permdock 0.7.0 → 0.8.0

package/dist/{bind-JDuvxjuW.d.ts → bind-Cp2hBHzP.d.ts}

@@ -1,17 +1,23 @@
-import { lr as Subject } from "./policy-types-B-F-qAZk.js";
-import { m as ApprovalStore } from "./types-DC44-hqb.js";
-import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
+import { lr as Subject } from "./policy-types-CCiDRZBH.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
-import { o as OtelWrap } from "./types-CIeZcG8v.js";
-import { r as PdpFactory } from "./types-D3A19w4A.js";
-import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-C4gZUEZy.js";
+import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
+import { o as OtelWrap } from "./types-DHKPcqzr.js";
+import { r as PdpFactory } from "./types-B4uqKDnp.js";
+import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-CIlpSA2G.js";
 //#region src/server/bind.d.ts
-/** The options of every framework adapter; `TContext` is what its callbacks receive. */
+/**
+ * The options of every framework adapter; `TContext` is what its callbacks
+ * receive.
+ */
 type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerAdapterServices & {
   /** The user, or a full `Subject` (core then skips `policy.subject`). */
   readonly subject: (context: TContext) => TUser | Subject | Promise<TUser | Subject>;
-  /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
+  /**
+   * The agent or service acting for the subject; anything but an `Actor` is
+   * ignored.
+   */
   readonly actor?: (context: TContext) => unknown;
   readonly tenant?: TenantOption<TContext>;
   /**
@@ -23,15 +29,24 @@ type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerA
 /** The services an adapter hands to its kernel unchanged. */
 type ServerAdapterServices = {
   readonly store?: ApprovalStore;
-  /** `getPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
+  /**
+   * `getPermDock` from `permdock/pdp`; `protect` then decides delegated
+   * permissions remotely.
+   */
   readonly pdp?: PdpFactory;
   /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
   readonly otel?: OtelWrap;
   /** `webBotAuthVerifier(options)`; a verified bot becomes the actor. */
   readonly webBotAuth?: WebBotAuthVerifier;
-  /** Wraps each instance after `otel`; build it with `wrapPermDock` to cover derived instances. */
+  /**
+   * Wraps each instance after `otel`; build it with `wrapPermDock` to cover
+   * derived instances.
+   */
   readonly wrap?: PermDockWrap;
-  /** Replaces the response of a refused guard; it can never turn a refusal into a grant. */
+  /**
+   * Replaces the response of a refused guard; it can never turn a refusal into
+   * a grant.
+   */
   readonly deniedResponse?: DeniedResponse;
 };
 //#endregion

package/dist/{bind-D1nO6fiC.js → bind-D_sZSVA3.js}

@@ -1,12 +1,15 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { l as withApp } from "./permdock-BfWEeMqk.js";
-import { t as composeWraps } from "./wrap-CiSc_KCq.js";
-import { r as instanceOptions } from "./build-instance-DxE7czo9.js";
-import { f as invalidSignatureResponse } from "./evaluations-DReoiVBw.js";
-import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
-import { t as createPermDock } from "./create-DJrlhEp9.js";
+import { l as withApp } from "./permdock-L-_I_3zP.js";
+import { t as composeWraps } from "./wrap-B2wziJI_.js";
+import { r as instanceOptions } from "./build-instance-CNWaYJyr.js";
+import { f as invalidSignatureResponse } from "./evaluations-IBceAeKT.js";
+import { n as tenantScope } from "./adapter-context-CIQpQxbE.js";
+import { t as createPermDock } from "./create-_noSrY1T.js";
 //#region src/server/bind.ts
-/** The server kernel with the subject and actor callbacks reading the context `contextOf` maps a `Request` to. */
+/**
+* The server kernel with the subject and actor callbacks reading the context
+* `contextOf` maps a `Request` to.
+*/
 function adapterKernel(policy, options, adapter, contextOf) {
 	return createPermDock(policy, compact({
 		subject: (request) => {
@@ -74,7 +77,10 @@ function bindKernel(policy, given, adapter, toRequest) {
 		guard
 	};
 }
-/** The instance `build` resolves; an invalid Web Bot Auth signature is its `401` response. */
+/**
+* The instance `build` resolves; an invalid Web Bot Auth signature is its `401`
+* response.
+*/
 async function attached(build) {
 	try {
 		return {
@@ -90,14 +96,20 @@ async function attached(build) {
 		};
 	}
 }
-/** Sets `permdock`, and `permdockData` when a loader returned a row, on a framework request or context. */
+/**
+* Sets `permdock`, and `permdockData` when a loader returned a row, on a
+* framework request or context.
+*/
 function decorate(target, instance, data) {
 	Object.assign(target, data === void 0 ? { permdock: instance } : {
 		permdock: instance,
 		permdockData: data
 	});
 }
-/** One connection per socket: every handler of `socket` gets the promise the first one opened. */
+/**
+* One connection per socket: every handler of `socket` gets the promise the
+* first one opened.
+*/
 function socketConnection(sockets, socket, open) {
 	const hit = sockets.get(socket);
 	if (hit !== void 0) return hit;

