@joe-broadhead/messaging 0.0.0-stage → 0.7.1

package/dist/types/core/schema/delegation.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Delegation chains (spec §6.7). A task request carries the chain of signed
+ * grants from its root requester to the session it addresses, so an executor (and whoever approves
+ * its work) sees who asked whom, for which task.
+ *
+ *   sig         = Ed25519(by, DOMAIN.delegation + JCS(grant without sig))
+ *   grantHash   = SHA-256(UTF-8(JCS(grant))), base64url, over the full grant including sig
+ *   chain       = [root grant, …, grant to this session]; each later grant has parent = grantHash(previous)
+ *
+ * Every hop is a new statement by the machine that delegates; nothing is forwarded as a credential.
+ * A hop can only narrow: scope ⊆ the previous scope (absent = unrestricted), maxDepth ≤ the previous
+ * maxDepth, exp ≤ the previous exp. `verifyChain` in core checks all of it.
+ *
+ * Grants are loose objects: a field a newer signer adds stays in the parsed grant, so the signature
+ * and the hash still cover it.
+ */
+import { z } from "zod";
+/** A scope label. Its meaning is left to clients; the protocol only checks that a hop never widens the set. */
+export declare const DelegationScope: z.ZodString;
+export type DelegationScope = z.infer<typeof DelegationScope>;
+export declare const DelegationGrant: z.ZodObject<{
+    realm: z.ZodString;
+    task: z.ZodString;
+    from: z.ZodString;
+    to: z.ZodString;
+    by: z.ZodString;
+    ts: z.ZodNumber;
+    exp: z.ZodNumber;
+    maxDepth: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    parent: z.ZodOptional<z.ZodString>;
+    sig: z.ZodString;
+}, z.core.$loose>;
+export type DelegationGrant = z.infer<typeof DelegationGrant>;
+/** Root first. Carried as `MessagePayload.delegation` on `kind: "task"` only. */
+export declare const DelegationChain: z.ZodArray<z.ZodObject<{
+    realm: z.ZodString;
+    task: z.ZodString;
+    from: z.ZodString;
+    to: z.ZodString;
+    by: z.ZodString;
+    ts: z.ZodNumber;
+    exp: z.ZodNumber;
+    maxDepth: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    parent: z.ZodOptional<z.ZodString>;
+    sig: z.ZodString;
+}, z.core.$loose>>;
+export type DelegationChain = z.infer<typeof DelegationChain>;
+/** What a verified chain says, as the daemon shows it on `InboxItem.chain` and `TaskRecord.chain`. */
+export declare const DelegationSummary: z.ZodObject<{
+    addresses: z.ZodArray<z.ZodString>;
+    depth: z.ZodNumber;
+    maxDepth: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+export type DelegationSummary = z.infer<typeof DelegationSummary>;