@inixiative/signet 0.12.2 → 0.12.3

package/README.md

@@ -1,10 +1,12 @@
 # @inixiative/signet
 
-Present Kingdom Signets.
+> Part of [inixiative](https://www.inixiative.com), technology for cooperation. See [all the projects](https://github.com/inixiative).
+
+Pass-through execution with tracking and audit. A Signet is how anything uses an integration through Kingdom: a revocable pass on the owner's terms. Kingdom decides who may grant and use one with [`@inixiative/permissions`](https://github.com/inixiative/permissions); a grant's lens is [json-rules](https://github.com/inixiative/json-rules). This package presents Kingdom Signets.
 
 A **Signet** is Kingdom's only grant for using an integration. It names the resources, operations, lens and limits, and it can be revoked. Its grantee is a user or an integration, for example a paired Foundry or a machine's local Archive. The grantee presents it with an access token plus a DPoP proof signed by its device key (RFC 9449).
 
-This package is the one implementation of that protocol, shared by Kingdom (which verifies) and Archive, Foundry and Oracle (which present):
+This package is the one implementation of that protocol, shared by Kingdom (which verifies) and Archive, Foundry, Oracle and KCP (which present):
 
 - `contracts`: the wire schemas: keys, grants (operation picks, lens layers, terms), proposals, pairing requests, delivered credentials, `describe` and `execute`, and the conversation frames.
 - `proof`: create and verify DPoP proofs (ES256, nonce-bound, access-token-bound).
@@ -106,7 +108,7 @@ socket.start();
 await signet.execute({
   integrationId,
   operation: 'thread.prompt',
-  input: { resourceId, threadId, postId: crypto.randomUUID(), text: 'The role you wanted opened' },
+  input: { resourceId, threadId, postId: Bun.randomUUIDv7(), text: 'The role you wanted opened' },
 });
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/signet",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Present Kingdom Signets: the wire contracts, DPoP proofs, device pairing and a renewing client shared by Kingdom, Archive, Foundry and Oracle.",
   "type": "module",
   "main": "src/index.ts",
@@ -35,7 +35,7 @@
   "devDependencies": {
     "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@biomejs/biome": "2.5.2",
-    "@inixiative/config": "^0.5.178",
+    "@inixiative/config": "^0.5.188",
     "@inixiative/json-rules": "^3.16.0",
     "@types/bun": "1.4.4",
     "lefthook": "2.1.9",

package/src/client.ts

@@ -643,7 +643,7 @@ export class SignetClient {
     return accessResultSchema.parse(
       await this.post(
         'execute',
-        { ...request, signetId: this.signetId, requestId: crypto.randomUUID() },
+        { ...request, signetId: this.signetId, requestId: Bun.randomUUIDv7() },
         undefined,
         options,
       ),

package/src/files.ts

@@ -32,7 +32,7 @@ export async function writePrivateJson(path: string, value: unknown): Promise<vo
     (process.getuid && parent.uid !== process.getuid())
   )
     throw Error('Signet credential directory must be owned and private (0700)');
-  const temporary = join(dirname(path), `.credential-${crypto.randomUUID()}`);
+  const temporary = join(dirname(path), `.credential-${Bun.randomUUIDv7()}`);
   try {
     await writeFile(temporary, JSON.stringify(value), { mode: 0o600, flag: 'wx' });
     await rename(temporary, path);

package/src/proof.ts

@@ -76,7 +76,7 @@ export const createSignetProof = async (input: {
       jwk: publicClientKeySchema.parse(input.publicKey),
     })
     .setIssuedAt()
-    .setJti(input.proofId ?? crypto.randomUUID())
+    .setJti(input.proofId ?? Bun.randomUUIDv7())
     .sign(await importJWK(input.privateKey, 'ES256'));
 
 export const keyThumbprint = (key: unknown) =>