@astrale-os/kernel-core 0.9.0-beta.39 → 0.9.0-beta.40

package/dist/auth/index.d.ts

@@ -10,7 +10,7 @@ export type { Grant, UnresolvedGrant } from './grant/index.js';
 export type { Authentication, Identity, IdentityId, Subject } from './identity/index.js';
 export type { IssuerId } from './issuer/index.js';
 export type { JsonWebKey, KeyId } from './jwk/index.js';
-export type { AuthenticationProvision, IdentityProvision, ProvisionFingerprint, ProvisionRequest, ProvisionResult, ProvisionedIdentity, RequiredClaims, } from './provision/index.js';
+export type { IdentityRegistration, RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, RegisterRequest, RegisterResult, RegisteredIdentity, } from './register/index.js';
 export type { AuthenticationCandidate, AuthenticationTrust, StringPatternSet, TrustDecision, TrustRule, } from './trust/index.js';
 export * as attestation from './attestation/index.js';
 export * as authority from './authority/index.js';
@@ -22,5 +22,5 @@ export * as grant from './grant/index.js';
 export * as identity from './identity/index.js';
 export * as issuer from './issuer/index.js';
 export * as jwk from './jwk/index.js';
-export * as provision from './provision/index.js';
+export * as register from './register/index.js';
 export * as trust from './trust/index.js';

package/dist/auth/index.js

@@ -9,5 +9,5 @@ export * as grant from './grant/index.js';
 export * as identity from './identity/index.js';
 export * as issuer from './issuer/index.js';
 export * as jwk from './jwk/index.js';
-export * as provision from './provision/index.js';
+export * as register from './register/index.js';
 export * as trust from './trust/index.js';

package/dist/auth/jwk/index.d.ts

@@ -1,3 +1,3 @@
 export { acceptPublic } from './public-key.js';
-export { thumbprint } from './thumbprint.js';
+export { thumbprint, thumbprintMembers } from './thumbprint.js';
 export type { JsonWebKey, KeyId } from './public-key.js';

package/dist/auth/jwk/index.js

@@ -1,2 +1,2 @@
 export { acceptPublic } from './public-key.js';
-export { thumbprint } from './thumbprint.js';
+export { thumbprint, thumbprintMembers } from './thumbprint.js';

package/dist/auth/jwk/thumbprint.d.ts

@@ -1,3 +1,5 @@
 import type { JsonWebKey } from './public-key.js';
 /** Compute the RFC 7638 SHA-256 thumbprint of an admitted public key. */
 export declare function thumbprint(input: JsonWebKey): Promise<string>;
+/** Return the exact RFC 7638 members that identify one public key's cryptographic material. */
+export declare function thumbprintMembers(input: JsonWebKey): Readonly<Record<string, string>>;

package/dist/auth/jwk/thumbprint.js

@@ -1,19 +1,25 @@
 import { acceptPublic } from './public-key.js';
 /** Compute the RFC 7638 SHA-256 thumbprint of an admitted public key. */
 export async function thumbprint(input) {
-    const key = acceptPublic(input);
-    const canonical = JSON.stringify(members(key));
+    const canonical = JSON.stringify(thumbprintMembers(input));
     const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical)));
     return base64url(digest);
 }
-function members(key) {
+/** Return the exact RFC 7638 members that identify one public key's cryptographic material. */
+export function thumbprintMembers(input) {
+    const key = acceptPublic(input);
     if (key.kty === 'EC') {
-        return { crv: key.crv, kty: key.kty, x: key.x, y: key.y };
+        return Object.freeze({
+            crv: key.crv,
+            kty: key.kty,
+            x: key.x,
+            y: key.y,
+        });
     }
     if (key.kty === 'RSA') {
-        return { e: key.e, kty: key.kty, n: key.n };
+        return Object.freeze({ e: key.e, kty: key.kty, n: key.n });
     }
-    return { crv: key.crv, kty: key.kty, x: key.x };
+    return Object.freeze({ crv: key.crv, kty: key.kty, x: key.x });
 }
 function base64url(input) {
     let binary = '';

