permdock 0.3.1 → 0.5.0

package/dist/bind--9EFVYWF.d.ts

@@ -0,0 +1,38 @@
+import { ir as Subject } from "./policy-types-DzwivBgR.js";
+import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { t as RequestContext } from "./request-context-C2_1lchh.js";
+import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
+import { o as OtelWrap } from "./types-BqAKcRNW.js";
+import { r as PdpFactory } from "./types-ClZaWzfb.js";
+import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-BLd4MnBX.js";
+//#region src/server/bind.d.ts
+/** The options of every framework adapter; `TContext` is what its callbacks receive. */
+type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerAdapterServices & {
+  /** The user, or a full `Subject` (core then skips `policy.subject`). */
+  readonly subject: (context: TContext) => TUser | Subject | Promise<TUser | Subject>;
+  /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
+  readonly actor?: (context: TContext) => unknown;
+  readonly tenant?: TenantOption<TContext>;
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Only values the server derived belong here, never client input.
+   */
+  readonly context?: (context: TContext) => RequestContext | undefined | Promise<RequestContext | undefined>;
+};
+/** The services an adapter hands to its kernel unchanged. */
+type ServerAdapterServices = {
+  readonly store?: ApprovalStore;
+  /** `getPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
+  readonly pdp?: PdpFactory;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+  /** `webBotAuthVerifier(options)`; a verified bot becomes the actor. */
+  readonly webBotAuth?: WebBotAuthVerifier;
+  /** Wraps each instance after `otel`; build it with `wrapPermDock` to cover derived instances. */
+  readonly wrap?: PermDockWrap;
+  /** Replaces the response of a refused guard; it can never turn a refusal into a grant. */
+  readonly deniedResponse?: DeniedResponse;
+};
+//#endregion
+export { ServerAdapterServices as n, ServerAdapterOptions as t };

package/dist/{bind-CuzGytRf.js → bind-CZzhx-Vj.js}

@@ -1,12 +1,14 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { o as invalidSignatureResponse } from "./evaluations-tz6D9A2G.js";
-import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
-import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
-import { n as createServerKernel } from "./create-CMwIl-w2.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { c as withApp } from "./permdock-B9JxkBwC.js";
+import { t as composeWraps } from "./wrap-gX61EtpB.js";
+import { r as instanceOptions } from "./build-instance-BMnAudHn.js";
+import { p as invalidSignatureResponse } from "./evaluations-DZ2CbV5k.js";
+import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
+import { t as createPermDock } from "./create-DnrmLnLW.js";
 //#region src/server/bind.ts
 /** The server kernel with the subject and actor callbacks reading the context `contextOf` maps a `Request` to. */
 function adapterKernel(policy, options, adapter, contextOf) {
-	return createServerKernel(policy, compact({
+	return createPermDock(policy, compact({
 		subject: (request) => {
 			const context = contextOf(request);
 			return context === void 0 ? null : options.subject(context);
@@ -15,20 +17,26 @@ function adapterKernel(policy, options, adapter, contextOf) {
 			const context = contextOf(request);
 			return context === void 0 ? void 0 : options.actor?.(context);
 		},
+		context: options.context === void 0 ? void 0 : (request) => {
+			const context = contextOf(request);
+			return context === void 0 ? void 0 : options.context?.(context);
+		},
 		...instanceOptions(options),
 		store: options.store,
 		pdp: options.pdp,
 		webBotAuth: options.webBotAuth,
 		revocations: options.revocations,
 		adapter,
-		wrap: options.otel
+		wrap: composeWraps(options.otel, options.wrap),
+		deniedResponse: options.deniedResponse
 	}));
 }
 /**
 * The kernel of a framework adapter, with the subject, actor and tenant
 * callbacks reading the framework context each `Request` was built from.
 */
-function bindKernel(policy, options, adapter, toRequest) {
+function bindKernel(policy, given, adapter, toRequest) {
+	const options = withApp(policy, given);
 	const contexts = /* @__PURE__ */ new WeakMap();
 	const bound = /* @__PURE__ */ new WeakMap();
 	const kernel = adapterKernel(policy, options, adapter, (request) => contexts.get(request));
@@ -52,14 +60,18 @@ function bindKernel(policy, options, adapter, toRequest) {
 		const context = contexts.get(request);
 		return context === void 0 ? Promise.resolve({ tenant: void 0 }) : scopeOf(context);
 	};
-	const attach = (context) => attached(async () => kernel.permdock(bind(context), await scopeOf(context)));
+	const getPermDock = async (context) => kernel.getPermDock(bind(context), await scopeOf(context));
+	const attach = (context) => attached(() => getPermDock(context));
+	const guard = async (permission, data, context, protectOptions) => kernel.protect(permission, data === void 0 ? void 0 : () => data(context), protectOptions)(bind(context), await scopeOf(context));
 	return {
 		kernel,
 		bind,
 		rebind,
 		scopeOf,
 		handlerScope,
-		attach
+		getPermDock,
+		attach,
+		guard
 	};
 }
 /** The instance `build` resolves; an invalid Web Bot Auth signature is its `401` response. */