package/dist/{body-CH5of8Ne.js → body-CJQwYVa8.js}

@@ -1,6 +1,6 @@
-import { o as statusProblem } from "./problem-details-cn5X30gZ.js";
-import { t as MAX_BODY_BYTES } from "./body-text-QcXok_SI.js";
-import { c as problemResponse } from "./problem-CTviyH5L.js";
+import { o as statusProblem } from "./problem-details-CLDgX1KV.js";
+import { t as MAX_BODY_BYTES } from "./body-text-DQhcmqdY.js";
+import { l as problemResponse } from "./problem-BVLHFK33.js";
 //#region src/server/body.ts
 /** The 413 Problem Details for a body over `maxBytes`. */
 function bodyTooLarge(maxBytes = MAX_BODY_BYTES) {

package/dist/{body-text-QcXok_SI.js → body-text-DQhcmqdY.js}

@@ -1,10 +1,14 @@
 //#region src/server/body-text.ts
-/** The largest request body PermDock reads when a handler sets no smaller cap: 1 MiB. */
+/**
+* The largest request body PermDock reads when a handler sets no smaller cap: 1
+* MiB.
+*/
 const MAX_BODY_BYTES = 1048576;
 /**
-* The request or response body as UTF-8 text, read until `maxBytes` and no further. A
-* `Content-Length` above the cap is refused before the body is touched; a body
-* that runs past the cap whatever its header says is cancelled mid-stream.
+* The request or response body as UTF-8 text, read until `maxBytes` and no
+* further. A `Content-Length` above the cap is refused before the body is
+* touched; a body that runs past the cap whatever its header says is cancelled
+* mid-stream.
 */
 async function readBodyText(request, maxBytes = MAX_BODY_BYTES) {
 	const declared = request.headers.get("content-length");

package/dist/{boundary-BM8a_P6E.js → boundary-BV3O1eud.js}

@@ -1,11 +1,17 @@
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
 //#region src/client/boundary.ts
-/** The digest of a PermDock error (`PermDockDeniedError`, `PermDockApprovalRequiredError`); `null` for any other error. */
+/**
+* The digest of a PermDock error (`PermDockDeniedError`,
+* `PermDockApprovalRequiredError`); `null` for any other error.
+*/
 function boundaryDigest(error) {
 	if (error === null || typeof error !== "object" || !("digest" in error)) return null;
 	return parsePermDockDigest(error.digest);
 }
-/** What a boundary renders for `digest`: `approval` for an approval request when given, otherwise `denied`. */
+/**
+* What a boundary renders for `digest`: `approval` for an approval request when
+* given, otherwise `denied`.
+*/
 function boundaryFallback(digest, fallbacks) {
 	return digest.outcome === "approval-required" ? fallbacks.approval ?? fallbacks.denied : fallbacks.denied;
 }

package/dist/{boundary-BmHxVH1J.d.ts → boundary-C9ck-3uK.d.ts}

@@ -1,12 +1,21 @@
-import { t as PermDockDigest } from "./digest-B3kc_PgQ.js";
+import { t as PermDockDigest } from "./digest-8Yx2CchM.js";
 //#region src/client/boundary.d.ts
 type PermissionBoundaryState = PermDockDigest & {
-  /** Renders the boundary's children again, e.g. after an approval or a role change. */
+  /**
+   * Renders the boundary's children again, e.g. after an approval or a role
+   * change.
+   */
   readonly retry: () => void;
 };
-/** The digest of a PermDock error (`PermDockDeniedError`, `PermDockApprovalRequiredError`); `null` for any other error. */
+/**
+ * The digest of a PermDock error (`PermDockDeniedError`,
+ * `PermDockApprovalRequiredError`); `null` for any other error.
+ */
 declare function boundaryDigest(error: unknown): PermDockDigest | null;
-/** What a boundary renders for `digest`: `approval` for an approval request when given, otherwise `denied`. */
+/**
+ * What a boundary renders for `digest`: `approval` for an approval request when
+ * given, otherwise `denied`.
+ */
 declare function boundaryFallback<T>(digest: PermDockDigest, fallbacks: {
   readonly denied?: T | undefined;
   readonly approval?: T | undefined;

