@astrale-os/kernel-core 0.9.0-beta.8 → 0.9.0

package/dist/auth/grant/resolved/admission.d.ts

@@ -1,6 +1,6 @@
 import type { Grant } from './grant.js';
-/** Admit one exact resolved Grant. */
+/**
+ * Admit one exact resolved claim value `{ expr: { kind: 'identity', id } }`. Compound structure
+ * keeps the unresolved claim's stable code, AUTH_GRANT_COMPOUND.
+ */
 export declare function accept(input: unknown): Grant;
-/** Re-canonicalize a trusted Grant value. */
-export declare function canonicalize(input: Grant): Grant;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/grant/resolved/admission.js

@@ -1,30 +1,40 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
+import { isNodeId, NodeId } from '../../../graph/node/index.js';
 import { AuthValueError } from '../../error.js';
-import { admitResolvedExpression, canonicalize as canonicalizeExpression, } from '../../expression/normalization/index.js';
-/** Admit one exact resolved Grant. */
+const COMPOUND = new Set(['union', 'intersect', 'exclude']);
+/**
+ * Admit one exact resolved claim value `{ expr: { kind: 'identity', id } }`. Compound structure
+ * keeps the unresolved claim's stable code, AUTH_GRANT_COMPOUND.
+ */
 export function accept(input) {
     try {
         const value = portable.accept(input);
-        if (value === null || Array.isArray(value) || typeof value !== 'object') {
-            invalid('', 'Expected a Grant object');
-        }
-        const grant = value;
+        const grant = record(value, '', 'Expected a Grant object');
         exact(grant, ['expr'], '');
-        if (grant.expr === undefined)
-            invalid('/expr', 'Expected a resolved Identity expression');
-        return Object.freeze({ expr: admitResolvedExpression(grant.expr, '/expr', 0) });
+        const expr = record(grant.expr, '/expr', 'Expected one resolved Identity leaf');
+        if (typeof expr.kind === 'string' && COMPOUND.has(expr.kind)) {
+            throw new AuthValueError('AUTH_GRANT_COMPOUND', 'Resolved Grant must name exactly one Identity', '/expr');
+        }
+        exact(expr, ['id', 'kind'], '/expr');
+        if (expr.kind !== 'identity')
+            invalid('/expr/kind', 'Expected one resolved Identity leaf');
+        if (typeof expr.id !== 'string' || !isNodeId(expr.id)) {
+            invalid('/expr/id', 'Expected one canonical IdentityId');
+        }
+        return Object.freeze({ expr: Object.freeze({ kind: 'identity', id: NodeId(expr.id) }) });
     }
     catch (cause) {
         if (cause instanceof AuthValueError)
             throw cause;
-        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a canonical resolved Grant', '', {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a resolved single-Identity Grant', '', {
             cause,
         });
     }
 }
-/** Re-canonicalize a trusted Grant value. */
-export function canonicalize(input) {
-    return Object.freeze({ expr: canonicalizeExpression(input.expr) });
+function record(value, path, message) {
+    if (value === null || Array.isArray(value) || typeof value !== 'object')
+        invalid(path, message);
+    return value;
 }
 function exact(value, expected, path) {
     const actual = Object.keys(value).sort(compare);
@@ -39,4 +49,3 @@ function compare(left, right) {
 function invalid(path, message) {
     throw new AuthValueError('AUTH_GRANT_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/grant/resolved/grant.d.ts

@@ -1,6 +1,5 @@
 import type { IdentityExpr } from '../../expression/language/index.js';
-/** One resolved, canonical authority expression. */
+/** The resolved single-identity claim value carried by Kernel bearers and delegation proofs. */
 export interface Grant {
     readonly expr: IdentityExpr;
 }
-//# sourceMappingURL=grant.d.ts.map

package/dist/auth/grant/resolved/grant.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=grant.js.map

package/dist/auth/grant/resolved/index.d.ts

@@ -1,4 +1,3 @@
-export { accept, canonicalize } from './admission.js';
+export { accept } from './admission.js';
 export { self } from './self.js';
 export type { Grant } from './grant.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/grant/resolved/index.js

