permdock 0.3.1 → 0.5.0

package/dist/create-DnrmLnLW.js

@@ -0,0 +1,323 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as problemDetails } from "./problem-details-cn5X30gZ.js";
+import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
+import { c as withApp, i as challengeScope } from "./permdock-B9JxkBwC.js";
+import { r as hasCredentials } from "./http-BBoKefeS.js";
+import { i as decisionResponse, o as notFoundProblem, s as problemFromDecision, t as ANONYMOUS, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
+import { n as resolveOrNull } from "./build-instance-BMnAudHn.js";
+import { n as applyApprovalResume, o as evaluationsHandler, u as InvalidSignatureError } from "./evaluations-DZ2CbV5k.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-CRhqyzCk.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-BTRTG7OT.js";
+//#region src/server/kernel-problems.ts
+const NOT_DELEGATED = freezeDeep({
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "not-delegated"
+	}],
+	alternatives: []
+});
+const LOAD_FAILED = freezeDeep({
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "validation"
+	}],
+	alternatives: []
+});
+/** The `403` for a loader that threw: the check fails closed, as on MCP. */
+function loadFailedProblem(permission) {
+	const key = permission?.key ?? "the route";
+	return decisionResponse(problemDetails(compact({
+		decision: LOAD_FAILED,
+		detail: `${key} failed closed: the row could not be loaded`,
+		permission: permission?.key
+	})), LOAD_FAILED);
+}
+/** The `403` `insufficient_scope` for a token that holds none of a route's OAuth scopes. */
+function scopeProblem(permission, subject, credentials, scope) {
+	return permission === null ? decisionResponse(problemDetails(compact({
+		decision: NOT_DELEGATED,
+		detail: `the token holds none of the OAuth scopes this route needs, such as ${String(scope)}`,
+		scope
+	})), NOT_DELEGATED, compact({
+		credentials,
+		scope
+	})) : problemFromDecision(NOT_DELEGATED, permission, subject, compact({
+		credentials,
+		scope
+	}));
+}
+function problemFor(decision, init, approval) {
+	if (init?.permission !== void 0) return problemFromDecision(decision, init.permission, void 0, compact({
+		instance: init.instance,
+		approval
+	}));
+	if (decision.outcome === "granted") return new Response(null, { status: 204 });
+	return decisionResponse(problemDetails(compact({
+		decision,
+		detail: decision.outcome,
+		instance: init?.instance
+	})), decision);
+}
+//#endregion
+//#region src/server/route-guard.ts
+function routeScopes(value) {
+	if (value === void 0) return;
+	const scopes = Array.isArray(value) ? value : [];
+	const names = scopes.filter((scope) => typeof scope === "string" && scope !== "");
+	if (names.length === 0 || names.length !== scopes.length) throw new TypeError("PermDock: oauthScopes must be a non-empty list of scope names");
+	return names;
+}
+async function refused(hook, fallback, decision, request, report) {
+	if (hook === void 0) return {
+		ok: false,
+		response: fallback,
+		decision
+	};
+	try {
+		const result = await hook({
+			decision,
+			problem: await fallback.clone().json(),
+			request
+		});
+		if (result === void 0) return {
+			ok: false,
+			response: fallback,
+			decision
+		};
+		const status = result.status;
+		if (typeof status !== "number" || status < 300) throw new TypeError(`PermDock: deniedResponse returned status ${String(status)}; a refusal keeps a status of 300 or more`);
+		return {
+			ok: false,
+			response: result instanceof Response ? result : new Response(JSON.stringify(result), {
+				status,
+				headers: fallback.headers
+			}),
+			decision
+		};
+	} catch (error) {
+		report(error);
+		return {
+			ok: false,
+			response: fallback,
+			decision
+		};
+	}
+}
+async function guardOn(deps, instance, remote, report, request, permission, load, protectOptions) {
+	const declared = routeScopes(protectOptions.oauthScopes ?? (request === void 0 ? void 0 : deps.options.operations?.oauthScopesForRequest(request.method, new URL(request.url).pathname)));
+	const credentials = request === void 0 ? false : hasCredentials(request);
+	if (permission === null) {