package/dist/{budget-NbEtbJC_.js → budget-BELja5A9.js}

@@ -1,9 +1,12 @@
 //#region src/supabase/budget.ts
-/** The default size budget, in bytes of JSON, for the hook's `memberships` claim: about 15 UUID-keyed single-role memberships. */
+/**
+* The default size budget, in bytes of JSON, for the hook's `memberships`
+* claim: about 15 UUID-keyed single-role memberships.
+*/
 const supabaseMembershipsBudget = 1024;
 /**
-* The default claim that carries the active first-scope id: the hook writes
-* it, `subjectFromSupabase` reads it, and the RLS helpers compare with it.
+* The default claim that carries the active first-scope id: the hook writes it,
+* `subjectFromSupabase` reads it, and the RLS helpers compare with it.
 * `rls.tenantClaim` and the `tenant` option change it.
 */
 const supabaseTenantClaim = "tenant_id";

package/dist/{budget-JqcRqyhK.d.ts → budget-hYsPz_yE.d.ts}

@@ -1,9 +1,12 @@
 //#region src/supabase/budget.d.ts
-/** The default size budget, in bytes of JSON, for the hook's `memberships` claim: about 15 UUID-keyed single-role memberships. */
+/**
+ * The default size budget, in bytes of JSON, for the hook's `memberships`
+ * claim: about 15 UUID-keyed single-role memberships.
+ */
 declare const supabaseMembershipsBudget = 1024;
 /**
- * The default claim that carries the active first-scope id: the hook writes
- * it, `subjectFromSupabase` reads it, and the RLS helpers compare with it.
+ * The default claim that carries the active first-scope id: the hook writes it,
+ * `subjectFromSupabase` reads it, and the RLS helpers compare with it.
  * `rls.tenantClaim` and the `tenant` option change it.
  */
 declare const supabaseTenantClaim = "tenant_id";

package/dist/{build-instance-DxE7czo9.js → build-instance-CNWaYJyr.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as getPermDock } from "./permdock-BfWEeMqk.js";
+import { t as getPermDock } from "./permdock-L-_I_3zP.js";
 //#region src/core/instance-options.ts
 const INSTANCE_KEYS = {
 	memberships: true,
@@ -24,8 +24,8 @@ function instanceOptions(options) {
 //#endregion
 //#region src/core/build-instance.ts
 /**
-* `resolve()`, or `null` when it throws: a subject or delegation that cannot
-* be resolved is absent. `rethrow` sees the error first, so a framework's
+* `resolve()`, or `null` when it throws: a subject or delegation that cannot be
+* resolved is absent. `rethrow` sees the error first, so a framework's
 * control-flow throws (Next.js `redirect`, `notFound`) pass through.
 */
 async function resolveOrNull(resolve, rethrow) {