@@ -1,3 +1,2 @@
-export { accept, canonicalize } from './admission.js';
+export { accept } from './admission.js';
 export { self } from './self.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/grant/resolved/self.d.ts

@@ -1,4 +1,3 @@
 import type { IdentityId } from '../../identity/index.js';
 import type { Grant } from './grant.js';
 export declare function self(principal: IdentityId): Grant;
-//# sourceMappingURL=self.d.ts.map

package/dist/auth/grant/resolved/self.js

@@ -2,4 +2,3 @@ import { NodeId } from '../../../graph/node/index.js';
 export function self(principal) {
     return Object.freeze({ expr: Object.freeze({ kind: 'identity', id: NodeId(principal) }) });
 }
-//# sourceMappingURL=self.js.map

package/dist/auth/grant/unresolved/admission.d.ts

@@ -1,4 +1,6 @@
 import type { UnresolvedGrant } from './grant.js';
-/** Admit the exact bounded unresolved Grant wire language. */
+/**
+ * Admit the exact version-1 unresolved Grant claim: exactly one `self` or one credential leaf.
+ * Compound structure is refused before any nested credential could be verified.
+ */
 export declare function acceptUnresolved(input: unknown): UnresolvedGrant;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/grant/unresolved/admission.js

@@ -1,17 +1,17 @@
 import { AuthValueError } from '../../error.js';
-import { EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from '../../expression/normalization/index.js';
-import { CREDENTIAL_BYTES_LIMIT, CREDENTIAL_NESTING_DEPTH_LIMIT } from './limits.js';
-/** Admit the exact bounded unresolved Grant wire language. */
+import { CREDENTIAL_BYTES_LIMIT } from './limits.js';
+const COMPOUND = new Set(['union', 'intersect', 'exclude']);
+/**
+ * Admit the exact version-1 unresolved Grant claim: exactly one `self` or one credential leaf.
+ * Compound structure is refused before any nested credential could be verified.
+ */
 export function acceptUnresolved(input) {
     try {
         const value = record(input, '');
         exact(value, ['expr', 'v'], '');
         if (data(value, 'v', '/v') !== 1)
             invalid('/v', 'Unsupported unresolved Grant version');
-        return Object.freeze({
-            v: 1,
-            expr: expression(data(value, 'expr', '/expr'), '/expr', 0, 0, new WeakSet()),
-        });
+        return Object.freeze({ v: 1, expr: leaf(data(value, 'expr', '/expr'), '/expr') });
     }
     catch (cause) {
         if (cause instanceof AuthValueError)
@@ -21,61 +21,29 @@ export function acceptUnresolved(input) {
         });
     }
 }
-function expression(input, path, depth, credentialDepth, active) {
-    if (depth > EXPRESSION_DEPTH_LIMIT)
-        invalid(path, 'Identity expression exceeds its depth limit');
+function leaf(input, path) {
     const value = record(input, path);
-    if (active.has(value))
-        invalid(path, 'Cyclic Identity expressions are not supported');
-    active.add(value);
-    try {
-        const kind = data(value, 'kind', `${path}/kind`);
-        switch (kind) {
-            case 'identity': {
-                const hasSelf = own(value, 'self');
-                const hasCredential = own(value, 'credential');
-                if (hasSelf === hasCredential)
-                    invalid(path, 'Expected exactly one unresolved Identity leaf');
-                if (hasSelf) {
-                    exact(value, ['kind', 'self'], path);
-                    if (data(value, 'self', `${path}/self`) !== true)
-                        invalid(`${path}/self`, 'Expected true');
-                    return Object.freeze({ kind: 'identity', self: true });
-                }
-                exact(value, ['credential', 'kind'], path);
-                if (credentialDepth >= CREDENTIAL_NESTING_DEPTH_LIMIT) {
-                    invalid(`${path}/credential`, 'Credential nesting exceeds its limit');
-                }
-                return Object.freeze({
-                    kind: 'identity',