+		if (declared === void 0) throw new TypeError(request === void 0 ? "PermDock: protect(null) needs oauthScopes" : `PermDock: protect(null) needs oauthScopes, and no operation declares them for ${request.method} ${new URL(request.url).pathname}`);
+		if (instance.subject.principal === null) return refused(deps.options.deniedResponse, unauthenticatedProblem(credentials), ANONYMOUS, request, report);
+	}
+	const { actor, delegation } = instance.subject;
+	const held = permission === null && (actor !== void 0 || delegation !== void 0) ? delegation?.scopes ?? [] : delegation?.scopes;
+	if (declared !== void 0 && held !== void 0 && !declared.some((granted) => held.includes(granted))) return refused(deps.options.deniedResponse, scopeProblem(permission, instance.subject, credentials, declared[0]), NOT_DELEGATED, request, report);
+	let data;
+	if (load !== void 0) {
+		let loaded;
+		try {
+			loaded = await load();
+		} catch (error) {
+			report(error);
+			return refused(deps.options.deniedResponse, loadFailedProblem(permission), LOAD_FAILED, request, report);
+		}
+		if (loaded === null || loaded === void 0) return {
+			ok: false,
+			response: notFoundProblem()
+		};
+		data = loaded;
+	}
+	if (permission === null) return {
+		ok: true,
+		permdock: instance,
+		data
+	};
+	const decideOptions = compact({
+		call: "adapter",
+		adapter: deps.adapter,
+		field: protectOptions.field,
+		explain: protectOptions.explain,
+		...protectOptions.trusted === true ? { trusted: true } : {
+			trusted: false,
+			boundary: "http-body"
+		}
+	});
+	const raw = remote === void 0 ? instance.decide(permission, data, decideOptions) : await remote.decide(permission, data, decideOptions).catch(() => ({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "pdp-unavailable"
+		}],
+		alternatives: []
+	}));
+	const decision = await applyApprovalResume(raw, permission, instance, deps.options.store, request, resourceRef(permission, data), deps.adapter);
+	if (decision.outcome === "granted") return {
+		ok: true,
+		permdock: instance,
+		decision,
+		data
+	};
+	return refused(deps.options.deniedResponse, problemFromDecision(decision, permission, instance.subject, compact({
+		approval: deps.options.approval,
+		credentials,
+		scope: declared?.[0] ?? challengeScope(deps.policy, permission),
+		disclosure: data === void 0 ? void 0 : deps.policy.resources.get(permission.resource)?.disclosure
+	})), decision, request, report);
+}
+//#endregion
+//#region src/server/create.ts
+async function resolveActor(request, options) {
+	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth.verify(request)) ?? actorFrom(options.actor, request);
+}
+const NO_TENANT = "\0";
+/**
+* The Fetch factory behind every HTTP adapter. The subject and actor are
+* resolved once per `Request`; one instance is cached per `(Request, tenant)`,
+* so a global middleware and a later tenant-scoped `protect` never share a
+* tenant.
+*/
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
+	const adapter = options.adapter ?? "server";
+	const subjects = /* @__PURE__ */ new WeakMap();
+	const instances = /* @__PURE__ */ new WeakMap();
+	const freshSubject = async (request) => {
+		const actor = await resolveActor(request, options);
+		const errors = [];
+		const context = await requestContext(options.context, request, errors);
+		return {
+			user: await resolveOrNull(() => options.subject(request)),
+			actor,
+			context,
+			errors
+		};
+	};
+	const resolveSubject = (request) => {
+		const hit = subjects.get(request);
+		if (hit !== void 0) return hit;
+		const resolved = freshSubject(request);
+		subjects.set(request, resolved);
+		return resolved;
+	};
+	const reporters = /* @__PURE__ */ new WeakMap();
+	const instanceFor = async ({ user, actor, context, errors }, tenant) => {
+		const built = await buildReportingInstance({
+			policy,
+			user,
+			sources: options,
+			scope: {
+				tenant,
+				actor,
+				context
+			},
+			errors,
+			wrap: (created) => options.wrap === void 0 ? created : options.wrap(created)
+		});
+		const remote = options.pdp === void 0 ? void 0 : await options.pdp(policy, user, built.options);
+		reporters.set(built.permdock, built.report);
+		return {
+			permdock: built.permdock,
+			remote,
+			report: built.report