package/dist/{capability-L7NnfhiE.js → capability-BqX94r07.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { a as isId, o as sameId, r as idList, t as expiredAt } from "./expiry-D4_YKRKD.js";
-import { c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
-import { o as epochSeconds, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { a as isId, o as sameId, r as idList, t as expiredAt } from "./expiry-6XByK0dm.js";
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { o as epochSeconds, p as nowSeconds } from "./time-nR1JesoH.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/capability.ts
 function redeemerKind(redeemer) {
@@ -11,9 +11,9 @@ function redeemerKind(redeemer) {
 	return "user" in redeemer ? "user" : "scope";
 }
 /**
-* The first rule of `policy` the capability breaks, or `undefined`. A
-* lifetime rule without a known `issuedAt`, or one that is not a finite
-* non-negative number, is broken: the check fails closed.
+* The first rule of `policy` the capability breaks, or `undefined`. A lifetime
+* rule without a known `issuedAt`, or one that is not a finite non-negative
+* number, is broken: the check fails closed.
 */
 function linkPolicyViolation(capability, policy, issuedAt) {
 	const policies = Array.isArray(policy) ? policy : [policy];
@@ -40,8 +40,8 @@ function parseConfirmation(input) {
 	return typeof jkt === "string" && /^[\w-]{43}$/u.test(jkt) ? { jkt } : void 0;
 }
 /**
-* Validates a verified capability (a claim plus `id`, `expiresAt` and
-* an optional `cnf`) and returns a frozen copy, or `undefined`.
+* Validates a verified capability (a claim plus `id`, `expiresAt` and an
+* optional `cnf`) and returns a frozen copy, or `undefined`.
 */
 function parseCapability(input) {
 	const value = ownRecord(input);
@@ -59,9 +59,9 @@ function parseCapability(input) {
 	}));
 }
 /**
-* The capability verified claims carry: the `capability` claim, `sub` as
-* `id`, `exp` as `expiresAt` and the RFC 7800 `cnf`. `undefined` when any
-* of them is missing or malformed.
+* The capability verified claims carry: the `capability` claim, `sub` as `id`,
+* `exp` as `expiresAt` and the RFC 7800 `cnf`. `undefined` when any of them is
+* missing or malformed.
 */
 function capabilityFromClaims(claims) {
 	const claim = parseCapabilityClaim(claims["capability"]);
@@ -76,9 +76,9 @@ function capabilityFromClaims(claims) {
 	});
 }
 /**
-* Validates an untrusted `capability` claim and returns a frozen copy with
-* only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
-* type in a known field rejects the whole claim.
+* Validates an untrusted `capability` claim and returns a frozen copy with only
+* the v1 fields, or `undefined`. Unknown fields are dropped; a wrong type in a
+* known field rejects the whole claim.
 */
 function parseCapabilityClaim(input) {
 	const value = ownRecord(input);
@@ -112,7 +112,10 @@ function resourceName(resource) {
 	if (names.size !== 1 || name === void 0) throw new Error("PermDock: capability on.resource must name exactly one resource");
 	return name;
 }
-/** Builds the v1 `Capability` for `input`; throws on an input no resolver would accept. */
+/**
+* Builds the v1 `Capability` for `input`; throws on an input no resolver would
+* accept.
+*/
 function capabilityOf(input) {
 	const capability = parseCapability(compact({
 		v: 1,
@@ -133,9 +136,9 @@ function capabilityOf(input) {
 	return capability;
 }
 /**
-* Signs a capability as a `vnd.permdock.capability+jwt`: `sub` is the link
-* id, `exp` is `expiresAt`, `cnf` binds the redeemer's key, and the signer
-* sets `iss`, `aud`, `iat` (`issuedAt`, else now) and a fresh `jti`.
+* Signs a capability as a `vnd.permdock.capability+jwt`: `sub` is the link id,
+* `exp` is `expiresAt`, `cnf` binds the redeemer's key, and the signer sets
+* `iss`, `aud`, `iat` (`issuedAt`, else now) and a fresh `jti`.
 */
 function signCapability(input, signer, options = {}) {
 	const capability = capabilityOf(input);
@@ -159,7 +162,10 @@ function holdsScope(membership, scope, id, now) {
 	if (membership.scope === scope && sameId(membership.id, id)) return true;
 	return scope === "tenant" && sameId(membership.tenant, id) || scope === "team" && sameId(membership.team, id);
 }
-/** Whether `viewer`, the request's own verified subject, may redeem a capability. */
+/**
+* Whether `viewer`, the request's own verified subject, may redeem a
+* capability.
+*/
 function redeemerAllows(redeemer, viewer, now = epochSeconds()) {
 	if (redeemer === void 0 || redeemer === "anyone") return true;
 	const principal = viewer?.principal ?? null;
@@ -169,10 +175,10 @@ function redeemerAllows(redeemer, viewer, now = epochSeconds()) {
 	return (principal.memberships ?? []).some((membership) => holdsScope(membership, redeemer.scope, redeemer.id, now));
 }
 /**
-* The subject a verified capability acts as: a `link` principal holding
-* `roles` on `on` and nothing else, with `delegation.scopes` narrowing it to
-* `permissions` when the capability lists them. A `key` holder resolves to
-* the anonymous subject until user-bound credentials ship.
+* The subject a verified capability acts as: a `link` principal holding `roles`
+* on `on` and nothing else, with `delegation.scopes` narrowing it to
+* `permissions` when the capability lists them. A `key` holder resolves to the
+* anonymous subject until user-bound credentials ship.
 */
 function capabilitySubject(capability, options = {}) {
 	if (capability.holder !== "link") return anonymousSubject();