-                    credential: credential(data(value, 'credential', `${path}/credential`), `${path}/credential`),
-                });
-            }
-            case 'union':
-            case 'intersect': {
-                exact(value, ['kind', 'operands'], path);
-                const operands = list(data(value, 'operands', `${path}/operands`), `${path}/operands`, 2);
-                return Object.freeze({
-                    kind,
-                    operands: Object.freeze(operands.map((operand, index) => expression(operand, `${path}/operands/${index}`, depth + 1, credentialDepth, active))),
-                });
-            }
-            case 'exclude': {
-                exact(value, ['base', 'excluded', 'kind'], path);
-                const excluded = list(data(value, 'excluded', `${path}/excluded`), `${path}/excluded`, 1);
-                return Object.freeze({
-                    kind: 'exclude',
-                    base: expression(data(value, 'base', `${path}/base`), `${path}/base`, depth + 1, credentialDepth, active),
-                    excluded: Object.freeze(excluded.map((operand, index) => expression(operand, `${path}/excluded/${index}`, depth + 1, credentialDepth, active))),
-                });
-            }
-            default:
-                invalid(`${path}/kind`, 'Expected identity, union, intersect, or exclude');
-        }
+    const kind = data(value, 'kind', `${path}/kind`);
+    if (typeof kind === 'string' && COMPOUND.has(kind)) {
+        throw new AuthValueError('AUTH_GRANT_COMPOUND', 'Unresolved Grant must name exactly one Identity', path);
+    }
+    if (kind !== 'identity')
+        invalid(`${path}/kind`, 'Expected identity');
+    const hasSelf = own(value, 'self');
+    if (hasSelf === own(value, 'credential')) {
+        invalid(path, 'Expected exactly one unresolved Identity leaf');
     }
-    finally {
-        active.delete(value);
+    if (hasSelf) {
+        exact(value, ['kind', 'self'], path);
+        if (data(value, 'self', `${path}/self`) !== true)
+            invalid(`${path}/self`, 'Expected true');
+        return Object.freeze({ kind: 'identity', self: true });
     }
+    exact(value, ['credential', 'kind'], path);
+    return Object.freeze({
+        kind: 'identity',
+        credential: credential(data(value, 'credential', `${path}/credential`), `${path}/credential`),
+    });
 }
 function credential(input, path) {
     if (typeof input === 'string') {
@@ -120,18 +88,9 @@ function exact(input, expected, path) {
         invalid(path, `Expected exactly ${expected.join(', ')}`);
     }
 }
-function list(input, path, minimum) {
-    if (!Array.isArray(input) || input.length < minimum || input.length > EXPRESSION_OPERAND_LIMIT) {
-        invalid(path, `Expected ${minimum}-${EXPRESSION_OPERAND_LIMIT} operands`);
-    }
-    if (Object.keys(input).length !== input.length)
-        invalid(path, 'Expected a dense array');
-    return input;
-}
 function compare(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
 function invalid(path, message) {
     throw new AuthValueError('AUTH_GRANT_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/grant/unresolved/grant.d.ts

@@ -4,4 +4,3 @@ export interface UnresolvedGrant {
     readonly v: 1;
     readonly expr: UnresolvedIdentityExpr;
 }
-//# sourceMappingURL=grant.d.ts.map

package/dist/auth/grant/unresolved/grant.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=grant.js.map

package/dist/auth/grant/unresolved/index.d.ts

@@ -1,4 +1,3 @@
 export { acceptUnresolved } from './admission.js';
 export { limits } from './limits.js';
 export type { UnresolvedGrant } from './grant.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/grant/unresolved/index.js

@@ -1,3 +1,2 @@
 export { acceptUnresolved } from './admission.js';
 export { limits } from './limits.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/grant/unresolved/limits.d.ts