package/dist/body-CH5of8Ne.js

@@ -0,0 +1,10 @@
+import { o as statusProblem } from "./problem-details-cn5X30gZ.js";
+import { t as MAX_BODY_BYTES } from "./body-text-QcXok_SI.js";
+import { c as problemResponse } from "./problem-CTviyH5L.js";
+//#region src/server/body.ts
+/** The 413 Problem Details for a body over `maxBytes`. */
+function bodyTooLarge(maxBytes = MAX_BODY_BYTES) {
+	return problemResponse(statusProblem(413, `request body exceeds ${String(maxBytes)} bytes`));
+}
+//#endregion
+export { bodyTooLarge as t };

package/dist/body-text-QcXok_SI.js

@@ -0,0 +1,52 @@
+//#region src/server/body-text.ts
+/** The largest request body PermDock reads when a handler sets no smaller cap: 1 MiB. */
+const MAX_BODY_BYTES = 1048576;
+/**
+* The request or response body as UTF-8 text, read until `maxBytes` and no further. A
+* `Content-Length` above the cap is refused before the body is touched; a body
+* that runs past the cap whatever its header says is cancelled mid-stream.
+*/
+async function readBodyText(request, maxBytes = MAX_BODY_BYTES) {
+	const declared = request.headers.get("content-length");
+	if (declared !== null && Number(declared) > maxBytes) return {
+		ok: false,
+		cause: "too-large"
+	};
+	if (request.bodyUsed) return {
+		ok: false,
+		cause: "unreadable"
+	};
+	if (request.body === null) return {
+		ok: true,
+		text: ""
+	};
+	const decoder = new TextDecoder();
+	let size = 0;
+	let text = "";
+	try {
+		const reader = request.body.getReader();
+		for (;;) {
+			const chunk = await reader.read();
+			if (chunk.done) return {
+				ok: true,
+				text: text + decoder.decode()
+			};
+			size += chunk.value.byteLength;
+			if (size > maxBytes) {
+				await reader.cancel();
+				return {
+					ok: false,
+					cause: "too-large"
+				};
+			}
+			text += decoder.decode(chunk.value, { stream: true });
+		}
+	} catch {
+		return {
+			ok: false,
+			cause: "unreadable"
+		};
+	}
+}
+//#endregion
+export { readBodyText as n, MAX_BODY_BYTES as t };

package/dist/build-instance-BMnAudHn.js

@@ -0,0 +1,52 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+//#region src/core/instance-options.ts
+const INSTANCE_KEYS = {
+	memberships: true,
+	relations: true,
+	entitlements: true,
+	customRoles: true,
+	policies: true,
+	approvalPolicies: true,
+	sink: true,
+	limits: true,
+	principals: true
+};
+/** The `InstanceOptions` set on `options`, without the adapter's own keys. */
+function instanceOptions(options) {
+	const picked = {};
+	for (const key of Object.keys(INSTANCE_KEYS)) {
+		const name = key;
+		if (options[name] !== void 0) picked[name] = options[name];
+	}
+	return picked;
+}
+//#endregion
+//#region src/core/build-instance.ts
+/**
+* `resolve()`, or `null` when it throws: a subject or delegation that cannot
+* be resolved is absent. `rethrow` sees the error first, so a framework's
+* control-flow throws (Next.js `redirect`, `notFound`) pass through.
+*/
+async function resolveOrNull(resolve, rethrow) {
+	try {
+		return await resolve();
+	} catch (error) {
+		rethrow?.(error);
+		return null;
+	}
+}
+/** The one path every server adapter creates a request's instance through. */
+async function buildInstance(input) {
+	const options = compact({
+		...instanceOptions(input.sources),
+		...input.scope
+	});
+	const created = await getPermDock(input.policy, input.user, options);
+	return {
+		permdock: input.wrap === void 0 ? created : input.wrap(created),
+		options
+	};
+}
+//#endregion
+export { resolveOrNull as n, instanceOptions as r, buildInstance as t };