package/dist/{capability-D4UC9TTW.d.ts → capability-ChuiONQU.d.ts}

@@ -1,10 +1,10 @@
-import { Rt as Instant, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { Rt as Instant, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/capability.d.ts
 /**
- * Who may redeem a capability: anyone holding it, any signed-in principal,
- * one user, or a member of one scope instance. The viewer is the request's
- * own verified subject, never a claim of the capability.
+ * Who may redeem a capability: anyone holding it, any signed-in principal, one
+ * user, or a member of one scope instance. The viewer is the request's own
+ * verified subject, never a claim of the capability.
  */
 type CapabilityRedeemer = "anyone" | "signed-in" | {
   readonly user: string;
@@ -12,15 +12,18 @@ type CapabilityRedeemer = "anyone" | "signed-in" | {
   readonly scope: string;
   readonly id: string;
 };
-/** RFC 7800 confirmation: the SHA-256 JWK thumbprint (RFC 7638) of the key that must redeem it. */
+/**
+ * RFC 7800 confirmation: the SHA-256 JWK thumbprint (RFC 7638) of the key that
+ * must redeem it.
+ */
 type CapabilityConfirmation = {
   readonly jkt: string;
 };
 /**
- * Capability v1: the `capability` claim of a `vnd.permdock.capability+jwt`.
- * It holds `roles` on one resource instance (`on`, the `Membership.on`
- * shape), optionally narrowed to `permissions` (keys). The link id is the
- * token's `sub` and its expiry the token's `exp`; neither repeats here.
+ * Capability v1: the `capability` claim of a `vnd.permdock.capability+jwt`. It
+ * holds `roles` on one resource instance (`on`, the `Membership.on` shape),
+ * optionally narrowed to `permissions` (keys). The link id is the token's `sub`
+ * and its expiry the token's `exp`; neither repeats here.
  */
 type CapabilityClaim = {
   readonly v: 1;
@@ -33,12 +36,15 @@ type CapabilityClaim = {
   readonly roles: readonly string[];
   readonly permissions?: readonly string[];
   readonly redeemer?: CapabilityRedeemer;
-  /** One request per token: the resolver claims the token's `jti` in a `ReplayStore`. */
+  /**
+   * One request per token: the resolver claims the token's `jti` in a
+   * `ReplayStore`.
+   */
   readonly once?: true;
 };
 /**
- * A verified capability: the claim plus `id` (the token's `sub`, the handle
- * an application revokes), `expiresAt` (its `exp`, Unix seconds, also the
+ * A verified capability: the claim plus `id` (the token's `sub`, the handle an
+ * application revokes), `expiresAt` (its `exp`, Unix seconds, also the
  * membership's `expiresAt`) and `cnf` when the token binds a redeemer key.
  */
 type Capability = CapabilityClaim & {
@@ -62,7 +68,10 @@ type CapabilityInput = {
   readonly once?: boolean;
   /** `exp`, Unix seconds. */
   readonly expiresAt: number;
-  /** Binds the link to the key with this RFC 7638 thumbprint; redeeming it then needs a DPoP proof from that key. */
+  /**
+   * Binds the link to the key with this RFC 7638 thumbprint; redeeming it then
+   * needs a DPoP proof from that key.
+   */
   readonly cnf?: CapabilityConfirmation;
 };
 /**
@@ -72,7 +81,10 @@ type CapabilityInput = {
 type LinkPolicy = {
   /** Longest a link may live, in seconds from when it was issued. */
   readonly maxLifetime?: number;
-  /** Redeemer kinds allowed; `anyone` also covers a capability without `redeemer`. */
+  /**
+   * Redeemer kinds allowed; `anyone` also covers a capability without
+   * `redeemer`.
+   */
   readonly redeemers?: readonly ("anyone" | "signed-in" | "user" | "scope")[];
   /** Every link must be one-time. */
   readonly once?: boolean;
@@ -86,32 +98,32 @@ type CapabilityOptions = {
   readonly linkPolicy?: LinkPolicy | readonly LinkPolicy[];
 };
 /**
- * The first rule of `policy` the capability breaks, or `undefined`. A
- * lifetime rule without a known `issuedAt`, or one that is not a finite
- * non-negative number, is broken: the check fails closed.
+ * The first rule of `policy` the capability breaks, or `undefined`. A lifetime
+ * rule without a known `issuedAt`, or one that is not a finite non-negative
+ * number, is broken: the check fails closed.
  */
 declare function linkPolicyViolation(capability: Capability, policy: LinkPolicy | readonly LinkPolicy[], issuedAt: number | undefined): LinkPolicyViolation | undefined;
 /**
- * Validates a verified capability (a claim plus `id`, `expiresAt` and
- * an optional `cnf`) and returns a frozen copy, or `undefined`.
+ * Validates a verified capability (a claim plus `id`, `expiresAt` and an
+ * optional `cnf`) and returns a frozen copy, or `undefined`.
  */
 declare function parseCapability(input: unknown): Capability | undefined;
 /**
- * The capability verified claims carry: the `capability` claim, `sub` as
- * `id`, `exp` as `expiresAt` and the RFC 7800 `cnf`. `undefined` when any
- * of them is missing or malformed.
+ * The capability verified claims carry: the `capability` claim, `sub` as `id`,
+ * `exp` as `expiresAt` and the RFC 7800 `cnf`. `undefined` when any of them is
+ * missing or malformed.
  */
 declare function capabilityFromClaims(claims: Readonly<Record<string, unknown>>): Capability | undefined;
 /**
- * Validates an untrusted `capability` claim and returns a frozen copy with
- * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
- * type in a known field rejects the whole claim.
+ * Validates an untrusted `capability` claim and returns a frozen copy with only
+ * the v1 fields, or `undefined`. Unknown fields are dropped; a wrong type in a
+ * known field rejects the whole claim.
  */
 declare function parseCapabilityClaim(input: unknown): CapabilityClaim | undefined;
 /**
- * Signs a capability as a `vnd.permdock.capability+jwt`: `sub` is the link
- * id, `exp` is `expiresAt`, `cnf` binds the redeemer's key, and the signer
- * sets `iss`, `aud`, `iat` (`issuedAt`, else now) and a fresh `jti`.
+ * Signs a capability as a `vnd.permdock.capability+jwt`: `sub` is the link id,
+ * `exp` is `expiresAt`, `cnf` binds the redeemer's key, and the signer sets
+ * `iss`, `aud`, `iat` (`issuedAt`, else now) and a fresh `jti`.
  */
 declare function signCapability(input: CapabilityInput, signer: TokenSigner, options?: CapabilityOptions): Promise<string>;
 //#endregion

