@o3co/create-auth-policy-verifier 0.13.0 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-policy-verifier",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Scaffold a new o3co/auth.policy-verifier project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",

package/templates/standalone/README.ja.md

@@ -1,6 +1,6 @@
 # @o3co/auth-policy-verifier-standalone
 
-最終更新: 2026-09-23
+最終更新: 2026-09-28
 
 auth.policy-verifier のデプロイ可能なサーバーテンプレートです。このパッケージはコンポジションルートとして機能し、設定の読み込み・モジュールのロード・Express サーバーの起動を担います。`@o3co/create-auth-policy-verifier` によって生成されます。
 
@@ -80,7 +80,7 @@ OAUTH_JWT_SECRET=$(openssl rand -hex 32) \
 | `RULE_ON_EMPTY_RULE_SET` | `deny` | ルールが 1 つも集まらなかったときの決定（`deny` \| `allow`） |
 | `VERIFY_MAX_BATCH_SIZE` | `50` | `POST /verify/batch` の件数上限 |
 | `VERIFY_CREDENTIAL_TO_COLLECTORS` | `never` | `expose` は生の資格情報を `context.credential` として collector に渡す — subject として下流 API を呼ぶ collector のためだけの設定。既定では collector は検証済みクレームだけを扱う。資格情報はリプレイ可能であり、context がログに出ればそれが漏れる |
-| `VERIFY_EVALUATION_IN_RESPONSE` | `omit` | `include` にすると、policy を背後に持つ各 Rule の `evaluation`（status と、評価した policy revision。#244）を決定の response に載せる。どの revision が操作を許可したかを記録する呼び出し側サービス向け。`decision` ログイベントにはどちらの設定でも載る。受理される token の保持者全員に「policy set がいつ変わったか」を伝えることになるので、それが問題になる環境では `HTTP_CALLER_AUTH_TOKEN` と併用する |
+| `VERIFY_EVALUATION_IN_RESPONSE` | `omit` | `include` にすると、policy を背後に持つ各 Rule の `evaluation`（status、評価した policy revision（#244）、完了した answer ではそれを決めた policy（#199））を決定の response に載せる。どの revision が操作を許可したかを記録する呼び出し側サービス向け。`decision` ログイベントにはどちらの設定でも載る。受理される token の保持者全員に「policy set がいつ変わったか」「各 answer をどの policy が決めたか」を伝えることになるので、それが問題になる環境では `HTTP_CALLER_AUTH_TOKEN` と併用する |
 | `LOG_LEVEL` | `info` | 出力する最低レベル: `trace`\|`debug`\|`info`\|`warn`\|`error`\|`fatal`\|`silent`。decision ログのスイッチも兼ねる — [可観測性](#可観測性)を参照 |
 
 ## HS256 シークレットの強度

package/templates/standalone/README.md

@@ -1,6 +1,6 @@
 # @o3co/auth-policy-verifier-standalone
 
-Last updated: 2026-09-23
+Last updated: 2026-09-28
 
 Deployable server template for auth.policy-verifier. This is the composition root — it reads config, loads modules, and starts the Express server. Generated by `@o3co/create-auth-policy-verifier`.
 
@@ -82,7 +82,7 @@ Individual values can also be overridden with environment variables.
 | `RULE_ON_EMPTY_RULE_SET` | `deny` | Decision when no rule is collected (`deny` \| `allow`) |
 | `VERIFY_MAX_BATCH_SIZE` | `50` | Cap on `POST /verify/batch` entries |
 | `VERIFY_CREDENTIAL_TO_COLLECTORS` | `never` | `expose` hands collectors the raw credential as `context.credential` — only for a collector that calls a downstream API as the subject. The default keeps collectors on verified claims; the credential is replayable and a logged context would leak it |
-| `VERIFY_EVALUATION_IN_RESPONSE` | `omit` | `include` puts each policy-backed rule's `evaluation` — its status and the policy revision it evaluated (#244) — on the decision response, for a calling service that records which revision authorized an operation. The `decision` log event carries it either way. It tells any holder of an accepted token when the policy set changed, so pair it with `HTTP_CALLER_AUTH_TOKEN` where that matters |
+| `VERIFY_EVALUATION_IN_RESPONSE` | `omit` | `include` puts each policy-backed rule's `evaluation` — its status, the policy revision it evaluated (#244) and, for a completed answer, the policies that determined it (#199) — on the decision response, for a calling service that records which revision authorized an operation. The `decision` log event carries it either way. It tells any holder of an accepted token when the policy set changed and which policies determined each answer, so pair it with `HTTP_CALLER_AUTH_TOKEN` where that matters |
 | `LOG_LEVEL` | `info` | Minimum level emitted: `trace`\|`debug`\|`info`\|`warn`\|`error`\|`fatal`\|`silent`. Also the switch for the decision log — see [Observability](#observability) |
 
 ## HS256 secret strength

package/templates/standalone/config/application.conf

@@ -371,13 +371,15 @@ verify {
   credentialToCollectors = ${?VERIFY_CREDENTIAL_TO_COLLECTORS}
 
   # Whether a decision RESPONSE carries what each policy-backed rule reported
-  # about the evaluation behind its answer — its status, and the policy revision
-  # it evaluated (#244). The `decision` log event always carries it; this is
-  # only about the wire. "omit" (the default): the response is key-for-key what
-  # it was. Set "include" when the calling service records which policy
-  # revision authorized an operation. It tells any holder of an accepted token
-  # when the policy set changed and whether a denial was a policy's or the
-  # engine failing, so pair it with `http.callerAuth` where that matters.
+  # about the evaluation behind its answer — its status, the policy revision it
+  # evaluated (#244) and, for a completed answer, the policies that determined
+  # it (#199). The `decision` log event always carries it; this is only about
+  # the wire. "omit" (the default): the response is key-for-key what it was.
+  # Set "include" when the calling service records which policy revision
+  # authorized an operation. It tells any holder of an accepted token when the
+  # policy set changed, whether a denial was a policy's or the engine failing,
+  # and which policies determined each answer, so pair it with
+  # `http.callerAuth` where that matters.
   evaluationInResponse = "omit"
   evaluationInResponse = ${?VERIFY_EVALUATION_IN_RESPONSE}
 }

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-policy-verifier-standalone",
-	"version": "0.13.0",
+	"version": "0.15.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"packageManager": "pnpm@10.29.3",

package/templates/versions.json

@@ -1,5 +1,5 @@
 {
-	"@o3co/auth.policy-verifier.core": "0.13.0",
-	"@o3co/auth.policy-verifier.builtins": "0.13.0",
-	"@o3co/auth.policy-verifier.server": "0.13.0"
+	"@o3co/auth.policy-verifier.core": "0.15.0",
+	"@o3co/auth.policy-verifier.builtins": "0.15.0",
+	"@o3co/auth.policy-verifier.server": "0.15.0"
 }