@@ -1,8 +1,5 @@
-export declare const CREDENTIAL_NESTING_DEPTH_LIMIT = 3;
 export declare const CREDENTIAL_BYTES_LIMIT: number;
 export declare const limits: {
-    readonly expressionDepth: 32;
-    readonly operandsPerExpression: 64;
-    readonly credentialNestingDepth: 3;
+    /** One nested Kernel delegation proof; proofs never nest further. */
+    readonly credentialNestingDepth: 1;
 };
-//# sourceMappingURL=limits.d.ts.map

package/dist/auth/grant/unresolved/limits.js

@@ -1,9 +1,4 @@
-import { EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from '../../expression/normalization/index.js';
-export const CREDENTIAL_NESTING_DEPTH_LIMIT = 3;
 export const CREDENTIAL_BYTES_LIMIT = 64 * 1024;
 export const limits = Object.freeze({
-    expressionDepth: EXPRESSION_DEPTH_LIMIT,
-    operandsPerExpression: EXPRESSION_OPERAND_LIMIT,
-    credentialNestingDepth: CREDENTIAL_NESTING_DEPTH_LIMIT,
+    credentialNestingDepth: 1,
 });
-//# sourceMappingURL=limits.js.map

package/dist/auth/identity/admission.d.ts

@@ -1,4 +1,3 @@
 import type { Identity } from './identity.js';
 /** Admit and normalize one pure Identity boundary value. */
 export declare function accept(input: unknown): Identity;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/identity/admission.js

@@ -7,11 +7,19 @@ import { accept as acceptIssuer } from '../issuer/index.js';
 export function accept(input) {
     try {
         const value = object(portable.accept(input), '');
-        exact(value, ['frozen', 'id', 'issuer', 'requiredClaims', 'subject'], '');
+        exact(value, ['frozen', 'id', 'iss', 'requiredClaims', 'sub'], '');
+        const hasIssuer = value.iss !== undefined;
+        const hasSubject = value.sub !== undefined;
+        if (hasIssuer !== hasSubject)
+            invalid('', 'Expected both iss and sub or neither');
         return Object.freeze({
             id: NodeId(text(value.id, '/id')),
-            issuer: acceptIssuer(text(value.issuer, '/issuer')),
-            subject: text(value.subject, '/subject'),
+            ...(hasIssuer
+                ? {
+                    iss: acceptIssuer(text(value.iss, '/iss')),
+                    sub: text(value.sub, '/sub'),
+                }
+                : {}),
             frozen: value.frozen === undefined ? false : boolean(value.frozen, '/frozen'),
             requiredClaims: constraints(value.requiredClaims, '/requiredClaims'),
         });
@@ -56,4 +64,3 @@ function boolean(input, path) {
 function invalid(path, message) {
     throw new AuthValueError('AUTH_IDENTITY_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/identity/identity.d.ts

@@ -4,12 +4,23 @@ import type { IssuerId } from '../issuer/index.js';
 /** Stable graph identity of one authenticated principal. */
 export type IdentityId = NodeId;
 export type Subject = string;
+/** One complete authentication assertion at an API boundary. */
+export interface Authentication {
+    readonly iss: IssuerId;
+    readonly sub: Subject;
+}
 /** Normalized Identity value used at authentication boundaries, not a complete graph Node. */
-export interface Identity {
+interface IdentityBase {
     readonly id: IdentityId;
-    readonly issuer: IssuerId;
-    readonly subject: Subject;
     readonly frozen: boolean;
     readonly requiredClaims: readonly ClaimConstraint[];
 }
-//# sourceMappingURL=identity.d.ts.map
+/** A stable principal with either both protected authentication facts or neither. */
+export type Identity = IdentityBase & ({
+    readonly iss?: never;
+    readonly sub?: never;
+} | {
+    readonly iss: IssuerId;
+    readonly sub: Subject;
+});
+export {};