package/dist/{casbin-BW9pS47J.js → casbin-H0rKxBx2.js}

@@ -1,5 +1,6 @@
-import { t as applyFiles } from "./files-acUbNwWt.js";
-import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-CTlwMvLI.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
+import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/importers/casbin.ts
@@ -55,7 +56,7 @@ function readCasbinModel(text) {
 	if (policy.slice(0, expected.length).join(",") !== expected.join(",") || policy.length !== expected.length && !withEffect) return { refused: `p = ${policy.join(", ")}: casbin import reads p = ${expected.join(", ")}[, eft]` };
 	const terms = (model.get("matchers")?.get("m") ?? "").replaceAll(/\s+/gu, "").split("&&").filter((term) => term !== "");
 	const unsupported = terms.filter((term) => !MATCHER_TERMS.has(term));
-	if (terms.length === 0 || unsupported.length > 0) return { refused: `the matcher has terms casbin import cannot read: ${unsupported.join(" && ") || "(empty)"}; it reads g(r.sub, p.sub[, r.dom]), r.dom == p.dom, r.obj == p.obj and r.act == p.act` };
+	if (terms.length === 0 || unsupported.length > 0) return { refused: `the matcher has terms casbin import cannot read: ${nonEmptyOr(unsupported.join(" && "), "(empty)")}; it reads g(r.sub, p.sub[, r.dom]), r.dom == p.dom, r.obj == p.obj and r.act == p.act` };
 	const effect = (model.get("policy_effect")?.get("e") ?? "").replaceAll(/\s+/gu, "");
 	const allowOnly = effect === "some(where(p.eft==allow))";
 	const denyOverrides = effect === "some(where(p.eft==allow))&&!some(where(p.eft==deny))";
@@ -78,7 +79,10 @@ function policyLines(text) {
 	}
 	return lines;
 }
-/** Every grant `role` holds through `g` role-to-role lines, its own included; a cycle stops. */
+/**
+* Every grant `role` holds through `g` role-to-role lines, its own included; a
+* cycle stops.
+*/
 function inherited(role, own, parents) {
 	const seen = /* @__PURE__ */ new Set();
 	const grants = [];
@@ -195,17 +199,21 @@ function runCasbinImport(input) {
 		output: "casbin import needs --out <file>"
 	};
 	const modelText = readText(input.cwd, "--model", input.model);
+	if (typeof modelText !== "string") return {
+		code: 2,
+		output: modelText.error
+	};
 	const policyText = readText(input.cwd, "--policy", input.policy);
-	for (const read of [modelText, policyText]) if (typeof read !== "string") return {
+	if (typeof policyText !== "string") return {
 		code: 2,
-		output: read.error
+		output: policyText.error
 	};
-	const model = readCasbinModel(String(modelText));
+	const model = readCasbinModel(modelText);
 	if ("refused" in model) return {
 		code: 2,
 		output: `casbin import --model: ${model.refused}`
 	};
-	const imported = importCasbin(model, String(policyText));
+	const imported = importCasbin(model, policyText);
 	applyFiles(input.cwd, [{
 		path: input.out,
 		text: emitPolicyModule({

