@inixiative/signet 0.12.0 → 0.12.2

package/README.md

@@ -16,7 +16,7 @@ This package is the one implementation of that protocol, shared by Kingdom (whic
   - a **person or their agent** acts as themselves with a Kingdom API token plus a proof from its key: `requestSignet` asks for a Signet on an integration (a `signetRequest` Inquiry, approved at once when the caller manages the integration), `awaitSignet` polls `collectSignet` until it is approved, and `enrollSignet` enrolls the key on a Signet an owner granted directly (`owner/grant`). `saveCollectedSignet` writes either result next to the key;
   - `installation`: the layout every installation shares, under one root per product (a Foundry's `kingdom/`, `~/.kcp`): one directory per Kingdom host with its key and one file per Signet (`installationPaths`, `installationDirectory`, `signetCredentialFile`, `heldCredentials`), `privateDirectory`, and `defaultInstallationName(product)`. `listedSignets`, `heldSignetFile` and `withdrawRegistration` read and act on it. `holdPersonSignets` enrolls the key on Signets issued to a person, under the same per-directory `withHoldLock` as `holdInstallationSignets`, so a person login and an installation sync never enroll over each other;
   - `SignetHolders`, a cache of each held Signet's `access/describe` (with its `holder`), keyed by credential file or by the caller's own `keyOf`, refreshed after `stale()`;
-  - `SignetClient`, which renews its access token and signs each call: `describe`, `execute`, task settlement, and the run actions a Foundry uses for inference (`resolveRun`, `delegateRun`, `renewRun`, `revokeRun`), and for a subscription run `releaseSubscription` and `reportSubscriptionLimits`.
+  - `SignetClient`, which renews its access token and signs each call: `describe`, `execute`, task settlement, and the run actions a Foundry uses for inference (`resolveRun`, `delegateRun`, `renewRun`, `revokeRun`), and for a subscription run `releaseSubscription`, `reportSubscriptionLimits` and `reportCredentialRejected` (the provider rejected the login a release handed out).
 
 ```ts
 import { holdInstallationSignets, InstallationSocket, pairInstallation, SignetClient } from '@inixiative/signet';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/signet",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Present Kingdom Signets: the wire contracts, DPoP proofs, device pairing and a renewing client shared by Kingdom, Archive, Foundry and Oracle.",
   "type": "module",
   "main": "src/index.ts",
@@ -35,7 +35,7 @@
   "devDependencies": {
     "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@biomejs/biome": "2.5.2",
-    "@inixiative/config": "^0.5.174",
+    "@inixiative/config": "^0.5.178",
     "@inixiative/json-rules": "^3.16.0",
     "@types/bun": "1.4.4",
     "lefthook": "2.1.9",

package/src/archive.ts

@@ -1,5 +1,6 @@
+import type { Condition } from '@inixiative/json-rules';
 import { z } from 'zod';
-import { type GrantLens, projectionFilters, projectionShows } from './lens';
+import { type GrantLens, type LensLayer, projectionFilters, projectionShows } from './lens';
 import { type OperationScope, scopeRefusal } from './operations';
 
 /**
@@ -12,7 +13,14 @@ export const archiveLibraryResourceKind = 'archiveLibrary';
 
 /** An Archive session id: `archiveKey(snapshot)`, the digest of its source and session. */
 export const archiveDocumentIdSchema = z.string().regex(/^[a-f0-9]{64}$/);
-export const archiveFieldSchema = z.enum(['id', 'title', 'content', 'tags', 'createdAt']);
+export const archiveFieldSchema = z.enum([
+  'id',
+  'title',
+  'content',
+  'tags',
+  'projectId',
+  'createdAt',
+]);
 export type ArchiveField = z.infer<typeof archiveFieldSchema>;
 
 /** The operations an `archiveLibrary` resource carries. */
@@ -42,7 +50,7 @@ export const archiveSourceOperations = [
 export const isArchiveSourceOperation = (operation: ArchiveOperation) =>
   (archiveSourceOperations as readonly ArchiveOperation[]).includes(operation);
 
-const fieldsSchema = z.array(archiveFieldSchema).min(1).max(5);
+const fieldsSchema = z.array(archiveFieldSchema).min(1).max(archiveFieldSchema.options.length);
 
 /**
  * The input each Archive operation takes. `access/execute` carries the same fields beside
@@ -90,6 +98,40 @@ export const archiveLensRefusal = (operation: ArchiveOperation, lens: GrantLens)
   return null;
 };
 
+type ArchiveInput<O extends ArchiveOperation> = z.infer<(typeof archiveInputSchemas)[O]>;
+
+/**
+ * What one call filters on, as a json-rules condition over the Archive document, or undefined when
+ * it filters on nothing. Kingdom gates it with `validateRuleInLens` against the grant's composed
+ * lens: a filter on a field the lens hides (`projectId`, a `tag`) would say which documents carry a
+ * value the holder can't see, and is refused with the lens's own code.
