@astrale-os/cli 0.8.0-alpha.0 → 0.8.1-alpha.2

package/src/graph/query.ts

@@ -0,0 +1,108 @@
+import type {
+  QueryAST as QueryASTValue,
+  QueryDefinitionRef,
+  QueryDirection,
+} from '@astrale-os/sdk/query'
+
+import { Path } from '@astrale-os/sdk/graph/path'
+import { Query, QueryAST } from '@astrale-os/sdk/query'
+
+export interface QueryCommandInput {
+  readonly sources: readonly string[]
+  readonly definition?: string
+  readonly ast?: unknown
+  readonly edge?: string
+  readonly direction?: QueryDirection
+  readonly limit?: string
+  readonly cursor?: string
+}
+
+export interface PreparedQuery {
+  readonly ast: QueryASTValue
+  readonly page: Readonly<{ readonly size: number; readonly after?: string }>
+}
+
+const DEFAULT_LIMIT = 100
+
+/** Admit canonical Query V6 or author the intentionally small Path/Definition/one-edge subset. */
+export function prepareQuery(input: QueryCommandInput): PreparedQuery {
+  const limit = positiveInteger(input.limit, '--limit', DEFAULT_LIMIT)
+  if (input.ast !== undefined) {
+    if (
+      input.sources.length > 0 ||
+      input.definition !== undefined ||
+      input.edge !== undefined ||
+      input.direction !== undefined
+    ) {
+      throw new TypeError(
+        '--ast/--file cannot be combined with sources, --definition, --edge, or --direction',
+      )
+    }
+    return withPage(QueryAST.decode(input.ast), limit, input.cursor)
+  }
+
+  if (input.sources.length === 0 && input.definition === undefined) {
+    throw new TypeError(
+      'query requires a Path source, --definition, or a canonical Query V6 document',
+    )
+  }
+  if (input.direction !== undefined && input.edge === undefined) {
+    throw new TypeError('--direction requires --edge')
+  }
+
+  const paths = input.sources.map((source) => Path.parse(source))
+  const definition = input.definition === undefined ? undefined : definitionRef(input.definition)
+  const query =
+    paths.length > 0
+      ? Query.from({
+          kind: 'node',
+          paths: paths as [Path, ...Path[]],
+          ...(definition === undefined ? {} : { definitions: [definition] }),
+        })
+      : Query.from({ kind: 'node', definitions: [definition!] })
+  const ast =
+    input.edge === undefined
+      ? query.select({ kind: 'graph' })
+      : query
+          .expand({
+            via: [definitionRef(input.edge)],
+            direction: input.direction ?? 'outgoing',
+          })
+          .select({ kind: 'graph' })
+  return withPage(ast, limit, input.cursor)
+}
+
+function definitionRef(input: string): QueryDefinitionRef {
+  const path = Path.parse(input)
+  const step = path.ast.steps[0]
+  if (
+    path.ast.anchor.kind !== 'domain' ||
+    path.ast.steps.length !== 1 ||
+    step?.kind !== 'projection' ||
+    (step.projection.kind !== 'class' && step.projection.kind !== 'interface')
+  ) {
+    throw new TypeError('--definition must be one canonical Class or Interface Path')
+  }
+  return Object.freeze({
+    origin: path.ast.anchor.origin,
+    kind: step.projection.kind,
+    name: step.projection.name,
+  })
+}
+
+function positiveInteger(raw: string | undefined, name: string, fallback: number): number {
+  if (raw === undefined) return fallback
+  if (!/^\d+$/.test(raw)) throw new TypeError(`${name} must be a positive integer`)
+  const value = Number.parseInt(raw, 10)
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new TypeError(`${name} must be a positive integer`)
+  }
+  return value
+}
+
+function withPage(ast: QueryASTValue, size: number, cursor: string | undefined): PreparedQuery {
+  return Object.freeze({
+    ast,
+    page: Object.freeze({ size, ...(cursor === undefined ? {} : { after: cursor }) }),
+  })
+}

package/src/graph/tsconfig.json

@@ -0,0 +1,6 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": { "types": ["@types/node"] },
+  "include": ["*.ts"],
+  "exclude": ["__tests__"]
+}

