@joe-broadhead/messaging 0.0.0-stage → 0.7.1

package/dist/types/core/schema/ipc/device.d.ts

@@ -0,0 +1,735 @@
+/**
+ * The `device.*` IPC methods (spec §8.2, "Devices"; design §2.2, §7.5): this device's binding in its realm, and
+ * its person's devices. `device.status` and `device.bind` are on the agent tier (the plugin's runtime binds its
+ * host's daemon zero-click with a Jelly token, never a tool); `device.list`, `device.remove`, `device.link` and
+ * `device.approve` are for people, on the admin socket, and `device.approve.preview` is human tier. Spread into
+ * `IPC_METHODS`.
+ */
+import { z } from "zod";
+/**
+ * - `none`: this device is not a device of any person yet (a directory realm: not bound; a roster realm: no team).
+ * - `bound`: a current device of its person.
+ * - `attest-due`: bound, and its last Jelly token is over `LIMITS.attestAfterMs` old: the plugin binds again.
+ * - `removed`: its person's log (or the roster) shows it removed; it can never be bound again.
+ * - `replace`: `identity.replace` made this device new keys to replace its predecessor (design §13.8); the plugin
+ *   binds it with a Jelly token for `device`, as for `none`, and the daemon then removes the predecessor.
+ */
+export declare const BindingState: z.ZodEnum<{
+    removed: "removed";
+    none: "none";
+    bound: "bound";
+    "attest-due": "attest-due";
+    replace: "replace";
+}>;
+export type BindingState = z.infer<typeof BindingState>;
+/** An alarm of this device's realm (spec §15.9): `directory` (the directory contradicted itself) or `restored`. */
+export declare const RealmAlarmSummary: z.ZodObject<{
+    kind: z.ZodEnum<{
+        directory: "directory";
+        restored: "restored";
+    }>;
+    reason: z.ZodString;
+    at: z.ZodNumber;
+}, z.core.$strip>;
+export declare const DeviceStatus: z.ZodObject<{
+    realm: z.ZodEnum<{
+        roster: "roster";
+        directory: "directory";
+    }>;
+    device: z.ZodOptional<z.ZodString>;
+    binding: z.ZodEnum<{
+        removed: "removed";
+        none: "none";
+        bound: "bound";
+        "attest-due": "attest-due";
+        replace: "replace";
+    }>;
+    person: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>;
+    label: z.ZodOptional<z.ZodString>;
+    sth: z.ZodOptional<z.ZodObject<{
+        size: z.ZodNumber;
+        root: z.ZodString;
+        ts: z.ZodNumber;
+    }, z.core.$strip>>;
+    alarm: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<{
+            directory: "directory";
+            restored: "restored";
+        }>;
+        reason: z.ZodString;
+        at: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DeviceStatus = z.infer<typeof DeviceStatus>;
+/**
+ * One change of a person's devices (design §2.8): `added` (bound; a roster realm: admitted), `vouched` (an `attest`
+ * raised a device approved by link to Jelly-vouched), `removed` (unbound, or `member.remove`) or `replaced` (unbound
+ * by its successor after a restore, design §13.8). `label`, `kind`, `vouch` and `via` are the device's; `approver`
+ * names the device that approved one bound by link, by its label; `at` is the entry's time.
