@inixiative/signet 0.12.1 → 0.12.3

package/README.md

@@ -1,10 +1,12 @@
 # @inixiative/signet
 
-Present Kingdom Signets.
+> Part of [inixiative](https://www.inixiative.com), technology for cooperation. See [all the projects](https://github.com/inixiative).
+
+Pass-through execution with tracking and audit. A Signet is how anything uses an integration through Kingdom: a revocable pass on the owner's terms. Kingdom decides who may grant and use one with [`@inixiative/permissions`](https://github.com/inixiative/permissions); a grant's lens is [json-rules](https://github.com/inixiative/json-rules). This package presents Kingdom Signets.
 
 A **Signet** is Kingdom's only grant for using an integration. It names the resources, operations, lens and limits, and it can be revoked. Its grantee is a user or an integration, for example a paired Foundry or a machine's local Archive. The grantee presents it with an access token plus a DPoP proof signed by its device key (RFC 9449).
 
-This package is the one implementation of that protocol, shared by Kingdom (which verifies) and Archive, Foundry and Oracle (which present):
+This package is the one implementation of that protocol, shared by Kingdom (which verifies) and Archive, Foundry, Oracle and KCP (which present):
 
 - `contracts`: the wire schemas: keys, grants (operation picks, lens layers, terms), proposals, pairing requests, delivered credentials, `describe` and `execute`, and the conversation frames.
 - `proof`: create and verify DPoP proofs (ES256, nonce-bound, access-token-bound).
@@ -16,7 +18,7 @@ This package is the one implementation of that protocol, shared by Kingdom (whic
   - a **person or their agent** acts as themselves with a Kingdom API token plus a proof from its key: `requestSignet` asks for a Signet on an integration (a `signetRequest` Inquiry, approved at once when the caller manages the integration), `awaitSignet` polls `collectSignet` until it is approved, and `enrollSignet` enrolls the key on a Signet an owner granted directly (`owner/grant`). `saveCollectedSignet` writes either result next to the key;
   - `installation`: the layout every installation shares, under one root per product (a Foundry's `kingdom/`, `~/.kcp`): one directory per Kingdom host with its key and one file per Signet (`installationPaths`, `installationDirectory`, `signetCredentialFile`, `heldCredentials`), `privateDirectory`, and `defaultInstallationName(product)`. `listedSignets`, `heldSignetFile` and `withdrawRegistration` read and act on it. `holdPersonSignets` enrolls the key on Signets issued to a person, under the same per-directory `withHoldLock` as `holdInstallationSignets`, so a person login and an installation sync never enroll over each other;
   - `SignetHolders`, a cache of each held Signet's `access/describe` (with its `holder`), keyed by credential file or by the caller's own `keyOf`, refreshed after `stale()`;
-  - `SignetClient`, which renews its access token and signs each call: `describe`, `execute`, task settlement, and the run actions a Foundry uses for inference (`resolveRun`, `delegateRun`, `renewRun`, `revokeRun`), and for a subscription run `releaseSubscription` and `reportSubscriptionLimits`.
+  - `SignetClient`, which renews its access token and signs each call: `describe`, `execute`, task settlement, and the run actions a Foundry uses for inference (`resolveRun`, `delegateRun`, `renewRun`, `revokeRun`), and for a subscription run `releaseSubscription`, `reportSubscriptionLimits` and `reportCredentialRejected` (the provider rejected the login a release handed out).
 
 ```ts
 import { holdInstallationSignets, InstallationSocket, pairInstallation, SignetClient } from '@inixiative/signet';
@@ -106,7 +108,7 @@ socket.start();
 await signet.execute({
   integrationId,
   operation: 'thread.prompt',
-  input: { resourceId, threadId, postId: crypto.randomUUID(), text: 'The role you wanted opened' },
+  input: { resourceId, threadId, postId: Bun.randomUUIDv7(), text: 'The role you wanted opened' },
 });
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/signet",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "Present Kingdom Signets: the wire contracts, DPoP proofs, device pairing and a renewing client shared by Kingdom, Archive, Foundry and Oracle.",
   "type": "module",
   "main": "src/index.ts",
@@ -35,7 +35,7 @@
   "devDependencies": {
     "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@biomejs/biome": "2.5.2",
-    "@inixiative/config": "^0.5.175",
+    "@inixiative/config": "^0.5.188",
     "@inixiative/json-rules": "^3.16.0",
     "@types/bun": "1.4.4",
     "lefthook": "2.1.9",

package/src/client.ts

@@ -500,7 +500,8 @@ export type SignetAction =
   | 'renewRun'
   | 'revokeRun'
   | 'releaseSubscription'
-  | 'reportSubscriptionLimits';
+  | 'reportSubscriptionLimits'
+  | 'reportCredentialRejected';
 const signetActions: SignetAction[] = [
   'describe',
   'execute',
@@ -513,6 +514,7 @@ const signetActions: SignetAction[] = [
   'revokeRun',
   'releaseSubscription',
   'reportSubscriptionLimits',
+  'reportCredentialRejected',
 ];
 
 /** Presents one enrolled Signet: renews its access token and signs each call with the device key. */
@@ -641,7 +643,7 @@ export class SignetClient {
     return accessResultSchema.parse(
       await this.post(
         'execute',
-        { ...request, signetId: this.signetId, requestId: crypto.randomUUID() },
+        { ...request, signetId: this.signetId, requestId: Bun.randomUUIDv7() },
         undefined,
         options,
       ),

package/src/files.ts

@@ -32,7 +32,7 @@ export async function writePrivateJson(path: string, value: unknown): Promise<vo
     (process.getuid && parent.uid !== process.getuid())
   )
     throw Error('Signet credential directory must be owned and private (0700)');
-  const temporary = join(dirname(path), `.credential-${crypto.randomUUID()}`);
+  const temporary = join(dirname(path), `.credential-${Bun.randomUUIDv7()}`);
   try {
     await writeFile(temporary, JSON.stringify(value), { mode: 0o600, flag: 'wx' });
     await rename(temporary, path);

package/src/proof.ts

@@ -76,7 +76,7 @@ export const createSignetProof = async (input: {
       jwk: publicClientKeySchema.parse(input.publicKey),
     })
     .setIssuedAt()
-    .setJti(input.proofId ?? crypto.randomUUID())
+    .setJti(input.proofId ?? Bun.randomUUIDv7())
     .sign(await importJWK(input.privateKey, 'ES256'));
 
 export const keyThumbprint = (key: unknown) =>