package/dist/{canonical-json-DemiK4Vp.js → canonical-json-BC8_nMTw.js}

@@ -1,11 +1,11 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 //#region src/core/canonical-json.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /**
-* JSON with sorted keys and `undefined` members dropped, so equal values hash
-* equally. Dates become ISO strings, bigints `"<n>n"`, and a repeated object
-* on the current path `"[Circular]"`, so any validated row serialises.
+* RFC 8785 (JCS) output for I-JSON input: keys sorted by UTF-16 code units,
+* ECMAScript number and string serialisation, no whitespace. `undefined`
+* members are dropped. Outside I-JSON, Dates become ISO strings, bigints
+* `"<n>n"`, and a repeated object on the current path `"[Circular]"`, so any
+* validated row serialises.
 */
 function canonicalJson(value, path = /* @__PURE__ */ new Set()) {
 	if (typeof value === "bigint") return JSON.stringify(`${value}n`);

package/dist/{capability-2kYTMWDv.d.ts → capability-BSslw1QV.d.ts}

@@ -1,5 +1,5 @@
-import { Nr as Principal, Pr as Subject, Pt as TokenSigner } from "./policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
+import { Rt as Instant, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
+import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
 //#region src/core/capability.d.ts
 /**
  * Who may redeem a capability: anyone holding it, any signed-in principal,
@@ -12,15 +12,18 @@ type CapabilityRedeemer = "anyone" | "signed-in" | {
   readonly scope: string;
   readonly id: string;
 };
+/** RFC 7800 confirmation: the SHA-256 JWK thumbprint (RFC 7638) of the key that must redeem it. */
+type CapabilityConfirmation = {
+  readonly jkt: string;
+};
 /**
- * Capability v1: the `capability` claim of a `permdock-capability+jwt`. It
- * holds `roles` on one resource instance (`on`, the `Membership.on` shape),
- * optionally narrowed to `permissions` (keys). `id` is the link id: the
- * token's `sub` and the handle an application revokes.
+ * Capability v1: the `capability` claim of a `vnd.permdock.capability+jwt`.
+ * It holds `roles` on one resource instance (`on`, the `Membership.on`
+ * shape), optionally narrowed to `permissions` (keys). The link id is the
+ * token's `sub` and its expiry the token's `exp`; neither repeats here.
  */
-type Capability = {
+type CapabilityClaim = {
   readonly v: 1;
-  readonly id: string;
   /** `key` is reserved for user-bound credentials and resolves to no subject. */
   readonly holder: "link" | "key";
   readonly on: {
@@ -32,10 +35,18 @@ type Capability = {
   readonly redeemer?: CapabilityRedeemer;
   /** One request per token: the resolver claims the token's `jti` in a `ReplayStore`. */
   readonly once?: true;
-  /** Seconds since the epoch; also the token's `exp` and the membership's `expiresAt`. */
+};
+/**
+ * A verified capability: the claim plus `id` (the token's `sub`, the handle
+ * an application revokes), `expiresAt` (its `exp`, Unix seconds, also the
+ * membership's `expiresAt`) and `cnf` when the token binds a redeemer key.
+ */
+type Capability = CapabilityClaim & {
+  readonly id: string;
   readonly expiresAt: number;
+  readonly cnf?: CapabilityConfirmation;
 };
-type LinkPrincipal = Principal & {
+type CapabilityPrincipal = Principal & {
   readonly kind: "link";
   readonly capability: Capability;
 };
@@ -49,7 +60,10 @@ type CapabilityInput = {
   readonly permissions?: readonly Permission[];
   readonly redeemer?: CapabilityRedeemer;
   readonly once?: boolean;
+  /** `exp`, Unix seconds. */
   readonly expiresAt: number;
