@ibgib/core-gib 0.1.62 → 0.1.64

package/src/keystone/keystone-types.mts

@@ -256,6 +256,47 @@ export interface KeystoneChallengePool {
     metadata?: any;
 }
 
+// #region KeystoneClaimType enum
+export const KEYSTONE_CLAIM_TYPE_ADD_POOL = 'add-pool';
+export const KEYSTONE_CLAIM_TYPE_REPLACE_POOL = 'replace-pool';
+export const KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD = 'change-password';
+
+export type KeystoneClaimType =
+    | typeof KEYSTONE_CLAIM_TYPE_ADD_POOL
+    | typeof KEYSTONE_CLAIM_TYPE_REPLACE_POOL
+    | typeof KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD
+    ;
+
+export const KeystoneClaimType = {
+    add_pool: KEYSTONE_CLAIM_TYPE_ADD_POOL,
+    replace_pool: KEYSTONE_CLAIM_TYPE_REPLACE_POOL,
+    change_password: KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD,
+} satisfies { readonly [key: string]: KeystoneClaimType };
+
+export const KEYSTONE_CLAIM_TYPE_VALID_VALUES: KeystoneClaimType[] = Object.values(KeystoneClaimType);
+
+export function isKeystoneClaimType(value: any): value is KeystoneClaimType {
+    return typeof value === 'string' && KEYSTONE_CLAIM_TYPE_VALID_VALUES.includes(value as any);
+}
+// #endregion KeystoneClaimType enum
+
+export interface ClaimDetails {
+    type: KeystoneClaimType;
+    info: any;
+}
+
+export interface ClaimDetails_AddPool {
+    add: string[];
+}
+
+export interface ClaimDetails_ReplacePool {
+    replace: string;
+}
+
+export interface ClaimDetails_ChangePassword {
+    change: string[];
+}
+
 /**
  * Describes the specific privilege that the evolution of the keystone
  * authorizes.
@@ -277,9 +318,9 @@ export interface KeystoneClaim {
      */
     target: IbGibAddr;
     /**
-     * What limitations are narrowed down to beyond just target + verb?
+     * Detailed information describing the nature of the keystone evolution/transition.
      */
-    scope?: string;
+    details?: ClaimDetails;
 }
 
 /**
@@ -342,6 +383,11 @@ export interface DelegateKeystoneInfo {
      * `tjpGib` in its `GibInfo`.
      */
     thisAddr: IbGibAddr;
+    /**
+     * Optional list of verbs allowed for this delegate.
+     * e.g. ["sync^gib"]
+     */
+    allowedVerbs?: string[];
 }
 
 /**

package/src/keystone/policy/keystone-profile-builder.mts

@@ -8,6 +8,8 @@ import profileMedium from "./profiles/profile-medium.json" assert { type: "json"
 import profileLow from "./profiles/profile-low.json" assert { type: "json" };
 import profileSession from "./profiles/profile-session.json" assert { type: "json" };
 import profileTest from "./profiles/profile-test.json" assert { type: "json" };
+import profileDomain from "./profiles/profile-domain.json" assert { type: "json" };
+import profileSync from "./profiles/profile-sync.json" assert { type: "json" };
 
 export class KeystoneProfileBuilder {
     private _template: KeystonePolicyConfigTemplate;
@@ -22,7 +24,7 @@ export class KeystoneProfileBuilder {
         this._template = JSON.parse(JSON.stringify(template));
     }
 
-    static buildKeystone(profileName: 'high' | 'medium' | 'low' | 'session' | 'test'): KeystoneProfileBuilder {
+    static buildKeystone(profileName: 'high' | 'medium' | 'low' | 'session' | 'test' | 'domain' | 'sync'): KeystoneProfileBuilder {
         let selected: KeystonePolicyConfigTemplate;
         switch (profileName) {
             case 'high':
@@ -40,6 +42,12 @@ export class KeystoneProfileBuilder {
             case 'test':
                 selected = profileTest as any;
                 break;
+            case 'domain':
+                selected = profileDomain as any;
+                break;
+            case 'sync':
+                selected = profileSync as any;
+                break;
             default:
                 throw new Error(`Unknown profile name: ${profileName} (E: fc10a8ad482ef2bda871ac567d268d26)`);
         }

package/src/keystone/policy/profiles/profile-domain.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "../schemas/keystone.high.schema.json",
+  "metadata": {
+    "name": "Domain Identity Profile",
+    "securityLevel": "high"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-512",
+      "rounds": 6,
+      "behavior": {
+        "size": 2000,
+        "replenish": "replace-all",
+        "selectSequentially": 12,
+        "selectRandomly": 12,
+        "targetBindingCount": 16
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-512",
+      "rounds": 20,
+      "behavior": {
+        "size": 2000,
+        "replenish": "delete-all",
+        "selectSequentially": 50,
+        "selectRandomly": 50,
+        "targetBindingCount": 0
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    }
+  }
+}