package/src/identity/.history/ard/bootstrap-root-transfer.md

@@ -0,0 +1,57 @@
+# Bootstrap root transfer and child authority
+
+Status: resolved
+Impact: high
+Selection: identity-export-v1-and-authenticated-management-delegation
+
+## Context
+
+A production Host creates the manager Kernel's signing material before the CLI has any local state.
+Qualification may mount that generated secret into the operator environment, but it must not
+manufacture the CLI registry or key files. The Host producer and CLI importer previously agreed only
+through coincident TypeScript object shapes. The root-to-child journey was also distributed across
+Host, Runtime, Client, and CLI behavior, leaving room to confuse a manager-signed Management carrier
+with the effective child principal.
+
+## Decision
+
+https://schemas.astrale.ai/cli/identity-export/1 is the portable JSON Schema for the plaintext
+IdentityExport V1 envelope. CLI Identity owns and publishes that schema. Structural schema admission
+does not prove a keypair: identity import additionally proves that the private and public JWKs form
+one pair before publishing either keys or registry state.
+
+The Host secret generator emits one schema-conforming identity.json with mode 0600. The platform
+runner imports it through:
+
+    astrale identity import <identity.json> --name platform-root
+
+The imported root is the manager Kernel principal. It is never provisioned or registered as an
+application identity. The manager bookmark uses the non-reserved alias platform-manager, pins the
+manager issuer, and selects platform-root as its default identity. Manager identity is proved by the
+authenticated public Identity.whoami syscall, not local CLI status.
+
+Because this credential is issued by the target Kernel itself, CLI signing carries the imported
+subject as an already-resolved identity Grant. The external-primary `{ identity: self }` form is not
+valid for a self-issued Kernel bearer and cannot be substituted at this boundary.
+
+Child creation is the public receiver call
+/:host.astrale.ai:core.manager::createInstance. Once its Operation and Instance status report a
+ready route and issuer, the canonical child credential is minted at the manager:
+
+    astrale token -i platform-manager --for platform-root --audience <child-issuer> --raw
+
+That token is a manager-to-child Management carrier. Its outer JWT subject names the manager
+principal; child Runtime maps it to the child Kernel principal. Child calls therefore keep the token
+as --creds, and @self resolves through the child's authenticated Identity.whoami. The child bookmark
+pins the child issuer and carries no --as platform-root default.
+
+## Consequences
+
+- Bootstrap crosses one explicit file contract and one supported CLI command; no CLI state file is
+  fabricated.
+- Direct manager signing and child Management delegation remain distinct.
+- No consumer may infer the effective principal from an unverified JWT subject or cached
+  registration.
+- The portable schema is structural and versioned; cryptographic pair proof remains CLI admission.
+- A future encrypted Host-to-CLI bootstrap format requires a new explicit deployment decision. CLI's
+  interactive compact-JWE export remains an operator transfer representation, not Host output.

package/src/identity/.history/ard/domain-mediated-registration.md

@@ -0,0 +1,36 @@
+# Domain-mediated Identity registration
+
+Status: resolved
+Impact: high
+Selection: explicit-authority-owner-callable
+
+## Context
+
+`identity register` prepares an atomic graph Node and self-proven Identity designation. Submitting
+that request directly to Kernel Auth is correct only when the authenticated caller already holds
+creation authority for the chosen Class. A child Kernel management principal does not thereby own
+an installed application Domain's `Operator` Class, and production correctly denied that attempted
+authority substitution.
+
+The CLI must still own local key proof and target-bound registration state. Manufacturing CLI state,
+handing application credentials to the operator, or weakening mutation authorization would cross
+the wrong boundary.
+
+## Decision
+
+Registration retains direct Auth submission as its default. `--via <callablePath>` selects a second,
+explicit submission boundary: after constructing the exact same Provision request and fingerprint-
+bound self proof, CLI invokes the named Domain callable through the normal Host route. That callable
+owns admission and may exercise its Domain authority to submit the request to Kernel Auth.
+
+CLI treats the callable response as untrusted. It admits the prepared binding's issuer, subject, and
+optional created Node ID, then stores only the target-keyed issuer and subject. It never accepts or
+persists application authority, and it never exposes the self proof in argv or output.
+
+## Consequences
+
+- Kernel mutation non-amplification remains unchanged.
+- A Domain that offers registration must declare and authorize a Provision-shaped callable.
+- The option is explicit because choosing the authority owner is security-significant.
+- Direct registration remains useful for Classes the selected caller genuinely owns.
+- A failed callable or malformed response leaves CLI registration state unchanged.