+ */
+export const archiveCallCondition = <O extends ArchiveOperation>(
+  _operation: O,
+  input: ArchiveInput<O>,
+): Condition | undefined => {
+  const rules: Condition[] = [
+    ...('projectId' in input && input.projectId !== undefined
+      ? [{ field: 'projectId', operator: 'equals' as const, value: input.projectId }]
+      : []),
+    ...('tag' in input && input.tag !== undefined
+      ? [{ field: 'tags', operator: 'contains' as const, value: input.tag }]
+      : []),
+  ];
+  return rules.length === 0 ? undefined : rules.length === 1 ? rules[0] : { all: rules };
+};
+
+/**
+ * The fields one call asks for, as a lens layer that picks them, or undefined when it asks for none.
+ * Kingdom validates it under the grant's composed lens (`validateNarrowing`): a field the lens hides
+ * is refused there.
+ */
+export const archiveCallNarrowing = <O extends ArchiveOperation>(
+  _operation: O,
+  input: ArchiveInput<O>,
+): LensLayer | undefined =>
+  'fields' in input && input.fields?.length ? { root: { picks: [...input.fields] } } : undefined;
+
 /** `archiveLensRefusal` over every operation a grant row reaches, `full` meaning all of them. */
 export const archiveGrantRefusal = (scope: OperationScope, lens: GrantLens) =>
   scopeRefusal(scope, archiveOperationSchema.options, (operation) =>

package/src/client.ts

@@ -500,7 +500,8 @@ export type SignetAction =
   | 'renewRun'
   | 'revokeRun'
   | 'releaseSubscription'
-  | 'reportSubscriptionLimits';
+  | 'reportSubscriptionLimits'
+  | 'reportCredentialRejected';
 const signetActions: SignetAction[] = [
   'describe',
   'execute',
@@ -513,6 +514,7 @@ const signetActions: SignetAction[] = [
   'revokeRun',
   'releaseSubscription',
   'reportSubscriptionLimits',
+  'reportCredentialRejected',
 ];
 
 /** Presents one enrolled Signet: renews its access token and signs each call with the device key. */

package/src/contracts.ts

@@ -14,7 +14,7 @@ import {
   signetGrantSchema,
   signetResourceSchema,
 } from './grants';
-import { storedLensLayersSchema } from './lens';
+import { storedBaseLensSchema, storedLensLayersSchema } from './lens';
 import {
   foundryIdSchema,
   threadFloorActionSchema,
@@ -280,6 +280,8 @@ export const hostedSignetSchema = z.object({
     id: z.uuid(),
     displayName: z.string(),
   }),
+  /** Each base lens the rows' `lens` layers compose under, keyed by `baseLensId(provider, kind)`. */
+  baseLenses: z.record(z.string(), storedBaseLensSchema),
   resources: grantsSchema,
 });
 export type InstallationSignet = z.infer<typeof installationSignetSchema>;

package/src/lens.ts

@@ -34,6 +34,19 @@ export const storedLensLayerSchema = z.strictObject({
 });
 export const storedLensLayersSchema = z.array(storedLensLayerSchema).max(20);
 
+/**
+ * A base lens as Kingdom's catalog carries it: the json-rules `Lens` itself (its field maps, map name
+ * and model) with an `id` and no parents. Only the envelope is checked here; a holder composes it
+ * under a grant's layers with json-rules `composeLens`, which validates what is inside.
+ */
+export const storedBaseLensSchema = z.looseObject({
+  id: layerId,
+  parents: z.array(layerId).max(0),
+  mapName: z.string().min(1),
+  model: z.string().min(1),
+  maps: z.record(z.string(), z.unknown()),
+});
+
 /** The id of an integration's base lens for a resource kind's model, in Kingdom's catalog. */
 export const baseLensId = (provider: string, kind: string) => `${provider}:${kind}`;