+ */
+export declare const DeviceChangeView: z.ZodObject<{
+    change: z.ZodEnum<{
+        removed: "removed";
+        replaced: "replaced";
+        added: "added";
+        vouched: "vouched";
+    }>;
+    device: z.ZodString;
+    label: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        "jelly-host": "jelly-host";
+        laptop: "laptop";
+        server: "server";
+        other: "other";
+    }>>;
+    vouch: z.ZodEnum<{
+        admin: "admin";
+        device: "device";
+        jelly: "jelly";
+    }>;
+    via: z.ZodOptional<z.ZodEnum<{
+        host: "host";
+        browser: "browser";
+    }>>;
+    approver: z.ZodOptional<z.ZodString>;
+    at: z.ZodNumber;
+}, z.core.$strip>;
+export type DeviceChangeView = z.infer<typeof DeviceChangeView>;
+/** One device of this device's person. */
+export declare const DeviceListEntry: z.ZodObject<{
+    device: z.ZodString;
+    label: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        "jelly-host": "jelly-host";
+        laptop: "laptop";
+        server: "server";
+        other: "other";
+    }>>;
+    vouched: z.ZodEnum<{
+        admin: "admin";
+        device: "device";
+        jelly: "jelly";
+    }>;
+    via: z.ZodOptional<z.ZodEnum<{
+        host: "host";
+        browser: "browser";
+    }>>;
+    current: z.ZodBoolean;
+    self: z.ZodBoolean;
+    since: z.ZodOptional<z.ZodNumber>;
+    unbound: z.ZodOptional<z.ZodObject<{
+        at: z.ZodNumber;
+        reason: z.ZodEnum<{
+            self: "self";
+            removed: "removed";
+            lost: "lost";
+            replaced: "replaced";
+            account_deleted: "account_deleted";
+        }>;
+        by: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DeviceListEntry = z.infer<typeof DeviceListEntry>;
+/** What a link request asks for, and the code to compare. */
+export declare const LinkPreview: z.ZodObject<{
+    device: z.ZodString;
+    label: z.ZodString;
+    kind: z.ZodEnum<{
+        "jelly-host": "jelly-host";
+        laptop: "laptop";
+        server: "server";
+        other: "other";
+    }>;
+    sas: z.ZodString;
+}, z.core.$strip>;
+/**
+ * A key's fingerprint as Jelly ID's consent page shows it (Jelly's contract v1.2 §12.2): the first six bytes of the
+ * key's RFC 7638 thumbprint, lower-case hex, in three groups of four.
+ */
+export declare const KeyFingerprint: z.ZodString;
+/** The code the person types at Jelly ID's page: ten symbols grouped 5-5 (Jelly's contract v1.2 §12.1). */
+export declare const LoginUserCode: z.ZodString;
+/**
+ * What a sign-in is for: binding (or attesting) this device, removing another device of its person, a step of
+ * `identity.replace` (binding the new keys, then removing the predecessor), or `directory.erase`.
+ */
+export declare const LoginPurpose: z.ZodEnum<{
+    bind: "bind";
+    replace: "replace";
+    remove: "remove";
+    erase: "erase";
+}>;
+/** The kinds a device that signs in may give itself: never `jelly-host`. */
+export declare const LoginKind: z.ZodEnum<{
+    laptop: "laptop";
+    server: "server";
+    other: "other";
+}>;
+/**
+ * A device's sign-in through the browser (spec §15.9, "Signing in through the browser"), as `device.login.status`
+ * reports it and the `login` event announces it.
+ *
+ * - `idle`: none since the daemon started.
+ * - `pending`: waiting for the person at Jelly ID (or binding with the token Jelly ID just gave).
+ * - `done`: `bind` bound or attested this device; `remove` removed `device`. `seq` is the log entry's.
+ * - `failed`: `code` and `message` in the house style (`expired`, `login_denied`, `login_unsupported`, ...).
+ * - `cancelled`: `device.login.cancel`, a newer `device.login`, or the daemon stopping.
