attenu-guard 0.13.0 → 0.13.2

package/dist/esm/ceilings.js

@@ -14,7 +14,7 @@
  * always denies. There is no code path by which an unrecognised bound is
  * silently dropped.
  */
-import { MAX_SAFE_INTEGER, compareCodePoints, pyNumber, toPlain } from "./canonical.js";
+import { MAX_SAFE_INTEGER, RawNumber, canonicalJson, compareCodePoints, pyNumber, toPlain, } from "./canonical.js";
 import { escaped, pyRepr, pyStr, shown, shownText } from "./display.js";
 import { Decision, Reason, ReasonCode } from "./reasons.js";
 /**
@@ -32,6 +32,12 @@ function validateSafeNumber(key, value) {
             "binary64 signing surface (RFC 8785)");
     }
 }
+/**
+ * The scope grammar the draft defines: lowercase dot-separated segments, `*` only as the whole last
+ * segment. `Authority` validates its scopes against it, and a scoped `CallLimit`'s `appliesTo`
+ * follows it too.
+ */
+export const SCOPE_RE = /^[a-z][a-z0-9_-]*(?:\.[a-z][a-z0-9_-]*)*\.(?:[a-z][a-z0-9_-]*|\*)$/;
 // Ordered enum for egress: index 0 is the strictest. A value outside this
 // vocabulary is treated as maximally permissive-requested (worst case), so a
 // garbage or unknown egress value fails closed rather than silently passing.
@@ -40,6 +46,93 @@ function egressRankOf(value) {
     const i = EGRESS_ORDER.indexOf(value);
     return i === -1 ? EGRESS_ORDER.length : i;
 }
+/** The JSON kinds a ceiling compares, as `jsonKind` names them. */
+const NUMBER = ["a number"];
+const STRING = ["a string"];
+const SCALAR = ["a string", "a number", "a boolean"];
+/**
+ * `value`'s JSON type as a refusal names it: null, a boolean, a number, a string, an array or an
+ * object, or "a value that is not JSON" for anything else passed in-process (a bigint). A number
+ * this library's `parseJson` read, a `RawNumber`, is a number. The Python implementation names the
+ * same values the same way.
+ */
+export function jsonKind(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return "a boolean";
+    if (typeof value === "number" || value instanceof RawNumber)
+        return "a number";
+    if (typeof value === "string")
+        return "a string";
+    if (Array.isArray(value))
+        return "an array";
+    if (typeof value === "object")
+        return "an object";
+    return "a value that is not JSON";
+}
+/** `value`, or the number it holds when `parseJson` read it as a `RawNumber`. */
+function plain(value) {
+    return value instanceof RawNumber ? value.value : value;
+}
+/**
+ * `jsonKind(value)` when a ceiling that compares `accepted` cannot compare `value`, or `null`.
+ *
+ * Every built-in ceiling refuses such a request value rather than coercing it (attenu-ops#110):
+ * `"50"`, `[50]` and `true` passed a row cap through `<=`, `["/tmp/x"]` passed the prefix "/tmp/" as
+ * the text "/tmp/x", and `true` passed the prefix "t" as "true".
+ */
+function wrongKind(value, accepted) {
+    const kind = jsonKind(value);
+    return accepted.includes(kind) ? null : kind;
+}
+/**
+ * A denial's message: none when the value had the right type, as before; for one of the wrong type,
+ * `<kind> cannot be compared with <against>; refused`, one wording per ceiling kind, and the Python
+ * implementation's too.
+ */
+function refusal(kind, against) {
+    return kind === null ? "" : `${kind} cannot be compared with ${against}; refused`;
+}
+/**
+ * The error for a constraint member of the wrong type, `<member> of constraint <key> is <kind>, not
+ * <expected>`, with the key as Python's repr prints it: the Python implementation's text, where it
+ * raises ValueError. A member the constraint does not carry is `absent`.
+ *
+ * A bound of the wrong type is malformed (attenu-ops#110), on every path: the draft makes "max" a
+ * number and "prefix" a string, an egress rank outside none < internal < any ranked above "any" and
+ * admitted every request, and a `field` or `applies_to` that is not a string named a different
+ * context field in each implementation. A token carrying one is refused as malformed, and a bundle
+ * reports the authority unreadable.