package/src/identity/.spec/api.d.ts

@@ -0,0 +1,124 @@
+import type { Call } from '@astrale-os/kernel-client'
+import type { ProvisionRequest } from '@astrale-os/sdk/auth'
+import type { LocalBinding } from '@astrale-os/sdk/graph/model'
+import type { JWK } from 'jose'
+
+import type {
+  Identity,
+  IdentityMode,
+  IdentityStore,
+  IdentityStoreOptions,
+  Registration,
+} from '../../state/.spec/api.js'
+
+export type { Identity, IdentityStore, Registration } from '../../state/.spec/api.js'
+
+/** Filesystem coordinates used only by explicit identity transfer operations. */
+export interface IdentityFileOptions {
+  readonly state?: IdentityStoreOptions
+  readonly keysDir?: string
+}
+
+/** Canonical V1 key-identity transfer envelope. */
+export interface IdentityExport {
+  readonly version: 1
+  readonly subject: string
+  readonly mode: IdentityMode
+  readonly kid?: string
+  readonly issuer?: string
+  readonly privateJwk: JWK
+  readonly publicJwk: JWK
+}
+
+export interface IdentityImportOptions extends IdentityFileOptions {
+  readonly name?: string
+  readonly issuer?: string
+  readonly replace?: boolean
+}
+
+export interface IdentityRegistrationResult {
+  readonly iss: string
+  readonly sub: string
+  readonly nodeId?: string
+}
+
+export interface IdentityProvisionSubmission {
+  readonly request: ProvisionRequest
+  readonly binding: LocalBinding
+  readonly via?: string
+  readonly direct: {
+    provision(request: ProvisionRequest): Promise<unknown>
+  }
+  readonly callable: {
+    call(call: Call): Promise<unknown>
+  }
+}
+
+/** Submit one prepared request either directly or through its explicit Domain authority owner. */
+export function submitIdentityProvision(
+  input: IdentityProvisionSubmission,
+): Promise<IdentityRegistrationResult>
+
+/** Admit only the exact binding the CLI prepared; remote callables remain untrusted input. */
+export function acceptProvisionedIdentity(
+  value: unknown,
+  binding: LocalBinding,
+): IdentityRegistrationResult
+
+export function readIdentities(): Promise<IdentityStore>
+
+export function createIdentity(
+  name: string,
+  options?: {
+    readonly subject?: string
+    readonly mode?: IdentityMode
+    readonly issuer?: string
+    readonly kid?: string
+  },
+): Promise<Identity>
+
+export function deleteIdentity(name: string): Promise<void>
+export function setDefault(name: string): Promise<void>
+export function getDefault(): Promise<Identity & { readonly name: string }>
+export function getIdentity(name: string): Promise<Identity>
+
+export function upsertIdpIdentity(
+  name: string,
+  options: {
+    readonly subject: string
+    readonly idp: string
+    readonly issuer: string
+    readonly audience?: string
+    readonly claims?: Readonly<Record<string, unknown>>
+    readonly use?: boolean
+  },
+): Promise<Identity>
+
+export function setRegistration(
+  name: string,
+  instanceSlug: string,
+  registration: Registration,
+): Promise<void>
+
+export function setIdentityMode(name: string, mode: IdentityMode): Promise<void>
+
+/** Detect the retained compact-JWE representation without decoding it. */
+export function isEncryptedIdentityExport(raw: string): boolean
+
+/** Decode legacy plaintext, V1 plaintext, or compact-JWE content into one admitted V1 envelope. */
+export function decodeIdentityExport(raw: string, passphrase?: string): Promise<IdentityExport>
+
+/** Encode one admitted envelope as plaintext JSON or compact JWE. */
+export function encodeIdentityExport(envelope: IdentityExport, passphrase?: string): Promise<string>
+
+/** Read and prove one key-backed identity's transferable envelope. */
+export function exportIdentity(name: string, options?: IdentityFileOptions): Promise<IdentityExport>
+
+/** Import one admitted envelope after checking registry conflicts but before publishing registry state. */
+export function importIdentity(
+  envelope: IdentityExport,
+  options?: IdentityImportOptions,
+): Promise<Identity>
+
+/** Atomically publish one explicit private export file with mode 0600. */
+export function writeIdentityExport(path: string, content: string): Promise<void>