+  /** Binds the link to the key with this RFC 7638 thumbprint; redeeming it then needs a DPoP proof from that key. */
+  readonly cnf?: CapabilityConfirmation;
 };
 /**
  * What one scope instance (a tenant, a customer) allows for links on its
@@ -64,8 +78,10 @@ type LinkPolicy = {
   readonly once?: boolean;
 };
 type LinkPolicyViolation = "lifetime" | "redeemer" | "once";
-type SignCapabilityOptions = {
+type CapabilityOptions = {
   readonly audience?: string | readonly string[];
+  /** `iat`; the clock when absent. */
+  readonly issuedAt?: Instant;
   /** Refuse to sign a link these policies would refuse at resolution. */
   readonly linkPolicy?: LinkPolicy | readonly LinkPolicy[];
 };
@@ -76,24 +92,27 @@ type SignCapabilityOptions = {
  */
 declare function linkPolicyViolation(capability: Capability, policy: LinkPolicy | readonly LinkPolicy[], issuedAt: number | undefined): LinkPolicyViolation | undefined;
 /**
- * Validates an untrusted `capability` claim and returns a frozen copy with
- * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
- * type in a known field rejects the whole claim.
+ * Validates a verified capability (a claim plus `id`, `expiresAt` and
+ * an optional `cnf`) and returns a frozen copy, or `undefined`.
  */
 declare function parseCapability(input: unknown): Capability | undefined;
 /**
- * Signs a capability as a `permdock-capability+jwt`: `sub` is the link id,
- * `exp` is `expiresAt`, and the signer sets `iss`, `iat` and a fresh `jti`.
+ * The capability verified claims carry: the `capability` claim, `sub` as
+ * `id`, `exp` as `expiresAt` and the RFC 7800 `cnf`. `undefined` when any
+ * of them is missing or malformed.
+ */
+declare function capabilityFromClaims(claims: Readonly<Record<string, unknown>>): Capability | undefined;
+/**
+ * Validates an untrusted `capability` claim and returns a frozen copy with
+ * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
+ * type in a known field rejects the whole claim.
  */
-declare function signCapability(input: CapabilityInput, signer: TokenSigner, options?: SignCapabilityOptions): Promise<string>;
+declare function parseCapabilityClaim(input: unknown): CapabilityClaim | undefined;
 /**
- * The subject a verified capability acts as: a `link` principal holding
- * `roles` on `on` and nothing else, with `delegation.scopes` narrowing it to
- * `permissions` when the capability lists them. A `key` holder resolves to
- * the anonymous subject until user-bound credentials ship.
+ * Signs a capability as a `vnd.permdock.capability+jwt`: `sub` is the link
+ * id, `exp` is `expiresAt`, `cnf` binds the redeemer's key, and the signer
+ * sets `iss`, `aud`, `iat` (`issuedAt`, else now) and a fresh `jti`.
  */
-declare function capabilitySubject(capability: Capability, options?: {
-  readonly issuer?: string;
-}): Subject<LinkPrincipal> | Subject;
+declare function signCapability(input: CapabilityInput, signer: TokenSigner, options?: CapabilityOptions): Promise<string>;
 //#endregion
-export { LinkPolicyViolation as a, capabilitySubject as c, signCapability as d, LinkPolicy as i, linkPolicyViolation as l, CapabilityInput as n, LinkPrincipal as o, CapabilityRedeemer as r, SignCapabilityOptions as s, Capability as t, parseCapability as u };
+export { CapabilityOptions as a, LinkPolicy as c, linkPolicyViolation as d, parseCapability as f, CapabilityInput as i, LinkPolicyViolation as l, signCapability as m, CapabilityClaim as n, CapabilityPrincipal as o, parseCapabilityClaim as p, CapabilityConfirmation as r, CapabilityRedeemer as s, Capability as t, capabilityFromClaims as u };