+ */
+function malformed(key, member, value, expected, shownAs) {
+    const kind = value === undefined ? "absent" : (shownAs ?? jsonKind(value));
+    return new TypeError(`${member} of constraint ${pyRepr(key)} is ${kind}, not ${expected}`);
+}
+/**
+ * A constraint's key is a string: it names the dimension ceilings pair by and, unless `field` says
+ * otherwise, the context field the ceiling reads. A number, null or a boolean key was read as
+ * String(key) here, so 5 and "5" were one dimension, and an absent key loaded and read the field
+ * "undefined"; the Python implementation read a field no JSON context carries. Every constraint is
+ * refused without one, an unknown type included, in the Python implementation's words.
+ */
+function checkKey(key) {
+    if (typeof key !== "string") {
+        throw new TypeError(`key of a constraint is ${key === undefined ? "absent" : jsonKind(key)}, not a string`);
+    }
+}
+/** A `max` is a JSON number. */
+function checkMax(key, value) {
+    if (value === undefined || jsonKind(value) !== "a number")
+        throw malformed(key, "max", value, "a number");
+}
+/** A `prefix`, `field` or `applies_to` is a string; `field` and `applies_to` may be null, unset. */
+function checkString(key, member, value, optional = false) {
+    if (optional && (value === null || value === undefined))
+        return;
+    if (typeof value !== "string")
+        throw malformed(key, member, value, "a string");
+}
 /**
  * The request-context field a ceiling reads. Prefers an explicit `ctxField`,
  * then the caller-keyed `field`, then the ceiling's own `key`.
@@ -51,11 +144,23 @@ export function ctxFieldOf(ceiling) {
         return ceiling.field;
     return ceiling.key;
 }
-/** Uniform human-readable rendering of any ceiling. Never parsed back. */
+/**
+ * Python's `type(a) is type(b)`: whether two ceilings are of one class. Ceilings pair by key, and
+ * two of different classes under one key are not comparable: neither narrows the other, so an
+ * authority holding one is not narrower than an authority holding the other (attenu-ops#110).
+ */
+export function sameType(a, b) {
+    return Object.getPrototypeOf(a) === Object.getPrototypeOf(b);
+}
+/**
+ * Uniform human-readable rendering of any ceiling. Never parsed back. A ceiling without its own
+ * `describe`, such as one this build does not define, prints as the Python implementation prints
+ * it: its key as the wire carried it, `=`, and its wire form as Python prints a dict.
+ */
 export function describe(ceiling) {
     if (typeof ceiling.describe === "function")
         return ceiling.describe();
-    return `${ceiling.key}=${JSON.stringify(ceiling.toWire())}`;
+    return `${pyStr(wireKeyOf(ceiling))}=${pyRepr(ceiling.toWire())}`;
 }
 /**
  * A ceiling's key as the wire carried it, which is what a finding names. A ceiling this build does
@@ -70,16 +175,22 @@ export function wireKeyOf(ceiling) {
  * printed through `shown` (display.ts), so the finding stays on one line.
  *
  * `describe` itself is left alone, so dashboards and `Authority.describe()` print a region called
- * "São Paulo" as it is, and for values in the bare set the two agree character for character. A
- * ceiling this build does not define prints the Python implementation's description of it — its key,
- * `=`, and the wire object as Python prints a dict — as it is when that is printable ASCII, spaces
- * included, and as escaped JSON otherwise. Same text as the Python implementation's finding.
+ * "São Paulo" as it is, and for values in the bare set the two agree character for character, except
+ * that an allow-list's or a deny-list's string members are printed in their escaped JSON form, quoted,
+ * so the string "1" and the number 1 read differently. A ceiling this build does not define prints the
+ * Python implementation's description of it — its key, `=`, and the wire object as Python prints a
+ * dict — as it is when that is printable ASCII, spaces included, and as escaped JSON otherwise. Same
+ * text as the Python implementation's finding.
  */
 export function describeInFinding(ceiling) {
     // A bound the wire supplied: a number prints as `describe` prints it; anything else is shown.
     const bound = (v) => (typeof v === "number" ? pyNumber(v) : shown(v));
-    const members = (values) => sortByStr(values)
-        .map((v) => shownText(strOf(v), v))
+    // The typed members in wire order, as `describe` lists them, except that a string member is printed
+    // in its escaped JSON form, quoted, so a finding tells the string "1" from the number 1
+    // (attenu-ops#110). That form is ASCII, the Python implementation's on every Python version; its
+    // repr printed a printable non-ASCII character as it is. Every other member's text is bare.