package/src/identity/.spec/architecture.md

@@ -0,0 +1,33 @@
+# CLI identity ownership
+
+Identity owns local identity selection and the coordination between the State registry, per-subject
+Keys, and IdP sessions. State owns durable registry decoding and locking; Keys owns JWK admission,
+pair proof, and private files. Commands own prompts and presentation, not persistence mechanics.
+
+Identity transfer accepts the retained unversioned plaintext envelope and the current V1 plaintext
+or compact-JWE representation. Admission completes before mutation. Import checks the registry under
+its file lock, persists the admitted keypair, and only then publishes the identity entry. Export
+proves the stored pair and atomically writes one mode-`0600` user-selected file.
+
+The canonical plaintext V1 structure is independently published as
+`https://schemas.astrale.ai/cli/identity-export/1`. A production Host may emit that envelope as its
+bootstrap root secret, but CLI Identity remains the format owner and cryptographically proves the
+pair on import. The governing bootstrap flow imports the root as `platform-root`, authenticates it
+directly to the `platform-manager` Kernel, and reaches a child only through a manager-minted
+child-audience Management carrier. The carrier's outer subject is not the child's effective
+principal; authenticated child `Identity.whoami` owns that projection.
+
+Identity registration always prepares one self-proven atomic Provision request. Direct registration
+submits it to Kernel Auth only when the selected caller already owns the target Class authority. An
+explicit `--via <callable>` instead sends those exact bytes through the Domain that owns an
+application Identity Class. The Domain callable owns admission and effect authority; CLI admits only
+the prepared binding from the response before persisting its target-bound `(issuer, subject)`.
+
+```mermaid
+flowchart LR
+  C[identity command] --> D[decode or encode transfer]
+  D --> I[Identity orchestration]
+  I --> S[State registry lock]
+  I --> K[Keys pair proof and files]
+  S --> F[identities.json]
+```

package/src/identity/.spec/capabilities/identity.ts

@@ -0,0 +1,7 @@
+import { defineCapability } from '@astrale-os/spec/authoring'
+
+export const CLI_IDENTITY = defineCapability({
+  id: 'CLI-IDENTITY',
+  statement:
+    'Preserves local identity selection, isolated key material, and explicit import/export journeys.',
+})

package/src/identity/.spec/flows/bootstrap-root.ts

@@ -0,0 +1,79 @@
+import type { IdentityExport } from '../api.js'
+
+interface Target {
+  readonly name: string
+  readonly url: string
+  readonly issuer: string
+}
+
+interface ReadyChild {
+  readonly target: Target
+  readonly operation: string
+  readonly instance: string
+}
+
+interface BootstrapAuthority {
+  /** Supported identity-import boundary; never a direct State or Keys write. */
+  importIdentity(input: {
+    readonly name: 'platform-root'
+    readonly envelope: IdentityExport
+  }): Promise<void>
+  bookmark(input: {
+    readonly target: Target
+    readonly defaultIdentity?: 'platform-root'
+  }): Promise<void>
+  /** Authenticated public Identity.whoami result on the selected target. */
+  whoami(input: {
+    readonly target: Target
+    readonly as?: 'platform-root'
+    readonly credential?: string
+  }): Promise<{ readonly id: string }>
+  /** Public manager createInstance call plus Operation and Instance status polling. */
+  callCreateChild(input: {
+    readonly manager: Target
+    readonly as: 'platform-root'
+    readonly operationId: string
+    readonly slug: string
+  }): Promise<ReadyChild>
+  /** Public Auth delegation invoked on the manager after authenticated whoami. */
+  delegateSelf(input: {
+    readonly manager: Target
+    readonly as: 'platform-root'
+    readonly principal: string
+    readonly audience: string
+  }): Promise<string>
+}
+
+/**
+ * Bootstrap uses the imported root directly on the manager, then an unchanged
+ * manager-to-child Management carrier whose effective child principal is
+ * established only by the child's authenticated whoami result.
+ */
+export async function bootstrapRootAndChild(
+  authority: BootstrapAuthority,
+  input: {
+    readonly envelope: IdentityExport
+    readonly manager: Target & { readonly name: 'platform-manager' }
+    readonly childSlug: string
+    readonly operationId: string
+  },
+): Promise<{ readonly managerId: string; readonly childId: string; readonly child: ReadyChild }> {
+  await authority.importIdentity({ name: 'platform-root', envelope: input.envelope })
+  await authority.bookmark({ target: input.manager, defaultIdentity: 'platform-root' })
+  const manager = await authority.whoami({ target: input.manager, as: 'platform-root' })
+  const child = await authority.callCreateChild({
+    manager: input.manager,
+    as: 'platform-root',
+    operationId: input.operationId,
+    slug: input.childSlug,
+  })
+  const credential = await authority.delegateSelf({
+    manager: input.manager,
+    as: 'platform-root',
+    principal: manager.id,
+    audience: child.target.issuer,
+  })
+  await authority.bookmark({ target: child.target })
+  const effectiveChild = await authority.whoami({ target: child.target, credential })
+  return { managerId: manager.id, childId: effectiveChild.id, child }
+}

