collectors/_attributeMapping.mjs

@@ -0,0 +1,84 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { attributeKeyReservation } from "@o3co/auth.policy-verifier.core";
+export const ATTRIBUTE_MAPPING_TYPES = [
+    "string",
+    "number",
+    "boolean",
+    "string[]",
+];
+/**
+ * Validates the declaration at construction — boot, not first request — so a
+ * deployment that wrote a malformed or refused mapping never serves a decision.
+ */
+export function parseAttributeMappings(collector, config, reservedKeyPolicy) {
+    const attributes = config?.attributes;
+    if (!Array.isArray(attributes) || attributes.length === 0) {
+        throw new Error(`${collector}: attributes must be a non-empty array of mappings`);
+    }
+    return attributes.map((mapping, index) => {
+        const { from, to, type = "string" } = mapping ?? {};
+        if (typeof from !== "string" || from === "") {
+            throw new Error(`${collector}: attributes[${index}].from must be a non-empty string`);
+        }
+        if (to !== undefined && (typeof to !== "string" || to === "")) {
+            throw new Error(`${collector}: attributes[${index}].to must be a non-empty string`);
+        }
+        if (!ATTRIBUTE_MAPPING_TYPES.includes(type)) {
+            throw new Error(`${collector}: attributes[${index}].type must be one of ${ATTRIBUTE_MAPPING_TYPES.join(", ")}, got "${type}"`);
+        }
+        // Checked on the resolved key, not on `to`: `to` defaults to `from`,
+        // so `{ from = "scopes" }` reaches a reserved key without spelling it out.
+        const key = to ?? from;
+        const reservation = attributeKeyReservation(key);
+        if (reservation !== undefined) {
+            const refusal = reservedKeyPolicy(index, reservation);
+            if (refusal !== undefined)
+                throw new Error(refusal);
+        }
+        return { from, to: key, type };
+    });
+}
+/**
+ * Reads a field: the exact own key when the source has one, else a dot path
+ * traversing own properties only. Both sources this serves can carry anything,
+ * so inherited members (`constructor`, `toString`, …) must not be reachable
+ * through a configured name.
+ */
+export function readPath(root, path) {
+    if (Object.hasOwn(root, path))
+        return root[path];
+    let current = root;
+    for (const segment of path.split(".")) {
+        if (typeof current !== "object" || current === null)
+            return undefined;
+        if (!Object.hasOwn(current, segment))
+            return undefined;
+        current = current[segment];
+    }
+    return current;
+}
+/** Whether `value` is usable as the declared type. Empty strings count as absent. */
+export function matchesType(value, type) {
+    switch (type) {
+        case "string":
+            return typeof value === "string" && value !== "";
+        case "number":
+            return typeof value === "number" && Number.isFinite(value);
+        case "boolean":
+            return typeof value === "boolean";
+        case "string[]":
+            return Array.isArray(value) && value.every((item) => typeof item === "string" && item !== "");
+    }
+}
+/** Promotes every declared field whose value matches its declared type. */
+export function promoteMappings(mappings, source) {
+    const attrs = new Map();
+    for (const mapping of mappings) {
+        const raw = readPath(source, mapping.from);
+        if (matchesType(raw, mapping.type)) {
+            attrs.set(mapping.to, Array.isArray(raw) ? [...raw] : raw);
+        }
+    }
+    return attrs;
+}

package/dist/collectors/_claims.d.mts

@@ -0,0 +1,20 @@
+/** The claim RFC 8693 §4.2 / RFC 9068 §2.2.3 name, and the default. */
+export declare const DEFAULT_SCOPE_CLAIM = "scope";
+/**
+ * Resolves a `claim` option: absent means `fallback`, a non-empty string names
+ * the claim, anything else — an empty string, a number, an explicit `null` — is
+ * refused at construction. `null` is not "unset": a `null` in a config was
+ * produced rather than written (an unrendered template, a missing env var), and
+ * reading it as the default would silently point the collector elsewhere.
+ */
+export declare function resolveClaimName(collector: string, raw: unknown, fallback: string): string;
+/**
+ * Reads a scope claim as a list. The OAuth `scope` claim is a space-delimited
+ * string; Okta's `scp` and Auth0's `permissions` are arrays of strings. Either
+ * shape yields the non-empty entries. Anything else — absent, a number, a list
+ * carrying a non-string — asserts no capability at all, the way a non-string
+ * `scope` never did: fail closed rather than pick the strings out of a value
+ * that is not a scope list.
+ */
+export declare function scopesFrom(value: unknown): string[];
+//# sourceMappingURL=_claims.d.mts.map