+    const members = (values) => inWireOrder(values)
+        .map((v) => (typeof v === "string" ? escaped(v) : shownText(strOf(v), v)))
         .join(", ");
     // By exact class, as the Python implementation matches by exact type: a subclass of a built-in
     // describes itself, and is printed the way any other ceiling this build does not define is.
@@ -98,8 +209,7 @@ export function describeInFinding(ceiling) {
         return `${shown(ceiling.key)} not in [${members(ceiling.notOneOf)}]`;
     if (kind === Prefix)
         return `${shown(ceiling.key)} startswith ${shown(ceiling.prefix)}`;
-    const key = wireKeyOf(ceiling);
-    const text = typeof ceiling.describe === "function" ? ceiling.describe() : `${pyStr(key)}=${pyRepr(ceiling.toWire())}`;
+    const text = describe(ceiling);
     return /^[ -~]*$/.test(text) ? text : escaped(text);
 }
 /**
@@ -111,8 +221,136 @@ export function describeInFinding(ceiling) {
 export function isMetered(ceiling) {
     return Boolean(ceiling.metered) || String(ceiling.key).startsWith("max_");
 }
+/**
+ * What a refusal calls a `one_of` / `not_one_of` that is not a list of members, or `null` for one
+ * that is: a JSON array, or in-process any other iterable of members (a Set).
+ *
+ * The draft defines both as an array. null used to become the empty list, a string its
+ * characters, and an object threw a TypeError in its own words; an absent list read as an empty
+ * one, so an absent deny-list bounded nothing. Each is malformed now, as in the Python
+ * implementation: a token carrying one is refused as malformed, and a bundle reports the authority
+ * unreadable.
+ */
+function notAnArray(values) {
+    if (values === undefined)
+        return "absent";
+    if (values === null)
+        return "null";
+    if (typeof values === "boolean")
+        return "a boolean";
+    if (typeof values === "number")
+        return "a number";
+    if (typeof values === "string")
+        return "a string";
+    if (Array.isArray(values))
+        return null;
+    if (values instanceof Map)
+        return "an object";
+    if (typeof values === "object" && typeof values[Symbol.iterator] === "function")
+        return null;
+    if (typeof values === "object")
+        return "an object";
+    return "a value that is not an array";
+}
+/**
+ * `values` as the members of an `Allow` or a `Deny`, a number `parseJson` read as the number it
+ * holds. Throws a TypeError naming the list and the key when `values` is not a list of members
+ * (`notAnArray`); the Python implementation raises ValueError with the same text.
+ */
+function memberList(key, listName, values) {
+    const kind = notAnArray(values);
+    if (kind !== null)
+        throw new TypeError(`${listName} of constraint ${pyRepr(key)} is ${kind}, not an array`);
+    return Array.from(values, (v) => plain(v));
+}
+/**
+ * The context's own value for `field`, or `undefined`. A plain object inherits `constructor`,
+ * `toString` and the rest from Object.prototype, and a field named like one of them is absent unless
+ * the context holds it, as `ctx.get(field)` reads it in the Python implementation.
+ */
+export function ownValue(ctx, field) {
+    return Object.prototype.hasOwnProperty.call(ctx, field) ? ctx[field] : undefined;
+}
+/**
+ * Where two members print alike ("1" and 1), JSON type decides their order: null, boolean, number,
+ * string, then anything else.
+ */
+function kindRank(value) {
+    if (value === null)
+        return 0;
+    if (typeof value === "boolean")
+        return 1;
+    if (typeof value === "number")
+        return 2;
+    if (typeof value === "string")
+        return 3;
+    return 4;
+}
+/**
+ * `values` as the wire form, a denial's `limit` and `describe()` list them: sorted by `strOf`, then
+ * by JSON type (`kindRank`). That is a total order on distinct members, so an equal member set
+ * re-emits the same bytes whatever order it arrived in, in both implementations; ties used to keep
+ * their arrival order.