package/src/identity/.spec/flows/domain-mediated-registration.ts

@@ -0,0 +1,51 @@
+import type { ProvisionRequest, ProvisionResult } from '@astrale-os/sdk/auth'
+import type { LocalBinding } from '@astrale-os/sdk/mutation'
+
+interface RegistrationAuthority {
+  prepareSelfProven(input: {
+    readonly identity: string
+    readonly classPath: string
+    readonly properties: Readonly<Record<string, unknown>>
+    readonly kernelIssuer: string
+  }): Promise<{ readonly binding: LocalBinding; readonly request: ProvisionRequest }>
+  call(input: {
+    readonly target: string
+    readonly request: ProvisionRequest
+  }): Promise<ProvisionResult>
+  persist(input: {
+    readonly identity: string
+    readonly targetKey: string
+    readonly issuer: string
+    readonly subject: string
+  }): Promise<void>
+}
+
+/** Application Identity Classes are provisioned only through their explicit authority owner. */
+export async function registerThroughDomain(
+  authority: RegistrationAuthority,
+  input: {
+    readonly identity: string
+    readonly classPath: string
+    readonly properties: Readonly<Record<string, unknown>>
+    readonly kernelIssuer: string
+    readonly targetKey: string
+    readonly callable: string
+  },
+): Promise<{ readonly issuer: string; readonly subject: string; readonly nodeId?: string }> {
+  const prepared = await authority.prepareSelfProven(input)
+  const result = await authority.call({ target: input.callable, request: prepared.request })
+  const identity = result.identities[prepared.binding]
+  if (identity === undefined) throw new Error('Provision result omitted the prepared binding.')
+  await authority.persist({
+    identity: input.identity,
+    targetKey: input.targetKey,
+    issuer: identity.issuer,
+    subject: identity.subject,
+  })
+  const nodeId = result.createdNodes[prepared.binding]
+  return {
+    issuer: identity.issuer,
+    subject: identity.subject,
+    ...(nodeId === undefined ? {} : { nodeId }),
+  }
+}

package/src/identity/.spec/flows/import.ts

@@ -0,0 +1,29 @@
+import type { Identity, IdentityExport, IdentityImportOptions, IdentityStore } from '../api.js'
+
+declare const withIdentityLock: <Value>(transition: () => Promise<Value>) => Promise<Value>
+declare const readLatest: () => Promise<IdentityStore>
+declare const checkImportConflict: (
+  store: IdentityStore,
+  envelope: IdentityExport,
+  options: IdentityImportOptions,
+) => string
+declare const persistAdmittedKeypair: (envelope: IdentityExport) => Promise<void>
+declare const publishIdentity: (
+  store: IdentityStore,
+  name: string,
+  envelope: IdentityExport,
+  options: IdentityImportOptions,
+) => Promise<Identity>
+
+/** Import performs all fallible admission before entering this ordered persistence flow. */
+export function importIdentity(
+  envelope: IdentityExport,
+  options: IdentityImportOptions,
+): Promise<Identity> {
+  return withIdentityLock(async () => {
+    const store = await readLatest()
+    const name = checkImportConflict(store, envelope, options)
+    await persistAdmittedKeypair(envelope)
+    return publishIdentity(store, name, envelope, options)
+  })
+}