package/src/keystone/policy/profiles/profile-sync.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.low.schema.json",
+  "metadata": {
+    "name": "Sync Delegate Profile",
+    "securityLevel": "low"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 100,
+        "replenish": "replace-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-256",
+      "rounds": 5,
+      "behavior": {
+        "size": 100,
+        "replenish": "delete-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    }
+  }
+}

package/src/keystone/policy/schemas/keystone.high.schema.json

@@ -19,7 +19,7 @@
         "connect": { "$ref": "./connect-pool.high.schema.json" },
         "sign": { "$ref": "./sign-pool.high.schema.json" }
       },
-      "required": ["sync", "manage", "revoke", "connect", "sign"]
+      "required": ["manage", "revoke", "sign"]
     }
   },
   "required": ["pools"]

package/src/keystone/policy/schemas/keystone.medium.schema.json

@@ -19,7 +19,7 @@
         "connect": { "$ref": "./connect-pool.medium.schema.json" },
         "sign": { "$ref": "./sign-pool.medium.schema.json" }
       },
-      "required": ["sync", "manage", "revoke", "connect", "sign"]
+      "required": ["manage", "revoke", "sign"]
     }
   },
   "required": ["pools"]

package/src/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mts

@@ -1,4 +1,4 @@
-import { hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { hash, HashAlgorithm } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 
 import { KeystoneStrategy } from '../keystone-strategy.mjs';
 import {
@@ -140,3 +140,22 @@ export class KeystoneStrategy_HashRevealV1 extends KeystoneStrategy<
         }
     }
 }
+
+/**
+ * Derives a delegate secret from the parent's masterSecret using KDF.
+ * Salt is the sha512 hash of the masterSecret.
+ * Number of rounds is hardcoded to 1000.
+ */
+export async function deriveDelegateSecret({
+    masterSecret,
+}: {
+    masterSecret: string;
+}): Promise<string> {
+    const salt = await hash({ s: masterSecret, algorithm: HashAlgorithm.sha_512 });
+    return await kdf_recursiveSaltWrap({
+        masterSecret,
+        salt,
+        rounds: 1000,
+        algorithm: HashAlgorithm.sha_512
+    });
+}

package/src/sync/sync-conflict-adv-multitimelines.withid.respec.mts

@@ -178,7 +178,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r1_alpha_v1_source_common.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
 
@@ -300,7 +303,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r2_alpha_v3_source_rel8dBeta.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
     await r2_syncSaga.done;
@@ -449,7 +455,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r3_alpha_v4_source_mut8fieldC.ibGib, r3_beta_v1_source.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
     await r3_syncSaga.done;
@@ -625,7 +634,10 @@ await respecfully(sir, `Multi-round/timeline permutations with Identity`, async
         metaspace,
         domainIbGibs: [r4_alpha_v7_source.ibGib, r4_gamma_v0_source.ibGib, r4_beta_v2_source.ibGib],
         conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-        senderIdentity: senderIdentityLatestSource,
+        senderIdentityInfo: {
+            senderIdentity: senderIdentityLatestSource,
+            senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+        },
         fnSenderSecret: async () => SENDER_SECRET,
     });
     await r4_syncSaga.done;

package/src/sync/sync-conflict-basic-divergence.withid.respec.mts

@@ -221,7 +221,10 @@ await respecfully(sir, `Sync Conflict Basic Divergence with Identity`, async ()
                 metaspace,
                 domainIbGibs: [v2a],
                 conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-                senderIdentity: r1_senderIdentity_v0_source,
+                senderIdentityInfo: {
+                    senderIdentity: r1_senderIdentity_v0_source,
+                    senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+                },
                 fnSenderSecret: async () => SENDER_SECRET,
             });
             await resSync.done;

package/src/sync/sync-conflict-basic-multitimelines.withid.respec.mts

@@ -254,7 +254,10 @@ await respecfully(sir, `Sync Conflict Basic Multitimelines with Identity`, async
                 metaspace,
                 domainIbGibs: [alpha_v3_source_rel8beta],
                 conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-                senderIdentity: r1_senderIdentity_v0_source,
+                senderIdentityInfo: {
+                    senderIdentity: r1_senderIdentity_v0_source,
+                    senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+                },
                 fnSenderSecret: async () => SENDER_SECRET,
             });
             await resSync.done;