+ */
 function sortByStr(values) {
-    return Array.from(values).sort((a, b) => compareCodePoints(strOf(a), strOf(b)));
+    return Array.from(values).sort((a, b) => compareCodePoints(strOf(a), strOf(b)) || kindRank(a) - kindRank(b));
+}
+/**
+ * The members of an `Allow` or a `Deny`: a set that cannot change once built, as the Python
+ * implementation's member set has no mutators. `add`, `delete` and `clear` throw a TypeError, and the
+ * members live in a private Set no Set method can reach, so the wire order computed once
+ * (`inWireOrder`) cannot go stale: a plain Set a caller could still add to let `permits()` decide by
+ * members the wire did not list (attenu-ops#110).
+ */
+class Members {
+    #values;
+    constructor(values) {
+        this.#values = new Set(values);
+    }
+    get size() {
+        return this.#values.size;
+    }
+    has(value) {
+        return this.#values.has(value);
+    }
+    forEach(callback, thisArg) {
+        this.#values.forEach((value) => callback.call(thisArg, value, value, this));
+    }
+    entries() {
+        return this.#values.entries();
+    }
+    keys() {
+        return this.#values.keys();
+    }
+    values() {
+        return this.#values.values();
+    }
+    [Symbol.iterator]() {
+        return this.#values.values();
+    }
+    add(_value) {
+        throw new TypeError("the members of an allow-list or a deny-list are read-only");
+    }
+    delete(_value) {
+        throw new TypeError("the members of an allow-list or a deny-list are read-only");
+    }
+    clear() {
+        throw new TypeError("the members of an allow-list or a deny-list are read-only");
+    }
+}
+/**
+ * The wire order (`sortByStr`) of an `Allow`'s or a `Deny`'s members, computed once per member set: a
+ * denial, `toWire()` and `describe()` each sorted the whole set again. The members cannot change
+ * (`Members`); each caller gets its own copy of the order.
+ */
+const wireOrders = new WeakMap();
+function inWireOrder(members) {
+    let order = wireOrders.get(members);
+    if (order === undefined) {
+        order = sortByStr(members);
+        wireOrders.set(members, order);
+    }
+    return [...order];
 }
 function strOf(value) {
     if (typeof value === "number")
@@ -131,21 +369,26 @@ function strOf(value) {
 // =========================================================================
 /** Per-call cap on rows read or returned. Context field: "rows". */
 export class RowLimit {
-    maxRows;
     key = "max_rows";
     ctxField = "rows";
+    maxRows;
     constructor(maxRows) {
-        this.maxRows = maxRows;
-        validateSafeNumber("max_rows", maxRows);
+        checkMax("max_rows", maxRows);
+        this.maxRows = plain(maxRows);
+        validateSafeNumber("max_rows", this.maxRows);
     }
     permits(ctx) {
-        const n = ctx["rows"];
-        if (n === undefined || n === null || n <= this.maxRows)
+        const n = ownValue(ctx, "rows");
+        if (n === undefined || n === null)
+            return Decision.allow();
+        const kind = wrongKind(n, NUMBER);
+        if (kind === null && plain(n) <= this.maxRows)
             return Decision.allow();
         return Decision.deny(new Reason(ReasonCode.CEILING_EXCEEDED, {
             constraint: this.key,
             limit: this.maxRows,
             requested: n,
+            message: refusal(kind, "a maximum"),
         }));
     }
     describe() {
@@ -155,7 +398,7 @@ export class RowLimit {
         return new RowLimit(Math.min(this.maxRows, other.maxRows));
     }
     subsumes(other) {
-        return this.maxRows >= other.maxRows;
+        return sameType(this, other) && this.maxRows >= other.maxRows;
     }
     toWire() {
         return { key: this.key, max: this.maxRows };
@@ -166,21 +409,26 @@ export class RowLimit {
 }
 /** Per-call cap on spend, currency-agnostic. Context field: "spend". */
 export class SpendCap {
-    maxSpend;
     key = "max_spend";
     ctxField = "spend";
+    maxSpend;
     constructor(maxSpend) {
-        this.maxSpend = maxSpend;
-        validateSafeNumber("max_spend", maxSpend);
+        checkMax("max_spend", maxSpend);
+        this.maxSpend = plain(maxSpend);
+        validateSafeNumber("max_spend", this.maxSpend);
     }
     permits(ctx) {
-        const n = ctx["spend"];
-        if (n === undefined || n === null || n <= this.maxSpend)
+        const n = ownValue(ctx, "spend");
+        if (n === undefined || n === null)
+            return Decision.allow();
+        const kind = wrongKind(n, NUMBER);
+        if (kind === null && plain(n) <= this.maxSpend)
             return Decision.allow();
         return Decision.deny(new Reason(ReasonCode.CEILING_EXCEEDED, {
             constraint: this.key,
             limit: this.maxSpend,
             requested: n,
+            message: refusal(kind, "a maximum"),
         }));
     }
     describe() {
@@ -190,7 +438,7 @@ export class SpendCap {
         return new SpendCap(Math.min(this.maxSpend, other.maxSpend));
     }
     subsumes(other) {
-        return this.maxSpend >= other.maxSpend;
+        return sameType(this, other) && this.maxSpend >= other.maxSpend;
     }
     toWire() {
         return { key: this.key, max: this.maxSpend };
@@ -212,15 +460,22 @@ export class SpendCap {
  * does not; an explicit `calls` in the context still wins.