package/dist/auth/register/fingerprint/fingerprint.d.ts

@@ -0,0 +1,25 @@
+import type { Authentication, IdentityId } from '../../identity/index.js';
+import type { JsonWebKey } from '../../jwk/index.js';
+declare const REGISTER_FINGERPRINT: unique symbol;
+/** Digest of the semantic request. Credential bytes and verifier evidence are excluded. */
+export type RegisterFingerprint = `sha256:${string}` & {
+    readonly [REGISTER_FINGERPRINT]: true;
+};
+export type RegisterFingerprintIdentity = {
+    readonly id: IdentityId;
+    readonly mode: 'external';
+    readonly authentication: Authentication;
+    readonly publicKey?: never;
+} | {
+    readonly id: IdentityId;
+    readonly mode: 'self';
+    readonly authentication: Authentication;
+    readonly publicKey: JsonWebKey;
+};
+export interface RegisterFingerprintInput {
+    readonly idempotencyKey: string;
+    readonly identities: readonly [RegisterFingerprintIdentity, ...RegisterFingerprintIdentity[]];
+}
+/** Compute a deterministic post-verification digest without retaining credential evidence. */
+export declare function fingerprint(input: RegisterFingerprintInput): Promise<RegisterFingerprint>;
+export {};

package/dist/auth/register/fingerprint/fingerprint.js

@@ -0,0 +1,31 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { thumbprint as jwkThumbprint } from '../../jwk/index.js';
+/** Compute a deterministic post-verification digest without retaining credential evidence. */
+export async function fingerprint(input) {
+    const identities = await Promise.all([...input.identities]
+        .sort((left, right) => compare(left.id, right.id))
+        .map(async (identity) => ({
+        id: identity.id,
+        mode: identity.mode,
+        iss: identity.authentication.iss,
+        sub: identity.authentication.sub,
+        ...(identity.mode === 'self' ? { publication: await publication(identity.publicKey) } : {}),
+    })));
+    const encoded = portable.json.encode(portable.accept({ version: 2, idempotencyKey: input.idempotencyKey, identities }));
+    const digest = await crypto.subtle.digest('SHA-256', Uint8Array.from(encoded).buffer);
+    return `sha256:${hex(new Uint8Array(digest))}`;
+}
+async function publication(publicKey) {
+    const thumbprint = await jwkThumbprint(publicKey);
+    return Object.freeze({
+        key: publicKey,
+        thumbprint,
+        slot: publicKey.kid === undefined ? `thumbprint:${thumbprint}` : `kid:${publicKey.kid}`,
+    });
+}
+function hex(input) {
+    return [...input].map((value) => value.toString(16).padStart(2, '0')).join('');
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/register/fingerprint/index.d.ts

@@ -0,0 +1,2 @@
+export { fingerprint } from './fingerprint.js';
+export type { RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, } from './fingerprint.js';

package/dist/auth/register/index.d.ts

@@ -0,0 +1,5 @@
+export { fingerprint } from './fingerprint/index.js';
+export type { RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, } from './fingerprint/index.js';
+export { accept, isSelfIssuer, selfIssuer } from './request/index.js';
+export type { IdentityRegistration, RegisterRequest } from './request/index.js';
+export type { RegisteredIdentity, RegisterResult } from './result/index.js';

package/dist/auth/register/request/admission.d.ts

@@ -0,0 +1,3 @@
+import type { RegisterRequest } from './request.js';
+/** Admit unknown input into the exact immutable existing-target Register language. */
+export declare function accept(input: unknown): RegisterRequest;