package/dist/auth/identity/identity.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=identity.js.map

package/dist/auth/identity/index.d.ts

@@ -1,4 +1,3 @@
 export { accept } from './admission.js';
 export { verify, verifyFrozen } from './verification.js';
-export type { Identity, IdentityId, Subject } from './identity.js';
-//# sourceMappingURL=index.d.ts.map
+export type { Authentication, Identity, IdentityId, Subject } from './identity.js';

package/dist/auth/identity/index.js

@@ -1,3 +1,2 @@
 export { accept } from './admission.js';
 export { verify, verifyFrozen } from './verification.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/identity/verification.d.ts

@@ -4,4 +4,3 @@ import type { Identity } from './identity.js';
 export declare function verifyFrozen(identity: Identity): void;
 /** Assert required claims and active state over an already loaded Identity. */
 export declare function verify(identity: Identity, verifiedClaims: portable.Object): void;
-//# sourceMappingURL=verification.d.ts.map

package/dist/auth/identity/verification.js

@@ -9,4 +9,3 @@ export function verify(identity, verifiedClaims) {
     verifyRequired(identity.requiredClaims, verifiedClaims);
     verifyFrozen(identity);
 }
-//# sourceMappingURL=verification.js.map

package/dist/auth/index.d.ts

@@ -1,16 +1,16 @@
 export { AuthValueError } from './error.js';
 export type { Attestation } from './attestation/index.js';
-export type { AuthorityExpr, AuthorityPredicate } from './authority/language/index.js';
+export type { AuthorityExpr, AuthorityPredicate, AuthorityProgram, PredicateRef, ClosedEdgeExtent, } from './authority/language/index.js';
 export type { ClaimConstraint } from './claims/index.js';
 export type { AuthenticationEvidence, AuthenticationMethod, CredentialAudience, CredentialInput, MintedCredential, UnverifiedCredential, VerifiedCredential, } from './credential/index.js';
 export type { AuthContext, Authenticated, CredentialContext } from './context/index.js';
 export type { Delegation, DelegationCredential } from './delegation/index.js';
 export type { IdentityExpr, SelfIdentityExpr, UnresolvedIdentityExpr } from './expression/index.js';
 export type { Grant, UnresolvedGrant } from './grant/index.js';
-export type { Identity, IdentityId, Subject } from './identity/index.js';
+export type { Authentication, Identity, IdentityId, Subject } from './identity/index.js';
 export type { IssuerId } from './issuer/index.js';
 export type { JsonWebKey, KeyId } from './jwk/index.js';
-export type { AssertedIdentityProvision, IdentityProvisionInput, ProvisionFingerprint, ProvisionRequest, ProvisionResult, ProvisionedIdentity, RequiredClaims, SelfIdentityProvision, } from './provision/index.js';
+export type { IdentityRegistration, RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, RegisterRequest, RegisterResult, RegisteredIdentity, } from './register/index.js';
 export type { AuthenticationCandidate, AuthenticationTrust, StringPatternSet, TrustDecision, TrustRule, } from './trust/index.js';
 export * as attestation from './attestation/index.js';
 export * as authority from './authority/index.js';
@@ -22,6 +22,5 @@ export * as grant from './grant/index.js';
 export * as identity from './identity/index.js';
 export * as issuer from './issuer/index.js';
 export * as jwk from './jwk/index.js';
-export * as provision from './provision/index.js';
+export * as register from './register/index.js';
 export * as trust from './trust/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -9,6 +9,5 @@ export * as grant from './grant/index.js';
 export * as identity from './identity/index.js';
 export * as issuer from './issuer/index.js';
 export * as jwk from './jwk/index.js';
-export * as provision from './provision/index.js';
+export * as register from './register/index.js';
 export * as trust from './trust/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/issuer/index.d.ts

@@ -1,3 +1,2 @@
 export { accept, is } from './issuer-id.js';
 export type { IssuerId } from './issuer-id.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/issuer/index.js

