fix(core): freeze cached normalized scopes (local ticket 06)

.changeset/frozen-normalized-scopes.md

@@ -0,0 +1,5 @@
+---
+"@okyrychenko-dev/react-action-guard": patch
+---
+
+Freeze normalized scope arrays so JavaScript mutation cannot corrupt cached results shared by other consumers. Stable identity, sorting, deduplication, default and empty scope semantics, and bounded cache eviction are preserved.

packages/core/src/store/__tests__/scope.test.ts

@@ -20,6 +20,17 @@ describe("scope", () => {
     it("should return the canonical scope list", () => {
       expect(normalizeScope(scope)).toEqual(expected);
     });
+
+    it("should protect cached scopes from JavaScript mutation", () => {
+      const normalized = normalizeScope(scope);
+
+      expect(Reflect.set(normalized, "0", "poisoned")).toBe(false);
+      expect(Reflect.set(normalized, "length", 0)).toBe(false);
+      expect(() => Array.prototype.push.call(normalized, "poisoned")).toThrow(TypeError);
+      expect(Object.isFrozen(normalized)).toBe(true);
+      expect(normalizeScope(scope)).toBe(normalized);
+      expect(normalizeScope(scope)).toEqual(expected);
+    });
   });
 
   it("should reuse the canonical list for equivalent scopes", () => {

packages/core/src/store/scope/scope.utils.ts

@@ -34,7 +34,7 @@ function evictOldestNormalizedScopeCacheEntry(): void {
 }
 
 function getCachedNormalizedScope(scopes: ReadonlyArray<string>): ReadonlyArray<string> {
-  const normalizedScope = [...new Set(scopes)].sort();
+  const normalizedScope = Object.freeze([...new Set(scopes)].sort());
   const cacheKey = getNormalizedScopeCacheKey(normalizedScope);
   const cachedScope = normalizedScopeCache.get(cacheKey);
 
@@ -52,7 +52,7 @@ function getCachedNormalizedScope(scopes: ReadonlyArray<string>): ReadonlyArray<
 }
 
 /**
- * Returns a stable, deduplicated, sorted scope list.
+ * Returns a frozen, stable, deduplicated, sorted scope list.
  * An omitted scope means global; an empty list remains empty.
  */
 export function normalizeScope(scope?: Scope): ReadonlyArray<string> {