package/src/sync/sync-conflict-text-merge.withid.respec.mts

@@ -150,9 +150,12 @@ await respecfully(sir, `Text merge (LCS) conflict resolution with Identity`, asy
             localSpace: sourceSpace,
             metaspace,
             domainIbGibs: [r1_alpha_v0_source.ibGib],
-            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-            senderIdentity: senderIdentityLatestSource,
+            senderIdentityInfo: {
+                senderIdentity: senderIdentityLatestSource,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
+            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
         });
         await r1_syncSaga.done;
         if (logalot) { console.log(`${lc} R1 Sync Complete.`); }
@@ -286,9 +289,12 @@ await respecfully(sir, `Text merge (LCS) conflict resolution with Identity`, asy
             localSpace: sourceSpace,
             metaspace,
             domainIbGibs: [r2_alpha_v1_source_appendedText.ibGib],
-            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
-            senderIdentity: senderIdentityLatestSource,
+            senderIdentityInfo: {
+                senderIdentity: senderIdentityLatestSource,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
+            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
         });
         await r2_syncSaga.done;
     } catch (e) {

package/src/sync/sync-innerspace-constants.withid.respec.mts

@@ -134,7 +134,10 @@ await respecfully(sir, `Sync Constants (No TJP) with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_c1_v0_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;
@@ -153,7 +156,10 @@ await respecfully(sir, `Sync Constants (No TJP) with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_c1_v0_source],
-            senderIdentity: r1_senderIdentity_v1_source_postSync1,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v1_source_postSync1,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;
@@ -183,7 +189,10 @@ await respecfully(sir, `Sync Constants (No TJP) with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_c2_v0_source_rel8C1],
-            senderIdentity: r1_senderIdentity_v2_source_postSync2,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v2_source_postSync2,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-deep-updates.withid.respec.mts

@@ -162,7 +162,10 @@ await respecfully(sir, `Sync InnerSpaces (Deep Updates) with Identity`, async ()
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v2_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-dest-ahead.withid.respec.mts

@@ -184,7 +184,10 @@ await respecfully(sir, `Sync InnerSpaces (Dest Ahead) with Identity`, async () =
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v1_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-multiple-timelines.withid.respec.mts

@@ -175,7 +175,10 @@ await respecfully(sir, `Sync InnerSpaces (Multiple Timelines) with Identity`, as
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v1_source, r1_beta_v2_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace-partial-update.withid.respec.mts

@@ -163,7 +163,10 @@ await respecfully(sir, `Sync InnerSpaces (Partial Update) with Identity`, async
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v2_source],
-            senderIdentity: r1_senderIdentity_v0_source,
+            senderIdentityInfo: {
+                senderIdentity: r1_senderIdentity_v0_source,
+                senderDomainAddr: getIbGibAddr({ ibGib: r1_senderIdentity_v0_source }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
         });
         await resSync.done;

package/src/sync/sync-innerspace.withid.respec.mts

@@ -152,7 +152,10 @@ await respecfully(sir, `Sync InnerSpaces with Identity`, async () => {
             localSpace: sourceSpace,
             metaspace: metaspace,
             domainIbGibs: [r1_alpha_v1_source], // Sync the child
-            senderIdentity,
+            senderIdentityInfo: {
+                senderIdentity,
+                senderDomainAddr: getIbGibAddr({ ibGib: senderIdentity }),
+            },
             fnSenderSecret: async () => SENDER_SECRET,
             conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
         });

package/src/sync/sync-peer/sync-peer-types.mts

@@ -89,6 +89,10 @@ export interface InitializeSyncPeerOpts {
      * together or omitted together.
      */
     senderIdentity?: KeystoneIbGib_V1;
+    /**
+     * The root Domain Identity address associated with the senderIdentity delegate.
+     */
+    senderDomainAddr?: string;
     /**
      * Returns the plaintext secret corresponding to {@link senderIdentity}.
      * Wrapped in a function to avoid holding the secret in memory longer than needed.

package/src/sync/sync-peer/sync-peer-v1.mts

@@ -224,13 +224,17 @@ export abstract class SyncPeer_V1<
 
             if (!this.opts) { throw new Error(`(UNEXPECTED) this.opts falsy? Call initializeOpts first. (E: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c526)`); }
 
-            const { senderIdentity, fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+            const { senderIdentity, fnSenderSecret, senderDomainAddr, sagaId, localMetaspace, localSpace } = this.opts;
 
             // No identity provided — anonymous sync, nothing to establish.
             if (!senderIdentity || !fnSenderSecret) {
                 if (logalot) { console.log(`${lc} no senderIdentity/fnSenderSecret — skipping establish (I: f29348a77d1542326d14043ea4b69126)`); }
                 return undefined;
             }
+
+            if (!senderDomainAddr) {
+                throw new Error(`(UNEXPECTED) senderDomainAddr falsy but senderIdentity/fnSenderSecret truthy? if identity is used, senderDomainAddr must be provided. (E: c288fa8e9d3d82fc)`);
+            }
             const senderIdentityAddr = getIbGibAddr({ ibGib: senderIdentity });
             const senderIdentityTjpAddr = getTjpAddr({ ibGib: senderIdentity });
             if (!senderIdentityTjpAddr) { throw new Error(`(UNEXPECTED) senderIdentityTjpAddr falsy? (E: d5d8c3ab25a83a2c127904fe96de1526)`); }