package/dist/collectors/_claims.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_claims.d.mts","sourceRoot":"","sources":["../../src/collectors/_claims.mts"],"names":[],"mappings":"AASA,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM1F;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAMnD"}

package/dist/collectors/_claims.mjs

@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+/*
+ * Which claim carries the scopes, and how its value is read (#219). Shared by
+ * the collector that promotes scopes and the rule collector that has to know
+ * whether a token asserted any, so the two cannot disagree about a token.
+ */
+/** The claim RFC 8693 §4.2 / RFC 9068 §2.2.3 name, and the default. */
+export const DEFAULT_SCOPE_CLAIM = "scope";
+/**
+ * Resolves a `claim` option: absent means `fallback`, a non-empty string names
+ * the claim, anything else — an empty string, a number, an explicit `null` — is
+ * refused at construction. `null` is not "unset": a `null` in a config was
+ * produced rather than written (an unrendered template, a missing env var), and
+ * reading it as the default would silently point the collector elsewhere.
+ */
+export function resolveClaimName(collector, raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    if (typeof raw !== "string" || raw === "") {
+        throw new Error(`${collector}: claim must be a non-empty string`);
+    }
+    return raw;
+}
+/**
+ * Reads a scope claim as a list. The OAuth `scope` claim is a space-delimited
+ * string; Okta's `scp` and Auth0's `permissions` are arrays of strings. Either
+ * shape yields the non-empty entries. Anything else — absent, a number, a list
+ * carrying a non-string — asserts no capability at all, the way a non-string
+ * `scope` never did: fail closed rather than pick the strings out of a value
+ * that is not a scope list.
+ */
+export function scopesFrom(value) {
+    if (typeof value === "string")
+        return value.split(" ").filter(Boolean);
+    if (Array.isArray(value) && value.every((entry) => typeof entry === "string")) {
+        return value.filter(Boolean);
+    }
+    return [];
+}

package/dist/index.d.mts

@@ -1,4 +1,5 @@
-export { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
+export { PayloadClaimAttributeCollector, type PayloadClaimAttributeCollectorConfig, type PayloadClaimAttributeMapping, type PayloadClaimAttributeType, } from "./collectors/PayloadClaimAttributeCollector.mjs";
+export { PayloadScopeCollector, type PayloadScopeCollectorConfig, } from "./collectors/PayloadScopeCollector.mjs";
 export { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
 export { RequestContextAttributeCollector, type RequestContextAttributeCollectorConfig, type RequestContextAttributeMapping, type RequestContextAttributeType, } from "./collectors/RequestContextAttributeCollector.mjs";
 export { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GAChC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,eAAe,GACpB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAIA,OAAO,EACN,8BAA8B,EAC9B,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,GAC9B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACN,qBAAqB,EACrB,KAAK,2BAA2B,GAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GAChC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EACN,gCAAgC,EAChC,KAAK,sCAAsC,EAC3C,KAAK,eAAe,GACpB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.mjs

@@ -1,7 +1,8 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
 // Collectors
-export { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
+export { PayloadClaimAttributeCollector, } from "./collectors/PayloadClaimAttributeCollector.mjs";
+export { PayloadScopeCollector, } from "./collectors/PayloadScopeCollector.mjs";
 export { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
 export { RequestContextAttributeCollector, } from "./collectors/RequestContextAttributeCollector.mjs";
 export { StaticPermissionCollector } from "./collectors/StaticPermissionCollector.mjs";

package/dist/module.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAU9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAyCrC,CAAC"}
+{"version":3,"file":"module.d.mts","sourceRoot":"","sources":["../src/module.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAW9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MA6CrC,CAAC"}

package/dist/module.mjs

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
+import { PayloadClaimAttributeCollector } from "./collectors/PayloadClaimAttributeCollector.mjs";
 import { PayloadScopeCollector } from "./collectors/PayloadScopeCollector.mjs";
 import { PayloadSubjectIdCollector } from "./collectors/PayloadSubjectIdCollector.mjs";
 import { RequestContextAttributeCollector } from "./collectors/RequestContextAttributeCollector.mjs";
@@ -17,11 +18,12 @@ export const builtinCollectorsModule = {
     name: "builtin-collectors",
     async init(context) {
         // Attribute collector factories
-        context.attributeCollectorRegistry.register("PayloadScopeCollector", () => new PayloadScopeCollector());
+        context.attributeCollectorRegistry.register("PayloadScopeCollector", (config) => new PayloadScopeCollector(config));
         context.attributeCollectorRegistry.register("PayloadSubjectIdCollector", () => new PayloadSubjectIdCollector());
         context.attributeCollectorRegistry.register("StaticPermissionCollector", (config) => new StaticPermissionCollector(config));
         context.attributeCollectorRegistry.register("StaticRoleCollector", (config) => new StaticRoleCollector(config));
         context.attributeCollectorRegistry.register("RequestContextAttributeCollector", (config) => new RequestContextAttributeCollector(config));
+        context.attributeCollectorRegistry.register("PayloadClaimAttributeCollector", (config) => new PayloadClaimAttributeCollector(config));
         // Rule collector factories
         context.ruleCollectorRegistry.register("ResourceActionScopeRuleCollector", (config) => new ResourceActionScopeRuleCollector(config));
         context.ruleCollectorRegistry.register("ResourceActionPermissionRuleCollector", () => new ResourceActionPermissionRuleCollector());

