From a911da93d8630823f24e69134f7d5c38b1baf3fe Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 19 Oct 2026 13:34:41 +0200 Subject: [PATCH] Claims: facts are the one owner of a capability-free claim Every shared capability needs a non-empty anyOf, so an empty fact set already yields no capabilities; the explicit empty list beside it was a second owner no test could tell apart from the first. Co-Authored-By: Claude Opus 5.5 --- src/claims.ts | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/claims.ts b/src/claims.ts index b762cbd..4440ed3 100644 --- a/src/claims.ts +++ b/src/claims.ts @@ -90,13 +90,13 @@ export async function issueAccessClaim(options: { const facts = withoutCapabilities ? [] : normalizeFacts(options.input.accountId, options.input.linkedIdentities, options.input.facts); - const sharedCapabilities = withoutCapabilities - ? [] - : evaluateSharedCapabilities(profile, { - accountId: options.input.accountId, - facts: new Set(facts), - identities: options.input.linkedIdentities, - }); + // Every shared capability needs a non-empty anyOf (capability-rules), so an + // empty fact set yields no capabilities: facts are the one owner of that. + const sharedCapabilities = evaluateSharedCapabilities(profile, { + accountId: options.input.accountId, + facts: new Set(facts), + identities: options.input.linkedIdentities, + }); const issuedAt = nowEpochSeconds(); const ttlSeconds = clampTtlSeconds(