package/dist/{capability-4qPdO9gk.js → capability-N1K9IpqS.js}

@@ -1,9 +1,10 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { T as isForbiddenKey, _ as listPermissions } from "./permissions-DVoF6dMt.js";
-import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
-import { n as sameId } from "./ids-DC4V4CFu.js";
-import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, o as sameId, r as idList, t as expiredAt } from "./expiry-D4_YKRKD.js";
+import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { o as epochSeconds, p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/capability.ts
 function redeemerKind(redeemer) {
 	if (redeemer === void 0 || typeof redeemer === "string") return redeemer ?? "anyone";
@@ -23,22 +24,6 @@ function linkPolicyViolation(capability, policy, issuedAt) {
 		if (item.once === true && capability.once !== true) return "once";
 	}
 }
-const MAX_ID = 256;
-const MAX_ENTRIES = 64;
-/** A copy holding only own enumerable properties, so a prototype never supplies a field. */
-function ownRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
-	const record = {};
-	for (const [key, item] of Object.entries(value)) if (!isForbiddenKey(key)) record[key] = item;
-	return record;
-}
-function isId(value) {
-	return typeof value === "string" && value.length > 0 && value.length <= MAX_ID;
-}
-function idList(value) {
-	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_ENTRIES || !value.every(isId)) return;
-	return [...new Set(value)];
-}
 function parseRedeemer(input) {
 	if (input === "anyone" || input === "signed-in") return input;
 	const value = ownRecord(input);
@@ -50,14 +35,54 @@ function parseRedeemer(input) {
 		id: value["id"]
 	};
 }
+function parseConfirmation(input) {
+	const jkt = ownRecord(input)?.["jkt"];
+	return typeof jkt === "string" && /^[\w-]{43}$/u.test(jkt) ? { jkt } : void 0;
+}
+/**
+* Validates a verified capability (a claim plus `id`, `expiresAt` and
+* an optional `cnf`) and returns a frozen copy, or `undefined`.
+*/
+function parseCapability(input) {
+	const value = ownRecord(input);
+	const claim = parseCapabilityClaim(input);
+	if (value === void 0 || claim === void 0 || !isId(value["id"])) return;
+	const expiresAt = value["expiresAt"];
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return;
+	const cnf = value["cnf"] === void 0 ? void 0 : parseConfirmation(value["cnf"]);
+	if (value["cnf"] !== void 0 && cnf === void 0) return;
+	return freezeDeep(compact({
+		...claim,
+		id: value["id"],
+		expiresAt,
+		cnf
+	}));
+}
+/**
+* The capability verified claims carry: the `capability` claim, `sub` as
+* `id`, `exp` as `expiresAt` and the RFC 7800 `cnf`. `undefined` when any
+* of them is missing or malformed.
+*/
+function capabilityFromClaims(claims) {
+	const claim = parseCapabilityClaim(claims["capability"]);
+	const sub = claims["sub"];
+	const exp = claims["exp"];
+	if (claim === void 0 || !isId(sub) || typeof exp !== "number") return;
+	return parseCapability({
+		...claim,
+		id: sub,
+		expiresAt: exp,
+		cnf: claims["cnf"]
+	});
+}
 /**
 * Validates an untrusted `capability` claim and returns a frozen copy with
 * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
 * type in a known field rejects the whole claim.
 */
-function parseCapability(input) {
+function parseCapabilityClaim(input) {
 	const value = ownRecord(input);
-	if (value === void 0 || value["v"] !== 1 || !isId(value["id"])) return;
+	if (value === void 0 || value["v"] !== 1) return;
 	if (value["holder"] !== "link" && value["holder"] !== "key") return;
 	const on = ownRecord(value["on"]);
 	if (on === void 0 || !isId(on["resource"]) || !isId(on["id"])) return;
@@ -68,11 +93,8 @@ function parseCapability(input) {
 	const redeemer = value["redeemer"] === void 0 ? void 0 : parseRedeemer(value["redeemer"]);
 	if (value["redeemer"] !== void 0 && redeemer === void 0) return;
 	if (value["once"] !== void 0 && value["once"] !== true) return;
-	const expiresAt = value["expiresAt"];
-	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return;
 	return freezeDeep(compact({
 		v: 1,
-		id: value["id"],
 		holder: value["holder"],
 		on: {
 			resource: on["resource"],
@@ -81,8 +103,7 @@ function parseCapability(input) {
 		roles,
 		permissions,
 		redeemer,