package/dist/auth/register/request/admission.js

@@ -0,0 +1,103 @@
+import { NodeId } from '../../../graph/node/index.js';
+import { AuthValueError } from '../../error.js';
+import { acceptPublic } from '../../jwk/index.js';
+import { REGISTER_REQUEST_LIMITS } from './limits.js';
+const textEncoder = new TextEncoder();
+/** Admit unknown input into the exact immutable existing-target Register language. */
+export function accept(input) {
+    if (!isRecord(input))
+        invalid('', 'Expected a Register request object');
+    exact(input, ['idempotencyKey', 'identities'], '');
+    if (typeof input.idempotencyKey !== 'string' ||
+        input.idempotencyKey.length === 0 ||
+        input.idempotencyKey.length > REGISTER_REQUEST_LIMITS.idempotencyKeyCharacters ||
+        textEncoder.encode(input.idempotencyKey).byteLength >
+            REGISTER_REQUEST_LIMITS.idempotencyKeyBytes) {
+        invalid('/idempotencyKey', 'Expected a bounded non-empty idempotency key');
+    }
+    if (!Array.isArray(input.identities) ||
+        input.identities.length === 0 ||
+        input.identities.length > REGISTER_REQUEST_LIMITS.identities) {
+        invalid('/identities', 'Expected a bounded non-empty Identity register array');
+    }
+    const identities = input.identities
+        .map((candidate, index) => identityInput(candidate, `/identities/${index}`))
+        .sort((left, right) => compare(left.id, right.id));
+    for (let index = 1; index < identities.length; index += 1) {
+        if (identities[index - 1].id === identities[index].id) {
+            invalid(`/identities/${index}/id`, 'Duplicate Identity target');
+        }
+    }
+    return Object.freeze({
+        idempotencyKey: input.idempotencyKey,
+        identities: Object.freeze(identities),
+    });
+}
+function identityInput(input, path) {
+    if (!isRecord(input))
+        invalid(path, 'Expected an Identity register object');
+    if (input.mode !== 'external' && input.mode !== 'self') {
+        invalid(`${path}/mode`, 'Expected external or self');
+    }
+    exact(input, input.mode === 'self'
+        ? ['credential', 'id', 'mode', 'publicKey']
+        : ['credential', 'id', 'mode'], path);
+    let id;
+    try {
+        if (typeof input.id !== 'string')
+            throw new TypeError('IdentityId must be text.');
+        id = NodeId(input.id);
+    }
+    catch (cause) {
+        invalid(`${path}/id`, 'Expected an IdentityId', cause);
+    }
+    const credential = credentialInput(input.credential, `${path}/credential`);
+    if (input.mode === 'external') {
+        return Object.freeze({ id, mode: 'external', credential });
+    }
+    return Object.freeze({
+        id,
+        mode: 'self',
+        publicKey: publicJwk(input.publicKey, `${path}/publicKey`),
+        credential,
+    });
+}
+function credentialInput(input, path) {
+    if (typeof input === 'string') {
+        const bytes = textEncoder.encode(input).byteLength;
+        if (bytes === 0 || bytes > REGISTER_REQUEST_LIMITS.credentialBytes) {
+            invalid(path, `Credential must contain 1-${REGISTER_REQUEST_LIMITS.credentialBytes} bytes`);
+        }
+        return input;
+    }
+    if (!(input instanceof Uint8Array) ||
+        input.byteLength === 0 ||
+        input.byteLength > REGISTER_REQUEST_LIMITS.credentialBytes) {
+        invalid(path, `Credential must contain 1-${REGISTER_REQUEST_LIMITS.credentialBytes} bytes`);
+    }
+    return input.slice();
+}
+function publicJwk(input, path) {
+    try {
+        return acceptPublic(input);
+    }
+    catch (cause) {
+        invalid(path, 'Expected a thumbprintable public JWK', cause);
+    }
+}
+function exact(input, expected, path) {
+    const actual = Object.keys(input).sort(compare);
+    const wanted = [...expected].sort(compare);
+    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+        invalid(path, `Expected exactly ${expected.join(', ')}`);
+    }
+}
+function isRecord(input) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input);
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid(path, message, cause) {
+    throw new AuthValueError('AUTH_REGISTER_REQUEST_INVALID', message, path, cause === undefined ? undefined : { cause });
+}

package/dist/auth/register/request/index.d.ts

@@ -0,0 +1,3 @@
+export { accept } from './admission.js';
+export { isSelfIssuer, selfIssuer } from './self-issuer.js';
+export type { IdentityRegistration, RegisterRequest } from './request.js';

package/dist/auth/register/request/limits.d.ts

@@ -0,0 +1,6 @@
+export declare const REGISTER_REQUEST_LIMITS: Readonly<{
+    credentialBytes: number;
+    idempotencyKeyBytes: 1024;
+    idempotencyKeyCharacters: 256;
+    identities: 256;
+}>;

package/dist/auth/register/request/limits.js

@@ -0,0 +1,6 @@
+export const REGISTER_REQUEST_LIMITS = Object.freeze({
+    credentialBytes: 64 * 1024,
+    idempotencyKeyBytes: 1_024,
+    idempotencyKeyCharacters: 256,
+    identities: 256,
+});

