@o3co/create-auth-policy-verifier 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-policy-verifier",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Scaffold a new o3co/auth.policy-verifier project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,8 +28,8 @@
     "templates"
   ],
   "devDependencies": {
-    "@types/node": "^26.2.0",
-    "vitest": "^4.1.10"
+    "@types/node": "^26.4.0",
+    "vitest": "^4.1.11"
   },
   "scripts": {
     "build": "tsc",

package/templates/standalone/config/application.conf

@@ -314,12 +314,19 @@ verify {
 
   # `collectorConcurrency` is how many run at once, per pipeline, per decision.
   # Higher than any realistic collector set, so an ordinary configuration still
-  # fans out in one wave; what it removes is the tail, where a wide config or a
-  # full batch multiplies into simultaneous calls against a dependency that has
-  # just started to slow down.
+  # fans out in one wave; what it removes is the tail, where a wide config
+  # multiplies into simultaneous calls against a dependency that has just
+  # started to slow down.
   collectorConcurrency = 8
   collectorConcurrency = ${?VERIFY_COLLECTOR_CONCURRENCY}
 
+  # `batchConcurrency` is how many of a batch's entries are decided at once.
+  # The three collector bounds above are per decision — this is what keeps one
+  # `POST /verify/batch` from multiplying them by `maxBatchSize` (50 x 8
+  # collectors in flight per pipeline, from a single request).
+  batchConcurrency = 8
+  batchConcurrency = ${?VERIFY_BATCH_CONCURRENCY}
+
   # Whether collectors receive the raw credential as `context.credential`
   # (#175). "never" (the default): collectors get verified claims only — the
   # credential is replayable, and a collector that logs its context would leak

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-policy-verifier-standalone",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"packageManager": "pnpm@10.29.3",
@@ -20,17 +20,17 @@
 		"@o3co/auth.policy-verifier.builtins": "workspace:*",
 		"@o3co/auth.policy-verifier.server": "workspace:*",
 		"@o3co/auth.utils": "^0.0.4",
-		"@o3co/ts.hocon": "^1.12.0",
+		"@o3co/ts.hocon": "^1.13.0",
 		"express": "^5.2.1",
 		"pino": "^10.3.1"
 	},
 	"devDependencies": {
-		"@types/node": "^26.2.0",
+		"@types/node": "^26.4.0",
 		"@types/supertest": "^7.2.1",
-		"jose": "^6.2.8",
+		"jose": "^6.2.10",
 		"supertest": "^7.2.2",
-		"tsx": "^4.23.11",
+		"tsx": "^4.23.12",
 		"typescript": "^5.9.3",
-		"vitest": "^4.1.10"
+		"vitest": "^4.1.11"
 	}
 }

package/templates/standalone/src/__tests__/loadConfig.test.mts

@@ -381,7 +381,7 @@ rule { collectors = [ { collector = ResourceActionScopeRuleCollector } ] }
 
 		const config = loadAppConfig(withoutVerify(), "development");
 
-		// All ten, spelled out. A knob that reached the shape but not the
+		// All eleven, spelled out. A knob that reached the shape but not the
 		// block's `.default()` literal is `undefined` here, and `toEqual` says
 		// which one.
 		expect(config.verify).toEqual({
@@ -394,6 +394,7 @@ rule { collectors = [ { collector = ResourceActionScopeRuleCollector } ] }
 			collectorTimeoutMs: 2_000,
 			collectorDeadlineMs: 5_000,
 			collectorConcurrency: 8,
+			batchConcurrency: 8,
 			credentialToCollectors: "never",
 		});
 	});

package/templates/versions.json

@@ -1,5 +1,5 @@
 {
-	"@o3co/auth.policy-verifier.core": "0.4.0",
-	"@o3co/auth.policy-verifier.builtins": "0.4.0",
-	"@o3co/auth.policy-verifier.server": "0.4.0"
+	"@o3co/auth.policy-verifier.core": "0.5.0",
+	"@o3co/auth.policy-verifier.builtins": "0.5.0",
+	"@o3co/auth.policy-verifier.server": "0.5.0"
 }