+		};
+	};
+	const build = async (request, scope) => {
+		const { tenant } = scope ?? await tenantScope(options.tenant, request);
+		let byTenant = instances.get(request);
+		if (byTenant === void 0) {
+			byTenant = /* @__PURE__ */ new Map();
+			instances.set(request, byTenant);
+		}
+		const key = tenant ?? NO_TENANT;
+		const hit = byTenant.get(key);
+		if (hit !== void 0) return hit;
+		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
+		byTenant.set(key, built);
+		return built;
+	};
+	const connection = async (request, connectionOptions = {}, scope) => {
+		const { tenant } = scope ?? await tenantScope(options.tenant, request);
+		const { openConnection } = await import("./connection-DjhIJSs2.js");
+		return openConnection({
+			open: async () => (await build(request, { tenant })).permdock,
+			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
+			tenant,
+			...options.revocations === void 0 ? {} : { feed: options.revocations },
+			adapter,
+			options: connectionOptions
+		});
+	};
+	const getPermDock = async (request, scope) => (await build(request, scope)).permdock;
+	const getSnapshot = async (request, query = {}) => {
+		return (await getPermDock(request, query.tenant === void 0 ? void 0 : { tenant: query.tenant })).snapshot(compact({
+			include: query.include,
+			tenants: query.tenants
+		}));
+	};
+	const deps = {
+		policy,
+		options,
+		adapter
+	};
+	const protectRoute = (permission, data, protectOptions = {}) => {
+		if (permission === null && routeScopes(protectOptions.oauthScopes) === void 0 && options.operations === void 0) throw new TypeError("PermDock: protect(null) needs oauthScopes, in its options or an operations entry");
+		return async (request, scope) => {
+			let instance;
+			let remote;
+			let report;
+			try {
+				({permdock: instance, remote, report} = await build(request, scope));
+			} catch (error) {
+				if (error instanceof InvalidSignatureError) return {
+					ok: false,
+					response: error.response
+				};
+				throw error;
+			}
+			return guardOn(deps, instance, remote, report, request, permission, data === void 0 ? void 0 : () => data(request), protectOptions);
+		};
+	};
+	const protect = protectRoute;
+	const openapi = {
+		security: (permission) => ({
+			security: [{ oauth2: [permission.scope] }],
+			"x-permdock-permissions": [permission.key]
+		}),
+		securitySchemes: () => {
+			const scopes = {};
+			for (const leaf of listPermissions(policy.permissions)) scopes[leaf.scope] = leaf.meta.title ?? leaf.key;
+			return { oauth2: {
+				type: "oauth2",
+				flows: {},
+				scopes
+			} };
+		}
+	};
+	const permdockHandler = (scope) => evaluationsHandler(compact({
+		policy,
+		resolve: scope === void 0 ? getPermDock : async (request) => getPermDock(request, await scope(request)),
+		store: options.store,
+		adapter
+	}));
+	return {
+		getPermDock,
+		getSnapshot,
+		protect,
+		protectOn: (instance, permission, load, protectOptions = {}, request) => guardOn(deps, instance, void 0, reporters.get(instance) ?? (() => void 0), request, permission, load, protectOptions),
+		connection,
+		shareSubject: (from, to) => {
+			const resolved = subjects.get(from);
+			if (resolved !== void 0 && !subjects.has(to)) subjects.set(to, resolved);
+		},
+		problem: (decision, init) => problemFor(decision, init, options.approval),
+		openapi,
+		permdockHandler
+	};
+}
+//#endregion
+export { createPermDock as t };

package/dist/{credential-8P81ff4u.js → credential-DM2um3ha.js}

@@ -1,11 +1,20 @@
-import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
+import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { _ as listPermissions, a as formerKeys } from "./permissions-DVoF6dMt.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
-import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { a as ownRecord, n as idList, r as isId } from "./capability-4qPdO9gk.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/credential.ts
+/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+function isFeedId(value) {
+	return /^[a-z0-9-]{1,16}$/u.test(value);
+}
 const MAX_NAME = 256;
 function policies(policy) {
 	return isReadonlyArray(policy) ? policy : [policy];