  */
 export class CallLimit {
-    maxCalls;
     appliesTo;
     key;
     ctxField;
+    maxCalls;
     constructor(maxCalls, appliesTo = null) {
-        this.maxCalls = maxCalls;
         this.appliesTo = appliesTo;
-        validateSafeNumber("max_calls", maxCalls);
+        checkString("max_calls", "applies_to", appliesTo, true);
+        // A pattern no scope matches ("*", "crm", "CRM.READ") applied to no call, so the limit bounded
+        // nothing. It follows the scope grammar: an exact scope, or a terminal `.*` wildcard.
+        if (appliesTo !== null && appliesTo !== undefined && !SCOPE_RE.test(appliesTo)) {
+            throw malformed("max_calls", "applies_to", appliesTo, "a scope", pyRepr(appliesTo));
+        }
         this.key = appliesTo ? `max_calls[${appliesTo}]` : "max_calls";
+        checkMax(this.key, maxCalls);
+        this.maxCalls = plain(maxCalls);
+        validateSafeNumber("max_calls", this.maxCalls);
         this.ctxField = appliesTo ? `calls[${appliesTo}]` : "calls";
     }
     /** What this ceiling counts: the pattern it applies to, or every call. */
@@ -234,15 +489,19 @@ export class CallLimit {
         return held === scope || (held.endsWith(".*") && String(scope).startsWith(held.slice(0, -1)));
     }
     permits(ctx) {
-        if (!this.appliesToScope(ctx["_scope"]))
+        if (!this.appliesToScope(ownValue(ctx, "_scope")))
             return Decision.allow();
-        const n = ctx[this.ctxField];
-        if (n === undefined || n === null || n <= this.maxCalls)
+        const n = ownValue(ctx, this.ctxField);
+        if (n === undefined || n === null)
+            return Decision.allow();
+        const kind = wrongKind(n, NUMBER);
+        if (kind === null && plain(n) <= this.maxCalls)
             return Decision.allow();
         return Decision.deny(new Reason(ReasonCode.CEILING_EXCEEDED, {
             constraint: this.key,
             limit: this.maxCalls,
             requested: n,
+            message: refusal(kind, "a maximum"),
         }));
     }
     describe() {
@@ -252,7 +511,7 @@ export class CallLimit {
         return new CallLimit(Math.min(this.maxCalls, other.maxCalls), this.appliesTo);
     }
     subsumes(other) {
-        return this.maxCalls >= other.maxCalls;
+        return sameType(this, other) && this.maxCalls >= other.maxCalls;
     }
     toWire() {
         if (!this.appliesTo)
@@ -270,16 +529,23 @@ export class EgressRank {
     ctxField = "egress";
     constructor(level) {
         this.level = level;
+        // A rank outside the vocabulary ranked above "any", so the ceiling admitted every request.