package/src/identity/.spec/laws/identity.ts

@@ -0,0 +1,56 @@
+import { defineLaw } from '@astrale-os/spec/authoring'
+
+export const CLI_IDENTITY_REGISTRY_TRANSITIONS = defineLaw({
+  id: 'CLI-IDENTITY-REGISTRY-TRANSITIONS',
+  statement:
+    'Create, selection, registration, mode change, and non-default deletion preserve one locked registry and isolated subject keypair; deleting the selected identity is rejected unchanged.',
+  tests: [{ file: '__tests__/registry.test.ts', id: 'TEST-CLI-IDENTITY-REGISTRY-JOURNEY' }],
+})
+
+export const CLI_IDENTITY_TRANSFER_ADMITTED = defineLaw({
+  id: 'CLI-IDENTITY-TRANSFER-ADMITTED',
+  statement:
+    'Malformed, unsupported-version, or cryptographically mismatched transfer content is rejected before either key files or registry state changes.',
+  tests: [{ file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-TRANSFER-REJECTS' }],
+})
+
+export const CLI_IDENTITY_TRANSFER_ROUNDTRIP = defineLaw({
+  id: 'CLI-IDENTITY-TRANSFER-ROUNDTRIP',
+  statement:
+    'Legacy plaintext and V1 plaintext or compact-JWE content converge on one V1 envelope, and explicit exports are published atomically with mode 0600.',
+  tests: [
+    { file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-TRANSFER-ROUNDTRIP' },
+    { file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-EXPORT-PRIVATE' },
+  ],
+})
+
+export const CLI_IDENTITY_TRANSFER_SCHEMA = defineLaw({
+  id: 'CLI-IDENTITY-TRANSFER-SCHEMA',
+  statement:
+    'Plaintext IdentityExport V1 has one independently versioned portable JSON Schema; decoding additionally proves the JWK pair before any durable mutation.',
+  tests: [
+    {
+      file: '__tests__/transfer.test.ts',
+      id: 'TEST-CLI-IDENTITY-TRANSFER-SCHEMA',
+    },
+  ],
+})
+
+export const CLI_IDENTITY_IMPORT_ORDERED = defineLaw({
+  id: 'CLI-IDENTITY-IMPORT-ORDERED',
+  statement:
+    'Import checks name and identity-source conflicts under the registry lock before replacing keys, then publishes the registry only after the admitted pair is durable.',
+  tests: [{ file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-IMPORT-ORDERED' }],
+})
+
+export const CLI_IDENTITY_REGISTRATION_AUTHORITY = defineLaw({
+  id: 'CLI-IDENTITY-REGISTRATION-AUTHORITY',
+  statement:
+    'Identity registration binds one self-proven Provision request to the selected Kernel; direct submission uses caller authority, while explicit Domain-mediated submission sends the same request to the named callable and persists only its admitted prepared binding.',
+  tests: [
+    {
+      file: '__tests__/registration.test.ts',
+      id: 'TEST-CLI-IDENTITY-REGISTER-DOMAIN-MEDIATED',
+    },
+  ],
+})

package/src/identity/.spec/layout.ts

@@ -0,0 +1,13 @@
+import { defineLayout } from '@astrale-os/spec/authoring'
+
+export default defineLayout({
+  entries: [
+    '__tests__/',
+    'index.ts',
+    'registration.ts',
+    'registry.ts',
+    'transfer.ts',
+    'tsconfig.json',
+  ],
+  exact: true,
+})

package/src/identity/.spec/schemas/identity-export-v1.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.astrale.ai/cli/identity-export/1",
+  "title": "Astrale Identity Export V1",
+  "description": "Portable plaintext key-identity transfer envelope consumed by the Astrale CLI.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "subject", "privateJwk", "publicJwk"],
+  "properties": {
+    "version": { "const": 1 },
+    "subject": { "type": "string", "minLength": 1 },
+    "mode": { "enum": ["local", "remote"] },
+    "kid": { "type": "string", "minLength": 1 },
+    "issuer": { "type": "string", "format": "uri" },
+    "privateJwk": { "$ref": "#/$defs/jwk" },
+    "publicJwk": { "$ref": "#/$defs/jwk" }
+  },
+  "$defs": {
+    "jwk": {
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true
+    }
+  }
+}