@@ -18,10 +27,14 @@ function policies(policy) {
 function credentialPolicyViolation(credential, policy) {
 	const list = policies(policy);
 	for (const item of list) if (item.kinds !== void 0 && !item.kinds.includes(credential.kind)) return "kind";
-	if (credential.expiresAt === void 0) return list.some((item) => item.allowNoExpiry === true) && list.every((item) => item.maxTtl === void 0) ? void 0 : "no-expiry";
+	if (credential.expiresAt === void 0) {
+		if (credential.kind === "feed") return;
+		return list.some((item) => item.allowNoExpiry === true) && list.every((item) => item.maxTtl === void 0) ? void 0 : "no-expiry";
+	}
+	const lifetime = (secondsOf(credential.expiresAt) ?? NaN) - (secondsOf(credential.createdAt) ?? NaN);
 	for (const item of list) {
 		const max = item.maxTtl;
-		if (max !== void 0 && (typeof max !== "number" || !Number.isFinite(max) || max < 0 || credential.expiresAt - credential.createdAt > max)) return "ttl";
+		if (max !== void 0 && (!Number.isSafeInteger(max) || max < 0 || !(lifetime <= max))) return "ttl";
 	}
 }
 function parsePermissions(value) {
@@ -39,9 +52,6 @@ function parsePermissions(value) {
 	}
 	return out;
 }
-function isTime(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
 /**
 * Validates an untrusted credential record and returns a frozen copy with
 * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
@@ -51,19 +61,30 @@ function isTime(value) {
 function parseCredential(input) {
 	const value = ownRecord(input);
 	if (value === void 0 || value["v"] !== 1 || !isId(value["id"])) return;
-	if (value["kind"] !== "user" && value["kind"] !== "service") return;
+	if (value["kind"] !== "user" && value["kind"] !== "service" && value["kind"] !== "feed") return;
 	if (!isId(value["principal"]) || !isId(value["createdBy"])) return;
 	const permissions = parsePermissions(value["permissions"]);
-	if (permissions === void 0 || !isTime(value["createdAt"])) return;
-	if (value["expiresAt"] !== void 0 && !isTime(value["expiresAt"])) return;
+	if (permissions === void 0 || !isRfc3339(value["createdAt"])) return;
+	if (value["expiresAt"] !== void 0 && !isRfc3339(value["expiresAt"])) return;
 	if (value["name"] !== void 0 && (typeof value["name"] !== "string" || value["name"].length > MAX_NAME)) return;
 	let tenant;
 	let roles;
+	let on;
 	if (value["kind"] === "service") {
 		roles = idList(value["roles"]);
-		if (!isId(value["tenant"]) || roles === void 0) return;
+		if (!isId(value["tenant"]) || roles === void 0 || value["on"] !== void 0) return;
 		tenant = value["tenant"];
-	} else if (value["roles"] !== void 0 || value["tenant"] !== void 0 && !isId(value["tenant"])) return;
+	} else if (value["kind"] === "feed") {
+		roles = idList(value["roles"]);
+		const target = ownRecord(value["on"]);
+		if (roles === void 0 || target === void 0 || !isId(target["resource"]) || !isId(target["id"]) || value["principal"] !== value["id"] || !isFeedId(value["id"])) return;
+		if (value["tenant"] !== void 0 && !isId(value["tenant"])) return;
+		tenant = typeof value["tenant"] === "string" ? value["tenant"] : void 0;
+		on = {
+			resource: target["resource"],
+			id: target["id"]
+		};
+	} else if (value["roles"] !== void 0 || value["on"] !== void 0 || value["tenant"] !== void 0 && !isId(value["tenant"])) return;
 	else tenant = value["tenant"];
 	return freezeDeep(compact({
 		v: 1,
@@ -72,6 +93,7 @@ function parseCredential(input) {
 		principal: value["principal"],
 		tenant,
 		roles,
+		on,
 		permissions,
 		createdBy: value["createdBy"],
 		createdAt: value["createdAt"],
@@ -120,7 +142,7 @@ function credentialDelegation(credential, permissions) {
 * owner, passed live as `owner` (roles and memberships as of this request),
 * with the credential's delegation: every check is the owner's rights
 * intersected with the key's. One that names a `tenant` makes it the active
-* tenant, and `createPermDock` then keeps only the owner's memberships
+* tenant, and `getPermDock` then keeps only the owner's memberships
 * inside it and no global role. A `service` credential is a `service`
 * principal whose only membership is `roles` in `tenant`. An owner whose id
 * is not the credential's `principal`, or who is not a user, is anonymous.