package/dist/rules/collectors/ResourceActionScopeRuleCollector.d.mts

@@ -1,5 +1,5 @@
 import type { CollectorContext, Rule, RuleCollector } from "@o3co/auth.policy-verifier.core";
-/** How the collector treats a token that carries no `scope` claim. */
+/** How the collector treats a token that carries no scope claim (`scope`, or the configured `claim`). */
 export type ScopelessPolicy = "deny" | "skip";
 /** Config entry accepted by `ResourceActionScopeRuleCollector`. */
 export interface ResourceActionScopeRuleCollectorConfig {
@@ -15,6 +15,12 @@ export interface ResourceActionScopeRuleCollectorConfig {
      * `read:x`. See `HasScopeOptions.allowBareScopeRewrite`.
      */
     allowBareScopeRewrite?: boolean;
+    /**
+     * The claim whose presence says the token asserted scopes (#219). Defaults
+     * to `scope`; set it to what `PayloadScopeCollector` reads (`scp` for Okta)
+     * so the two agree about which tokens are scopeless.
+     */
+    claim?: string;
 }
 /**
  * Generates a HasScope rule derived from the request action and resource type.
@@ -56,6 +62,7 @@ export interface ResourceActionScopeRuleCollectorConfig {
 export declare class ResourceActionScopeRuleCollector implements RuleCollector {
     private readonly scopeless;
     private readonly allowBareScopeRewrite;
+    private readonly claim;
     constructor(config?: ResourceActionScopeRuleCollectorConfig);
     collect(context: CollectorContext): Promise<Rule[]>;
 }

package/dist/rules/collectors/ResourceActionScopeRuleCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../../src/rules/collectors/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAI9C,mEAAmE;AACnE,MAAM,WAAW,sCAAsC;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBAAa,gCAAiC,YAAW,aAAa;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;gBAEpC,MAAM,CAAC,EAAE,sCAAsC;IAqBrD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAOzD"}
+{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../../src/rules/collectors/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAI7F,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAI9C,mEAAmE;AACnE,MAAM,WAAW,sCAAsC;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBAAa,gCAAiC,YAAW,aAAa;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,MAAM,CAAC,EAAE,sCAAsC;IA0BrD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAOzD"}

package/dist/rules/collectors/ResourceActionScopeRuleCollector.mjs

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
+import { DEFAULT_SCOPE_CLAIM, resolveClaimName } from "../../collectors/_claims.mjs";
 import { HasScope } from "../HasScope.mjs";
 const SCOPELESS_POLICIES = ["deny", "skip"];
 /**
@@ -42,7 +43,9 @@ const SCOPELESS_POLICIES = ["deny", "skip"];
 export class ResourceActionScopeRuleCollector {
     scopeless;
     allowBareScopeRewrite;
+    claim;
     constructor(config) {
+        this.claim = resolveClaimName("ResourceActionScopeRuleCollector", config?.claim, DEFAULT_SCOPE_CLAIM);
         const scopeless = config?.scopeless ?? "deny";
         if (!SCOPELESS_POLICIES.includes(scopeless)) {
             throw new Error(`ResourceActionScopeRuleCollector: scopeless must be one of ${SCOPELESS_POLICIES.join(", ")}, got "${scopeless}"`);
@@ -58,7 +61,7 @@ export class ResourceActionScopeRuleCollector {
         this.allowBareScopeRewrite = rawRewrite ?? false;
     }
     async collect(context) {
-        if (this.scopeless === "skip" && context.subject.scope === undefined) {
+        if (this.scopeless === "skip" && context.subject[this.claim] === undefined) {
             return [];
         }
         const scope = `${context.action}:${context.resource.resourceType}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.builtins",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -31,7 +31,7 @@
     }
   },
   "dependencies": {
-    "@o3co/auth.policy-verifier.core": "0.8.0"
+    "@o3co/auth.policy-verifier.core": "0.9.0"
   },
   "devDependencies": {
     "@types/node": "^26.4.0",