package/dist/auth/register/request/request.d.ts

@@ -0,0 +1,19 @@
+import type { CredentialInput } from '../../credential/input/index.js';
+import type { IdentityId } from '../../identity/index.js';
+import type { JsonWebKey } from '../../jwk/index.js';
+export type IdentityRegistration = {
+    readonly id: IdentityId;
+    readonly mode: 'external';
+    readonly credential: CredentialInput;
+    readonly publicKey?: never;
+} | {
+    readonly id: IdentityId;
+    readonly mode: 'self';
+    readonly publicKey: JsonWebKey;
+    readonly credential: CredentialInput;
+};
+/** Claim credential-evidenced Authentication for existing Identity-bearing Nodes. */
+export interface RegisterRequest {
+    readonly idempotencyKey: string;
+    readonly identities: readonly [IdentityRegistration, ...IdentityRegistration[]];
+}

package/dist/auth/{provision → register}/request/self-issuer.d.ts

@@ -1,6 +1,6 @@
 import type { IssuerId } from '../../issuer/index.js';
 import type { JsonWebKey } from '../../jwk/index.js';
-/** Build the hosted issuer controlled by one self-provisioned public key. */
+/** Build the hosted issuer controlled by one self-registered public key. */
 export declare function selfIssuer(kernel: IssuerId, publicKey: JsonWebKey): Promise<IssuerId>;
 /** Whether an issuer is one exact key-bound issuer hosted by this Kernel. */
 export declare function isSelfIssuer(kernel: IssuerId, candidate: IssuerId): boolean;

package/dist/auth/{provision → register}/request/self-issuer.js

@@ -1,6 +1,6 @@
 import { accept as acceptIssuer } from '../../issuer/index.js';
 import { thumbprint } from '../../jwk/index.js';
-/** Build the hosted issuer controlled by one self-provisioned public key. */
+/** Build the hosted issuer controlled by one self-registered public key. */
 export async function selfIssuer(kernel, publicKey) {
     const base = String(kernel).replace(/\/+$/u, '');
     return acceptIssuer(`${base}/iss/${await thumbprint(publicKey)}`);

package/dist/auth/register/result/index.d.ts

@@ -0,0 +1 @@
+export type { RegisteredIdentity, RegisterResult } from './result.js';

package/dist/auth/register/result/result.d.ts

@@ -0,0 +1,10 @@
+import type { IdentityId, Subject } from '../../identity/index.js';
+import type { IssuerId } from '../../issuer/index.js';
+export interface RegisteredIdentity {
+    readonly id: IdentityId;
+    readonly iss: IssuerId;
+    readonly sub: Subject;
+}
+export interface RegisterResult {
+    readonly identities: readonly [RegisteredIdentity, ...RegisteredIdentity[]];
+}

package/dist/schema/kernel/projection/project.js

@@ -64,7 +64,7 @@ export function project(domain) {
         }));
     }
     for (const [slug, declaration] of Object.entries(domainSchema.core.nodes)) {
-        assertIdentityAuthenticationPair(domain, declaration.class, declaration.properties, slug);
+        assertIdentityAuthenticationUnowned(domain, declaration.class, declaration.properties, slug);
         const path = PathValue.project({ origin: domain.origin, kind: 'core', name: slug }).raw;
         const created = addNode(coreNodes, path, ClassKeyValue.of(declaration.class), declaration.properties, coreLocations);
         addEdge(locators, created, persistedDomainEndpoint, K.classes.of_domain.ref, normalizeProperties({
@@ -94,7 +94,7 @@ export function project(domain) {
         }),
     });
 }
-function assertIdentityAuthenticationPair(domain, classRef, properties, slug) {
+function assertIdentityAuthenticationUnowned(domain, classRef, properties, slug) {
     const definition = domain.definition(classRef);
     if (definition?.ref.kind !== 'class' ||
         definition.kind !== 'node' ||
@@ -103,8 +103,8 @@ function assertIdentityAuthenticationPair(domain, classRef, properties, slug) {
     }
     const hasIssuer = Object.hasOwn(properties, K.classes.Identity.properties.iss.key);
     const hasSubject = Object.hasOwn(properties, K.classes.Identity.properties.sub.key);
-    if (hasIssuer !== hasSubject) {
-        throw new ProjectionError('PROJECTION_INVALID', `Core Identity ${slug} must declare both iss and sub or neither.`);
+    if (hasIssuer || hasSubject) {
+        throw new ProjectionError('PROJECTION_INVALID', `Core Identity ${domain.origin}:core.${slug} cannot declare protected Authentication properties iss or sub.`);
     }
 }
 function projectionLocations(paths) {