@@ -128,7 +150,20 @@ function credentialDelegation(credential, permissions) {
 function credentialSubject(credential, options) {
 	const delegation = credentialDelegation(credential, options.permissions);
 	let principal;
-	if (credential.kind === "user") {
+	if (credential.kind === "feed") {
+		if (credential.on === void 0 || credential.roles === void 0) return anonymousSubject();
+		const membership = compact({
+			on: credential.on,
+			roles: credential.roles,
+			via: "feed"
+		});
+		principal = compact({
+			id: credential.id,
+			kind: "feed",
+			memberships: [membership],
+			credential
+		});
+	} else if (credential.kind === "user") {
 		const owner = options.owner ?? {
 			id: credential.principal,
 			kind: "user"
@@ -158,11 +193,11 @@ function credentialSubject(credential, options) {
 		principal,
 		delegation,
 		context: {},
-		expiresAt: credential.expiresAt
+		expiresAt: secondsOf(credential.expiresAt)
 	}));
 }
 function credentialToken(credential) {
-	const payload = JSON.stringify({
+	const payload = canonicalJson({
 		t: "credential",
 		id: credential.id,
 		kind: credential.kind,
@@ -170,11 +205,12 @@ function credentialToken(credential) {
 		tenant: credential.tenant ?? null,
 		roles: credential.roles ?? null,
 		permissions: credential.permissions,
+		...credential.on === void 0 ? {} : { on: credential.on },
 		createdBy: credential.createdBy,
 		expiresAt: credential.expiresAt ?? null,
 		name: credential.name ?? null
 	});
-	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+	return sha256Digest(payload);
 }
 function denied(reason, detail) {
 	return freezeDeep({
@@ -213,28 +249,90 @@ function refuse(reason, detail) {
 		decision: denied(reason, detail)
 	};
 }
+function oneResource(resource) {
+	const names = new Set(listPermissions(resource).map((leaf) => leaf.resource));
+	const [name] = names;
+	return names.size === 1 && name !== void 0 ? name : void 0;
+}
+function granteeOnResource(to, resource, role) {
+	for (const grant of flattenGrantee(to)) if (grant.kind === "role" && grant.role === role && typeof grant.scope === "object" && grant.scope.resource === resource) return true;
+	return false;
+}
+function roleDeclaredOn(permdock, resource, resourceName, roleName, id, row) {
+	const preview = permdock.simulate({
+		roles: [],
+		memberships: [{
+			on: {
+				resource: resourceName,
+				id
+			},
+			roles: [roleName]
+		}]
+	});
+	for (const leaf of listPermissions(resource)) {
+		if (leaf.resource !== resourceName) continue;
+		const decision = preview.explain(leaf, row, { trusted: true });
+		const seen = [
+			..."matched" in decision && decision.matched !== void 0 ? [decision.matched] : [],
+			...decision.trace?.allows ?? [],
+			...decision.trace?.denies ?? [],
+			..."denials" in decision ? decision.denials : []
+		];
+		for (const grant of seen) {
+			if (grant.role !== roleName) continue;
+			if (granteeOnResource(grant.to, resourceName, roleName)) return true;
+		}
+	}
+	return false;
+}
+function feedTarget(permdock, request, entries) {
+	const resource = oneResource(request.on.resource);
+	if (resource === void 0 || !isFeedId(request.id) || !isId(request.on.id) || request.row === void 0 || request.row === null || request.roles.length === 0) return refuse("validation");
+	for (const entry of entries) {
+		if (entry.leaf.resource !== resource) return refuse("exceeds-creator", { permission: entry.leaf.key });
+		if (entry.ids !== void 0 && (entry.ids.length !== 1 || entry.ids[0] !== request.on.id)) return refuse("exceeds-creator", { permission: entry.leaf.key });
+		if (permdock.decide(entry.leaf, request.row, { trusted: true }).outcome !== "granted") return refuse("exceeds-creator", { permission: entry.leaf.key });
+	}
+	for (const name of request.roles) if (!roleDeclaredOn(permdock, request.on.resource, resource, name, request.on.id, request.row)) return refuse("exceeds-creator", { role: name });
+	return {
+		ok: true,
+		resource
+	};
+}
+function feedOn(request, feed) {
+	if (request.kind !== "feed" || feed === void 0) return;
+	if (feed.ok && "resource" in feed) return {
+		resource: feed.resource,
+		id: request.on.id
+	};
+}