@@ -1,2 +1 @@
 export { accept, is } from './issuer-id.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/issuer/issuer-id.d.ts

@@ -8,4 +8,3 @@ export declare function accept(input: string): IssuerId;
 /** Recognize canonical issuer text without repairing it. */
 export declare function is(input: unknown): input is IssuerId;
 export {};
-//# sourceMappingURL=issuer-id.d.ts.map

package/dist/auth/issuer/issuer-id.js

@@ -84,4 +84,3 @@ function normalizeAuthority(authority, scheme) {
 function invalid() {
     throw new AuthValueError('AUTH_ISSUER_INVALID', 'Expected a supported issuer identifier');
 }
-//# sourceMappingURL=issuer-id.js.map

package/dist/auth/jwk/index.d.ts

@@ -1,4 +1,3 @@
 export { acceptPublic } from './public-key.js';
-export { thumbprint } from './thumbprint.js';
+export { thumbprint, thumbprintMembers } from './thumbprint.js';
 export type { JsonWebKey, KeyId } from './public-key.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/jwk/index.js

@@ -1,3 +1,2 @@
 export { acceptPublic } from './public-key.js';
-export { thumbprint } from './thumbprint.js';
-//# sourceMappingURL=index.js.map
+export { thumbprint, thumbprintMembers } from './thumbprint.js';

package/dist/auth/jwk/public-key.d.ts

@@ -8,4 +8,3 @@ export type JsonWebKey = portable.Object & {
 };
 /** Admit one detached public asymmetric JWK with complete RFC 7638 identity material. */
 export declare function acceptPublic(input: unknown): JsonWebKey;
-//# sourceMappingURL=public-key.d.ts.map

package/dist/auth/jwk/public-key.js

@@ -57,4 +57,3 @@ function deepFreeze(input) {
 function invalid(path, message) {
     throw new AuthValueError('AUTH_JWK_INVALID', message, path);
 }
-//# sourceMappingURL=public-key.js.map

package/dist/auth/jwk/thumbprint.d.ts

@@ -1,4 +1,5 @@
 import type { JsonWebKey } from './public-key.js';
 /** Compute the RFC 7638 SHA-256 thumbprint of an admitted public key. */
 export declare function thumbprint(input: JsonWebKey): Promise<string>;
-//# sourceMappingURL=thumbprint.d.ts.map
+/** Return the exact RFC 7638 members that identify one public key's cryptographic material. */
+export declare function thumbprintMembers(input: JsonWebKey): Readonly<Record<string, string>>;

package/dist/auth/jwk/thumbprint.js

@@ -1,19 +1,25 @@
 import { acceptPublic } from './public-key.js';
 /** Compute the RFC 7638 SHA-256 thumbprint of an admitted public key. */
 export async function thumbprint(input) {
-    const key = acceptPublic(input);
-    const canonical = JSON.stringify(members(key));
+    const canonical = JSON.stringify(thumbprintMembers(input));
     const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical)));
     return base64url(digest);
 }
-function members(key) {
+/** Return the exact RFC 7638 members that identify one public key's cryptographic material. */
+export function thumbprintMembers(input) {
+    const key = acceptPublic(input);
     if (key.kty === 'EC') {
-        return { crv: key.crv, kty: key.kty, x: key.x, y: key.y };
+        return Object.freeze({
+            crv: key.crv,
+            kty: key.kty,
+            x: key.x,
+            y: key.y,
+        });
     }
     if (key.kty === 'RSA') {
-        return { e: key.e, kty: key.kty, n: key.n };
+        return Object.freeze({ e: key.e, kty: key.kty, n: key.n });
     }
-    return { crv: key.crv, kty: key.kty, x: key.x };
+    return Object.freeze({ crv: key.crv, kty: key.kty, x: key.x });
 }
 function base64url(input) {
     let binary = '';
@@ -21,4 +27,3 @@ function base64url(input) {
         binary += String.fromCharCode(byte);
     return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/u, '');
 }
-//# sourceMappingURL=thumbprint.js.map

