@inixiative/signet 0.5.0 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/signet",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Present Kingdom Signets: the wire contracts, DPoP proofs, device pairing and a renewing client shared by Kingdom, Archive, Foundry and Oracle.",
   "type": "module",
   "main": "src/index.ts",
@@ -33,8 +33,9 @@
     "jose": "^6.2.3"
   },
   "devDependencies": {
+    "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@biomejs/biome": "2.5.2",
-    "@inixiative/config": "^0.5.115",
+    "@inixiative/config": "^0.5.116",
     "@types/bun": "1.4.2",
     "lefthook": "2.1.9",
     "typescript": "6.0.3",

package/src/threads.ts

@@ -27,16 +27,15 @@ export const threadIdSchema = foundryIdSchema;
 export const unbuiltThreadSelectorForms = ['withMember', 'tag'] as const;
 
 /**
- * What `within` may hold: exactly one non-`ids` form, never another selector, so it cannot nest. It is
- * set only by approving a request for a selector form narrowed to `ids` (the grant is then
- * `ids ∩ within`). No non-`ids` form is built in v1, so nothing parses here yet.
+ * `ids` takes `within` only once a non-`ids` form exists: `within` will hold exactly one such form
+ * (never a selector, so it can't nest), set only by approving a request for a selector form narrowed
+ * to `ids` (the grant is then `ids ∩ within`), and approval may never drop or widen it. Until then
+ * the strict object refuses `within` like any unknown key: structural, and representable in Kingdom's
+ * OpenAPI (a `z.never()` placeholder is not).
  */
-export const threadSelectorWithinSchema = z.never();
-
 export const idsThreadSelectorSchema = z.strictObject({
   form: z.literal('ids'),
   ids: z.array(threadIdSchema).min(1).max(100),
-  within: threadSelectorWithinSchema.optional(),
 });
 
 /** Which threads a grant reaches. A discriminated union on `form`; v1 builds only `ids`. */
@@ -78,12 +77,8 @@ export const narrowsThreadSelector = (
 ): boolean => {
   switch (requested.form) {
     case 'ids':
-      return (
-        granted.form === 'ids' &&
-        granted.ids.every((id) => requested.ids.includes(id)) &&
-        // `within` can only be kept as asked: never dropped, never added to a plain id list.
-        (requested.within === undefined) === (granted.within === undefined)
-      );
+      // When `within` exists, it must also be kept as asked: never dropped, never added.
+      return granted.form === 'ids' && granted.ids.every((id) => requested.ids.includes(id));
   }
 };