 function checkRequest(permdock, request, now) {
 	const creator = permdock.subject.principal;
 	if (creator === null) return refuse("anonymous");
-	if (creator.kind === "link" || "credential" in creator) return refuse("exceeds-creator", { creator: creator.kind === "link" ? "link" : "credential" });
+	if (creator.kind === "link" || creator.kind === "feed" || creator.kind === "contact") return refuse("exceeds-creator", { creator: creator.kind });
+	if ("credential" in creator) return refuse("exceeds-creator", { creator: "credential" });
 	const entries = permissionEntries(request, leafByKey(permdock.permissions));
-	if (entries === void 0 || !isId(request.id) || request.expiresAt !== void 0 && (!isTime(request.expiresAt) || request.expiresAt <= now)) return refuse("validation");
+	const expires = request.expiresAt === void 0 ? void 0 : secondsOf(request.expiresAt);
+	if (entries === void 0 || !isId(request.id) || request.expiresAt !== void 0 && (expires === void 0 || expires <= now)) return refuse("validation");
+	const feed = request.kind === "feed" ? feedTarget(permdock, request, entries) : void 0;
+	if (feed !== void 0 && !feed.ok) return feed;
 	const subject = permdock.subject;
 	for (const entry of entries) for (const id of entry.ids ?? [void 0]) if (coveredByDelegation(entry.leaf, subject.delegation, id, subject.actor !== void 0) !== void 0) return refuse("exceeds-creator", { permission: entry.leaf.key });
 	const credential = parseCredential(compact({
 		v: 1,
 		id: request.id,
 		kind: request.kind,
-		principal: request.kind === "service" ? request.principal ?? request.id : creator.id,
-		tenant: request.tenant,
-		roles: request.kind === "service" ? request.roles : void 0,
+		principal: request.kind === "service" ? request.principal ?? request.id : request.kind === "feed" ? request.id : creator.id,
+		tenant: "tenant" in request ? request.tenant : void 0,
+		roles: request.kind === "service" || request.kind === "feed" ? request.roles : void 0,
+		on: feedOn(request, feed),
 		permissions: entries.map((entry) => compact({
 			permission: entry.leaf.key,
-			ids: entry.ids
+			ids: request.kind === "feed" ? [request.on.id] : entry.ids
 		})),
 		createdBy: creator.id,
-		createdAt: now,
-		expiresAt: request.expiresAt === void 0 ? void 0 : Math.floor(request.expiresAt),
+		createdAt: rfc3339(now),
+		expiresAt: request.expiresAt,
 		name: request.name
 	}));
 	if (credential === void 0) return refuse("validation");
@@ -275,8 +373,31 @@ function credentialTenant(credential, active) {
 * its token. PermDock never stores the credential; the application does,
 * after a `granted` result.
 */
-async function decideCredential(permdock, request, options = {}) {
-	const checked = checkRequest(permdock, request, options.now ?? Math.floor(Date.now() / 1e3));
+/**
+* Decides whether the subject of `permdock` may create the credential in
+* `request`: the creator's own reach, the `credentials` policy of the key's
+* tenant (the call's `settings`, else the instance's), and `approval`.
+* PermDock never stores the credential; the application does, after a
+* `granted` result. An instance built from a snapshot denies with
+* `unsupported`.
+*/
+function decideCredential(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	const settings = options.settings ?? internals.env.settings;
+	return decideCredentialWith(internals.instance, request, settings === void 0 ? options : {
+		...options,
+		settings
+	});
+}
+async function decideCredentialWith(permdock, request, options) {
+	const checked = checkRequest(permdock, request, nowSeconds(options.now));
 	if (!checked.ok) return checked.decision;
 	const { credential } = checked;
 	const tenant = credentialTenant(credential, permdock.subject.principal?.tenant);
@@ -303,4 +424,4 @@ async function decideCredential(permdock, request, options = {}) {
 	});
 }
 //#endregion
-export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, parseCredential as o, credentialSubject as r, credentialDelegation as t };
+export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, isFeedId as o, credentialSubject as r, parseCredential as s, credentialDelegation as t };