package/dist/{casbin-BHijLuHY.js → casbin-cbSbhT_k.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, o as fileOut } from "./flags-aaeRAdiD.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/casbin.ts
 const casbinImport = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-BW9pS47J.js");
+		const { runCasbinImport } = await import("./casbin-H0rKxBx2.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/{casl-CmJlgziS.js → casl-C4OINZHI.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, o as fileOut } from "./flags-aaeRAdiD.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/casl.ts
 const caslImport = defineLeaf({
 	flags: {
@@ -11,7 +11,7 @@ const caslImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCaslImport } = await import("./casl-UbI8v-Wq.js");
+		const { runCaslImport } = await import("./casl-CHHoCldP.js");
 		return runCaslImport({
 			cwd: ctx.cwd,
 			rules: given(flags.rules),

package/dist/{casl-UbI8v-Wq.js → casl-CHHoCldP.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as applyFiles } from "./files-acUbNwWt.js";
-import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-CTlwMvLI.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
+import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/importers/casl.ts
@@ -32,7 +32,10 @@ function isStrings(value) {
 function split(item) {
 	return typeof item === "string" && item.includes(",") ? item.split(",") : item;
 }
-/** A rule in either shape: the object form, or `packRules`' `[action, subject, conditions, inverted, fields]`. */
+/**
+* A rule in either shape: the object form, or `packRules`' `[action, subject,
+* conditions, inverted, fields]`.
+*/
 function readRule(value) {
 	if (Array.isArray(value)) {
 		const [action, subject, conditions, inverted, fields] = value;
@@ -79,7 +82,10 @@ function readValue(value) {
 	}
 	return { unsupported: "a nested object value" };
 }
-/** The Mongo-query subset CASL conditions use, as a `where`; anything else is reported by name. */
+/**
+* The Mongo-query subset CASL conditions use, as a `where`; anything else is
+* reported by name.
+*/
 function readConditions(conditions) {
 	const parts = [];
 	for (const [key, value] of Object.entries(conditions)) {
@@ -143,11 +149,11 @@ function collectActions(rule, subjects, actionsBySubject) {
 	}
 }
 /**
-* CASL rules per role, as PermDock roles: `inverted` rules are denies,
-* `manage` and `all` expand to every action and subject the rules name, and
-* conditions in the portable Mongo-query subset become `where`. A deny whose
-* condition does not import keeps its effect without the condition, so the
-* import can only deny more, never less.
+* CASL rules per role, as PermDock roles: `inverted` rules are denies, `manage`
+* and `all` expand to every action and subject the rules name, and conditions
+* in the portable Mongo-query subset become `where`. A deny whose condition
+* does not import keeps its effect without the condition, so the import can
+* only deny more, never less.
 */
 function importCasl(rulesByRole) {
 	const parsed = [];
@@ -249,7 +255,10 @@ function importCasl(rulesByRole) {
 		skipped
 	};
 }
-/** `permdock casl import`: CASL rules per role into a `permissions` and `policy` module. */
+/**
+* `permdock casl import`: CASL rules per role into a `permissions` and `policy`
+* module.
+*/
 function runCaslImport(input) {
 	if (input.rules === void 0 || input.out === void 0) return {
 		code: 2,