+        if (typeof level !== "string" || !EGRESS_ORDER.includes(level)) {
+            throw malformed("egress", "rank", level, "'none', 'internal' or 'any'", typeof level === "string" ? pyRepr(level) : undefined);
+        }
     }
     permits(ctx) {
-        const val = ctx["egress"];
-        if (val === undefined || val === null || egressRankOf(val) <= egressRankOf(this.level)) {
+        const val = ownValue(ctx, "egress");
+        if (val === undefined || val === null)
+            return Decision.allow();
+        const kind = wrongKind(val, STRING);
+        if (kind === null && egressRankOf(val) <= egressRankOf(this.level))
             return Decision.allow();
-        }
         return Decision.deny(new Reason(ReasonCode.CEILING_EXCEEDED, {
             constraint: this.key,
             limit: this.level,
             requested: val,
+            message: refusal(kind, "an egress rank"),
         }));
     }
     describe() {
@@ -290,7 +556,7 @@ export class EgressRank {
         return new EgressRank(egressRankOf(this.level) <= egressRankOf(o.level) ? this.level : o.level);
     }
     subsumes(other) {
-        return egressRankOf(this.level) >= egressRankOf(other.level);
+        return sameType(this, other) && egressRankOf(this.level) >= egressRankOf(other.level);
     }
     toWire() {
         return { key: this.key, rank: this.level };
@@ -304,7 +570,11 @@ export class EgressRank {
 // `key` here IS a caller choice, so it cannot double as the wire discriminator;
 // these carry an explicit "type" on the wire.
 // =========================================================================
-/** Membership allow-list: the context value MUST be one of `oneOf`. */
+/**
+ * Membership allow-list: the context value MUST be one of `oneOf`. A member is its JSON type plus
+ * its value, as a Set holds it: `[1]` admits 1 and refuses `true` and `"1"`. A context value that
+ * is not a JSON scalar is refused (`wrongKind`).
+ */
 export class Allow {
     key;
     field;
@@ -312,42 +582,54 @@ export class Allow {
     constructor(key, oneOf, field = null) {
         this.key = key;
         this.field = field;
-        this.oneOf = new Set(oneOf);
+        checkKey(key);
+        this.oneOf = new Members(memberList(key, "one_of", oneOf));
+        checkString(key, "field", field, true);
     }
     ctxKey() {
         return this.field ?? this.key;
     }
     permits(ctx) {
-        const val = ctx[this.ctxKey()];
-        if (val === undefined || val === null || this.oneOf.has(val))
+        const val = ownValue(ctx, this.ctxKey());
+        if (val === undefined || val === null)
+            return Decision.allow();
+        const kind = wrongKind(val, SCALAR);
+        if (kind === null && this.oneOf.has(plain(val)))
             return Decision.allow();
         return Decision.deny(new Reason(ReasonCode.CEILING_EXCEEDED, {
             constraint: this.key,
-            limit: sortByStr(this.oneOf),
+            limit: inWireOrder(this.oneOf),
             requested: val,
+            message: refusal(kind, "one_of members"),
         }));
     }
     describe() {
-        return `${this.key} in [${sortByStr(this.oneOf).map(strOf).join(", ")}]`;
+        return `${this.key} in [${inWireOrder(this.oneOf).map(strOf).join(", ")}]`;
     }
     narrow(other) {
         const o = other;
         return new Allow(this.key, Array.from(this.oneOf).filter((v) => o.oneOf.has(v)), this.field);
     }
     subsumes(other) {
-        return Array.from(other.oneOf).every((v) => this.oneOf.has(v));
+        return sameType(this, other) && Array.from(other.oneOf).every((v) => this.oneOf.has(v));
     }
     toWire() {
-        const d = { key: this.key, type: "allow", one_of: sortByStr(this.oneOf) };
+        const d = { key: this.key, type: "allow", one_of: inWireOrder(this.oneOf) };
         if (this.field !== null && this.field !== this.key)
             d["field"] = this.field;
         return d;
     }
     static fromWire(d) {
-        return new Allow(d["key"], d["one_of"] ?? [], d["field"] ?? null);
+        // Anything but an array, an absent one_of included, is refused by the constructor.
+        return new Allow(d["key"], d["one_of"], d["field"] ?? null);
     }
 }
-/** Membership deny-list: the context value MUST NOT be one of `notOneOf`. */
+/**
+ * Membership deny-list: the context value MUST NOT be one of `notOneOf`. A member is its JSON type
+ * plus its value, as a Set holds it: `[1]` refuses 1 and not `true` or `"1"`. A context value that
+ * is not a JSON scalar is refused as well (`wrongKind`): a deny-list never waves through a value it
+ * cannot compare, since waving `["rm"]` through because it is not the string "rm" would fail open.