package/dist/auth/register/fingerprint/fingerprint.d.ts

@@ -0,0 +1,25 @@
+import type { Authentication, IdentityId } from '../../identity/index.js';
+import type { JsonWebKey } from '../../jwk/index.js';
+declare const REGISTER_FINGERPRINT: unique symbol;
+/** Digest of the semantic request. Credential bytes and verifier evidence are excluded. */
+export type RegisterFingerprint = `sha256:${string}` & {
+    readonly [REGISTER_FINGERPRINT]: true;
+};
+export type RegisterFingerprintIdentity = {
+    readonly id: IdentityId;
+    readonly mode: 'external';
+    readonly authentication: Authentication;
+    readonly publicKey?: never;
+} | {
+    readonly id: IdentityId;
+    readonly mode: 'self';
+    readonly authentication: Authentication;
+    readonly publicKey: JsonWebKey;
+};
+export interface RegisterFingerprintInput {
+    readonly idempotencyKey: string;
+    readonly identities: readonly [RegisterFingerprintIdentity, ...RegisterFingerprintIdentity[]];
+}
+/** Compute a deterministic post-verification digest without retaining credential evidence. */
+export declare function fingerprint(input: RegisterFingerprintInput): Promise<RegisterFingerprint>;
+export {};

package/dist/auth/register/fingerprint/fingerprint.js

@@ -0,0 +1,31 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { thumbprint as jwkThumbprint } from '../../jwk/index.js';
+/** Compute a deterministic post-verification digest without retaining credential evidence. */
+export async function fingerprint(input) {
+    const identities = await Promise.all([...input.identities]
+        .sort((left, right) => compare(left.id, right.id))
+        .map(async (identity) => ({
+        id: identity.id,
+        mode: identity.mode,
+        iss: identity.authentication.iss,
+        sub: identity.authentication.sub,
+        ...(identity.mode === 'self' ? { publication: await publication(identity.publicKey) } : {}),
+    })));
+    const encoded = portable.json.encode(portable.accept({ version: 2, idempotencyKey: input.idempotencyKey, identities }));
+    const digest = await crypto.subtle.digest('SHA-256', Uint8Array.from(encoded).buffer);
+    return `sha256:${hex(new Uint8Array(digest))}`;
+}
+async function publication(publicKey) {
+    const thumbprint = await jwkThumbprint(publicKey);
+    return Object.freeze({
+        key: publicKey,
+        thumbprint,
+        slot: publicKey.kid === undefined ? `thumbprint:${thumbprint}` : `kid:${publicKey.kid}`,
+    });
+}
+function hex(input) {
+    return [...input].map((value) => value.toString(16).padStart(2, '0')).join('');
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/register/fingerprint/index.d.ts

@@ -0,0 +1,2 @@
+export { fingerprint } from './fingerprint.js';
+export type { RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, } from './fingerprint.js';

package/dist/auth/{provision → register}/fingerprint/index.js

@@ -1,2 +1 @@
 export { fingerprint } from './fingerprint.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/register/index.d.ts

@@ -0,0 +1,5 @@
+export { fingerprint } from './fingerprint/index.js';
+export type { RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, } from './fingerprint/index.js';
+export { accept, isSelfIssuer, selfIssuer } from './request/index.js';
+export type { IdentityRegistration, RegisterRequest } from './request/index.js';
+export type { RegisteredIdentity, RegisterResult } from './result/index.js';

package/dist/auth/{provision → register}/index.js

@@ -1,3 +1,2 @@
 export { fingerprint } from './fingerprint/index.js';
 export { accept, isSelfIssuer, selfIssuer } from './request/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/register/request/admission.d.ts

@@ -0,0 +1,3 @@
+import type { RegisterRequest } from './request.js';
+/** Admit unknown input into the exact immutable existing-target Register language. */
+export declare function accept(input: unknown): RegisterRequest;