@irtio/protocol 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -128,6 +128,34 @@ declare const ErrorCode: {
         readonly code: 20;
         readonly message: "client cannot keep up with the stream; reconnect for a fresh snapshot";
     };
+    readonly E_TOKEN_EXPIRED: {
+        readonly code: 21;
+        readonly message: "auth token expired";
+    };
+    readonly E_TOKEN_INVALID: {
+        readonly code: 22;
+        readonly message: "auth token signature is invalid";
+    };
+    readonly E_TOKEN_WRONG_PROJECT: {
+        readonly code: 23;
+        readonly message: "auth token is for another project";
+    };
+    readonly E_TOKEN_WRONG_ROOM: {
+        readonly code: 24;
+        readonly message: "auth token is for another room";
+    };
+    readonly E_TOKEN_MALFORMED: {
+        readonly code: 25;
+        readonly message: "auth token is malformed: {reason}";
+    };
+    readonly E_TOKEN_BAD_ISSUER: {
+        readonly code: 26;
+        readonly message: "auth token issuer {issuer} is not accepted";
+    };
+    readonly E_TOKEN_BAD_ALG: {
+        readonly code: 27;
+        readonly message: "auth token algorithm {alg} is not allowed";
+    };
 };
 type ErrorCodeName = keyof typeof ErrorCode;
 interface ErrorCatalogueEntry {
@@ -153,6 +181,17 @@ type Credential = {
 } | {
     readonly kind: 'token';
     readonly token: string;
+}
+/**
+ * Week 13 (D27): the project key AND a JWT. The key stays because the router routes on it —
+ * a HELLO carrying only a token has nothing to resolve a tenant from — and the token is
+ * verified in the guest supervisor (HS256, per-project secret), never by the router. Wire tag
+ * 2; the unused tag 1 (`token`) keeps its meaning of months rather than being repurposed.
+ */
+ | {
+    readonly kind: 'jwt';
+    readonly key: string;
+    readonly token: string;
 };
 interface Hello {
     readonly protocolVersion: number;

package/dist/index.js

@@ -64,7 +64,17 @@ var ErrorCode = {
   E_SLOW_CONSUMER: {
     code: 20,
     message: "client cannot keep up with the stream; reconnect for a fresh snapshot"
-  }
+  },
+  // Week 13 (D27): every JWT refusal has a name. `E_AUTH` stays the generic ("no secret
+  // configured", "wrong project key"); these say WHICH refusal a token hit, because week 12's
+  // staging sessions were survivable precisely because refusals said which they were.
+  E_TOKEN_EXPIRED: { code: 21, message: "auth token expired" },
+  E_TOKEN_INVALID: { code: 22, message: "auth token signature is invalid" },
+  E_TOKEN_WRONG_PROJECT: { code: 23, message: "auth token is for another project" },
+  E_TOKEN_WRONG_ROOM: { code: 24, message: "auth token is for another room" },
+  E_TOKEN_MALFORMED: { code: 25, message: "auth token is malformed: {reason}" },
+  E_TOKEN_BAD_ISSUER: { code: 26, message: "auth token issuer {issuer} is not accepted" },
+  E_TOKEN_BAD_ALG: { code: 27, message: "auth token algorithm {alg} is not allowed" }
 };
 var ERROR_CATALOGUE = Object.keys(ErrorCode).map((name) => ({ name, code: ErrorCode[name].code, message: ErrorCode[name].message }));
 var BY_CODE = new Map(
@@ -100,9 +110,13 @@ function encodeHello(h) {
   if (h.credential.kind === "key") {
     w.u8(0);
     w.str(h.credential.key);
-  } else {
+  } else if (h.credential.kind === "token") {
     w.u8(1);
     w.str(h.credential.token);
+  } else {
+    w.u8(2);
+    w.str(h.credential.key);
+    w.str(h.credential.token);
   }
   w.str(h.roomId);
   w.bytes(h.schemaHash8);
@@ -123,6 +137,7 @@ function decodeHello(bytes) {
   let credential;
   if (credKind === 0) credential = { kind: "key", key: r.str() };
   else if (credKind === 1) credential = { kind: "token", token: r.str() };
+  else if (credKind === 2) credential = { kind: "jwt", key: r.str(), token: r.str() };
   else throw new Error(`decodeHello: unknown credential kind ${credKind}`);
   const roomId = r.str();
   const schemaHash8 = r.bytes(8);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@irtio/protocol",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "irtio wire protocol: frames, framing, session payloads, error codes, built-in presence",
   "license": "MIT",
   "publishConfig": {
@@ -20,7 +20,7 @@
     "dist"
   ],
   "dependencies": {
-    "@irtio/schema": "0.1.0"
+    "@irtio/schema": "0.2.0"
   },
   "scripts": {
     "build": "tsup",