+ */
 export class Deny {
     key;
     field;
@@ -355,23 +637,29 @@ export class Deny {
     constructor(key, notOneOf, field = null) {
         this.key = key;
         this.field = field;
-        this.notOneOf = new Set(notOneOf);
+        checkKey(key);
+        this.notOneOf = new Members(memberList(key, "not_one_of", notOneOf));
+        checkString(key, "field", field, true);
     }
     ctxKey() {
         return this.field ?? this.key;
     }
     permits(ctx) {
-        const val = ctx[this.ctxKey()];
-        if (val === undefined || val === null || !this.notOneOf.has(val))
+        const val = ownValue(ctx, this.ctxKey());
+        if (val === undefined || val === null)
+            return Decision.allow();
+        const kind = wrongKind(val, SCALAR);
+        if (kind === null && !this.notOneOf.has(plain(val)))
             return Decision.allow();
         return Decision.deny(new Reason(ReasonCode.CEILING_EXCEEDED, {
             constraint: this.key,
-            limit: sortByStr(this.notOneOf),
+            limit: inWireOrder(this.notOneOf),
             requested: val,
+            message: refusal(kind, "not_one_of members"),
         }));
     }
     describe() {
-        return `${this.key} not in [${sortByStr(this.notOneOf).map(strOf).join(", ")}]`;
+        return `${this.key} not in [${inWireOrder(this.notOneOf).map(strOf).join(", ")}]`;
     }
     narrow(other) {
         const o = other;
@@ -380,20 +668,21 @@ export class Deny {
     subsumes(other) {
         // `this` admits a superset of `other`'s admitted set iff it forbids a
         // subset of what `other` forbids.
-        return Array.from(this.notOneOf).every((v) => other.notOneOf.has(v));
+        return sameType(this, other) && Array.from(this.notOneOf).every((v) => other.notOneOf.has(v));
     }
     toWire() {
         const d = {
             key: this.key,
             type: "deny",
-            not_one_of: sortByStr(this.notOneOf),
+            not_one_of: inWireOrder(this.notOneOf),
         };
         if (this.field !== null && this.field !== this.key)
             d["field"] = this.field;
         return d;
     }
     static fromWire(d) {
-        return new Deny(d["key"], d["not_one_of"] ?? [], d["field"] ?? null);
+        // Anything but an array, an absent not_one_of included, is refused by the constructor.
+        return new Deny(d["key"], d["not_one_of"], d["field"] ?? null);
     }
 }
 /** String-prefix bound: the context value MUST start with `prefix`. */
@@ -405,19 +694,25 @@ export class Prefix {
         this.key = key;
         this.prefix = prefix;
         this.field = field;
+        checkKey(key);
+        checkString(key, "prefix", prefix);
+        checkString(key, "field", field, true);
     }
     ctxKey() {
         return this.field ?? this.key;
     }
     permits(ctx) {
-        const val = ctx[this.ctxKey()];
-        if (val === undefined || val === null || String(val).startsWith(this.prefix)) {
+        const val = ownValue(ctx, this.ctxKey());
+        if (val === undefined || val === null)
+            return Decision.allow();
+        const kind = wrongKind(val, STRING);
+        if (kind === null && val.startsWith(this.prefix))
             return Decision.allow();
-        }
         return Decision.deny(new Reason(ReasonCode.CEILING_EXCEEDED, {
             constraint: this.key,
             limit: this.prefix,
             requested: val,
+            message: refusal(kind, "a prefix"),
         }));
     }
     describe() {
@@ -439,7 +734,7 @@ export class Prefix {
         return new Prefix(this.key, `${this.prefix}\u0000${o.prefix}`, this.field);
     }
     subsumes(other) {
-        return other.prefix.startsWith(this.prefix);
+        return sameType(this, other) && other.prefix.startsWith(this.prefix);
     }
     toWire() {
         const d = { key: this.key, type: "prefix", prefix: this.prefix };
@@ -464,10 +759,15 @@ export function registerCeiling(key, cls) {
  * Fail-closed placeholder for a wire constraint this build does not recognise.