-		once: value["once"],
-		expiresAt
+		once: value["once"]
 	}));
 }
 function resourceName(resource) {
@@ -105,26 +126,32 @@ function capabilityOf(input) {
 		permissions: input.permissions?.map((permission) => permission.key),
 		redeemer: input.redeemer,
 		once: input.once === true ? true : void 0,
-		expiresAt: Math.floor(input.expiresAt)
+		expiresAt: Math.floor(input.expiresAt),
+		cnf: input.cnf
 	}));
-	if (capability === void 0) throw new Error("PermDock: invalid capability (id, on.id and roles are required; roles and permissions hold at most 64 entries)");
+	if (capability === void 0) throw new Error("PermDock: invalid capability (id, on.id and roles are required; roles and permissions hold at most 64 entries; cnf.jkt is a base64url SHA-256 thumbprint)");
 	return capability;
 }
 /**
-* Signs a capability as a `permdock-capability+jwt`: `sub` is the link id,
-* `exp` is `expiresAt`, and the signer sets `iss`, `iat` and a fresh `jti`.
+* Signs a capability as a `vnd.permdock.capability+jwt`: `sub` is the link
+* id, `exp` is `expiresAt`, `cnf` binds the redeemer's key, and the signer
+* sets `iss`, `aud`, `iat` (`issuedAt`, else now) and a fresh `jti`.
 */
 function signCapability(input, signer, options = {}) {
 	const capability = capabilityOf(input);
-	const violation = options.linkPolicy === void 0 ? void 0 : linkPolicyViolation(capability, options.linkPolicy, Math.floor(Date.now() / 1e3));
+	const issuedAt = nowSeconds(options.issuedAt);
+	const violation = options.linkPolicy === void 0 ? void 0 : linkPolicyViolation(capability, options.linkPolicy, issuedAt);
 	if (violation !== void 0) return Promise.reject(/* @__PURE__ */ new Error(`PermDock: capability breaks the link policy (${violation})`));
-	return signer.sign({
-		capability,
-		sub: capability.id
-	}, compact({
-		typ: "permdock-capability+jwt",
+	const { id, expiresAt, cnf, ...claim } = capability;
+	return signer.sign(compact({
+		capability: claim,
+		sub: id,
+		cnf
+	}), compact({
+		typ: "vnd.permdock.capability+jwt",
 		audience: options.audience,
-		expiresAt: capability.expiresAt
+		expiresAt,
+		issuedAt
 	}));
 }
 function holdsScope(membership, scope, id, now) {
@@ -133,10 +160,10 @@ function holdsScope(membership, scope, id, now) {
 	return scope === "tenant" && sameId(membership.tenant, id) || scope === "team" && sameId(membership.team, id);
 }
 /** Whether `viewer`, the request's own verified subject, may redeem a capability. */
-function redeemerAllows(redeemer, viewer, now = Date.now() / 1e3) {
+function redeemerAllows(redeemer, viewer, now = epochSeconds()) {
 	if (redeemer === void 0 || redeemer === "anyone") return true;
 	const principal = viewer?.principal ?? null;
-	if (principal === null || principal.kind === "link") return false;
+	if (principal === null || principal.kind === "link" || principal.kind === "feed") return false;
 	if (redeemer === "signed-in") return true;
 	if ("user" in redeemer) return principal.id === redeemer.user;
 	return (principal.memberships ?? []).some((membership) => holdsScope(membership, redeemer.scope, redeemer.id, now));
@@ -170,4 +197,4 @@ function capabilitySubject(capability, options = {}) {
 	}));
 }
 //#endregion
-export { ownRecord as a, signCapability as c, linkPolicyViolation as i, idList as n, parseCapability as o, isId as r, redeemerAllows as s, capabilitySubject as t };
+export { parseCapability as a, signCapability as c, linkPolicyViolation as i, capabilityOf as n, parseCapabilityClaim as o, capabilitySubject as r, redeemerAllows as s, capabilityFromClaims as t };

package/dist/casbin-Cr7RLtA3.js

@@ -0,0 +1,30 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/casbin.ts
+const casbinImport = defineLeaf({
+	flags: {
+		model: {
+			type: "string",
+			description: "The Casbin model.conf",
+			valueHint: "file"
+		},
+		policy: {
+			type: "string",
+			description: "The Casbin policy.csv",
+			valueHint: "file"
+		},
+		...outFlag
+	},
+	async run(ctx, { flags }) {
+		const { runCasbinImport } = await import("./casbin-Dyu2gnUD.js");
+		return runCasbinImport({
+			cwd: ctx.cwd,
+			model: given(flags.model),
+			policy: given(flags.policy),
+			out: fileOut("casbin import", flags.out),
+			json: ctx.json
+		});
+	}
+});
+//#endregion
+export { casbinImport };