  *
  * `permits` always denies. `narrow` stays an unknown ceiling, so it can never
- * resolve to something more permissive than "deny everything". `subsumes` is
+ * resolve to something more permissive than "deny everything"; `Authority.meet`
+ * keeps a parent's against a request of any other type, so the child inherits
+ * it. `subsumes` is
  * true only against an identical unknown ceiling — just enough reflexivity for
- * `isNarrowerThan(self)`. `toWire` preserves the original bytes losslessly, so
- * a chain that merely forwards constraints can still do so.
+ * `isNarrowerThan(self)`. Identical means the same RFC 8785 bytes, which is
+ * equality as JSON: `true` is not 1, `1.0` is 1, and key order is no difference
+ * at any depth; a value RFC 8785 cannot write is identical to nothing. `toWire`
+ * preserves the original bytes losslessly, so a chain that merely forwards
+ * constraints can still do so.
  */
 export class UnknownCeiling {
     raw;
@@ -477,17 +777,28 @@ export class UnknownCeiling {
         this.key = key === null || key === undefined ? "" : String(key);
     }
     permits(_ctx) {
+        // In the Python implementation's words, and with the key as the wire carried it (null, a
+        // number), so a deny entry is the same bytes from both implementations.
+        const key = wireKeyOf(this);
         return Decision.deny(new Reason(ReasonCode.UNKNOWN_CONSTRAINT, {
-            constraint: this.key,
-            message: `unrecognised constraint type for key=${JSON.stringify(this.key)}; fail-closed`,
+            constraint: key,
+            message: `unrecognised constraint type for key=${pyRepr(key)}; fail-closed`,
         }));
     }
     narrow(_other) {
         return this;
     }
     subsumes(other) {
-        return (other instanceof UnknownCeiling &&
-            JSON.stringify(canonicalPairs(other.raw)) === JSON.stringify(canonicalPairs(this.raw)));
+        // Compared as RFC 8785 bytes, as the Python implementation compares them. JSON text with only
+        // the top-level keys sorted told `{"v":{"a":1,"b":2}}` from `{"v":{"b":2,"a":1}}` (attenu-ops#110).
+        if (!(other instanceof UnknownCeiling))
+            return false;
+        try {
+            return canonicalJson(other.raw) === canonicalJson(this.raw);
+        }
+        catch {
+            return false;
+        }
     }
     toWire() {
         return { ...this.raw };
@@ -496,19 +807,28 @@ export class UnknownCeiling {
         return new UnknownCeiling(d["key"] ?? null, { ...d });
     }
 }
-function canonicalPairs(d) {
-    return Object.keys(d)
-        .sort(compareCodePoints)
-        .map((k) => [k, d[k]]);
-}
 /**
  * Reconstruct a Ceiling from its wire form. Routes on "type" when present (it
  * disambiguates the generic ceilings), else on "key". An unrecognised
  * discriminator fails closed via `UnknownCeiling`.
+ *
+ * A constraint is a JSON object with a string `key`, and a `type` that, when present, is a string;
+ * anything else is malformed (attenu-ops#110), in the Python implementation's words too: `a
+ * constraint is a string, not an object`, `type of constraint 'max_rows' is null, not a string`.
+ * A constraint that is not an object loaded as an unknown constraint here, null aside, and a null
+ * `type` was read as absent, so the constraint was routed by its key: `{"key": "allow", "type":
+ * null, ...}` loaded as an allow-list, where the Python implementation loaded an unknown constraint.
  */
 export function ceilingFromWire(wire) {
     const d = toPlain(wire);
-    const discriminator = d["type"] ?? d["key"];
+    if (d === null || typeof d !== "object" || Array.isArray(d)) {
+        throw new TypeError(`a constraint is ${jsonKind(d)}, not an object`);
+    }
+    checkKey(d["key"]);
+    const type = d["type"];
+    if (type !== undefined && typeof type !== "string")
+        throw malformed(d["key"], "type", type, "a string");
+    const discriminator = type ?? d["key"];
     const cls = typeof discriminator === "string" ? REGISTRY.get(discriminator) : undefined;
     if (cls === undefined)
         return UnknownCeiling.fromWire(d);