+ */
+export declare const LoginState: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"idle">;
+}, z.core.$strip>, z.ZodObject<{
+    verificationUri: z.ZodString;
+    userCode: z.ZodString;
+    fingerprint: z.ZodString;
+    expires: z.ZodNumber;
+    state: z.ZodLiteral<"pending">;
+    purpose: z.ZodEnum<{
+        bind: "bind";
+        replace: "replace";
+        remove: "remove";
+        erase: "erase";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"done">;
+    purpose: z.ZodEnum<{
+        bind: "bind";
+        replace: "replace";
+        remove: "remove";
+        erase: "erase";
+    }>;
+    person: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+    device: z.ZodString;
+    seq: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"failed">;
+    purpose: z.ZodEnum<{
+        bind: "bind";
+        replace: "replace";
+        remove: "remove";
+        erase: "erase";
+    }>;
+    code: z.ZodEnum<{
+        expired: "expired";
+        invalid_request: "invalid_request";
+        not_member: "not_member";
+        bad_signature: "bad_signature";
+        unknown_session: "unknown_session";
+        ambiguous_address: "ambiguous_address";
+        no_recipients: "no_recipients";
+        unknown_address: "unknown_address";
+        refused: "refused";
+        declined: "declined";
+        request_required: "request_required";
+        rate_limited: "rate_limited";
+        loop_guard: "loop_guard";
+        too_large: "too_large";
+        secret_refused: "secret_refused";
+        duplicate: "duplicate";
+        relay_unavailable: "relay_unavailable";
+        not_found: "not_found";
+        invalid_state: "invalid_state";
+        forbidden: "forbidden";
+        guarded_turn: "guarded_turn";
+        roster_conflict: "roster_conflict";
+        invite_invalid: "invite_invalid";
+        no_identity: "no_identity";
+        binding_invalid: "binding_invalid";
+        jelly_unavailable: "jelly_unavailable";
+        log_conflict: "log_conflict";
+        conv_conflict: "conv_conflict";
+        stale_epoch: "stale_epoch";
+        device_limit: "device_limit";
+        admission_required: "admission_required";
+        admission_invalid: "admission_invalid";
+        directory_inconsistent: "directory_inconsistent";
+        unknown_device: "unknown_device";
+        directory_unavailable: "directory_unavailable";
+        login_unsupported: "login_unsupported";
+        login_denied: "login_denied";
+        grant_required: "grant_required";
+        grant_invalid: "grant_invalid";
+        ticket_required: "ticket_required";
+        ticket_invalid: "ticket_invalid";
+        daemon_unavailable: "daemon_unavailable";
+        daemon_mismatch: "daemon_mismatch";
+        store_refused: "store_refused";
+        internal: "internal";
+    }>;
+    message: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"cancelled">;
+    purpose: z.ZodEnum<{
+        bind: "bind";
+        replace: "replace";
+        remove: "remove";
+        erase: "erase";
+    }>;
+}, z.core.$strip>], "state">;
+export type LoginState = z.infer<typeof LoginState>;
+/** `device.remove`'s params, which its preview takes too (spec §8.2, "Previews"). */
+export declare const DeviceRemoveParams: z.ZodObject<{
+    device: z.ZodString;
+    reason: z.ZodOptional<z.ZodEnum<{
+        self: "self";
+        removed: "removed";
+        lost: "lost";
+    }>>;
+    token: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** `device.approve`'s params; its preview takes them with `sas` optional. */
+export declare const DeviceApproveParams: z.ZodObject<{
+    link: z.ZodString;
+    sas: z.ZodString;
+}, z.core.$strict>;
+/** `identity.replace`'s params, which its preview takes too (spec §8.2, "Previews"); the preview never reads `token`. */
+export declare const IdentityReplaceParams: z.ZodObject<{
+    token: z.ZodOptional<z.ZodString>;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** `directory.erase`'s params, which its preview takes too; the preview never reads `token`. */
+export declare const DirectoryEraseParams: z.ZodObject<{
+    token: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const DEVICE_METHODS: {
+    /** Agent tier. This device's realm and binding; the device id the plugin asks Jelly ID to bind. */
+    readonly "device.status": {
+        readonly params: z.ZodObject<{}, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            realm: z.ZodEnum<{
+                roster: "roster";
+                directory: "directory";
+            }>;
+            device: z.ZodOptional<z.ZodString>;
+            binding: z.ZodEnum<{
+                removed: "removed";
+                none: "none";
+                bound: "bound";
+                "attest-due": "attest-due";
+                replace: "replace";
+            }>;
+            person: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>;
+            label: z.ZodOptional<z.ZodString>;
+            sth: z.ZodOptional<z.ZodObject<{
+                size: z.ZodNumber;
+                root: z.ZodString;
+                ts: z.ZodNumber;
+            }, z.core.$strip>>;
+            alarm: z.ZodOptional<z.ZodObject<{
+                kind: z.ZodEnum<{
+                    directory: "directory";
+                    restored: "restored";
+                }>;
+                reason: z.ZodString;
+                at: z.ZodNumber;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    /**
+     * Agent tier, for the plugin's runtime only (design §2.2). Binds this device (or attests it again) with a Jelly
+     * resource token whose `cnf` names this device's key, for this home's account if it has one. A directory realm only.
+     */
+    readonly "device.bind": {
+        readonly params: z.ZodObject<{
+            token: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            kind: z.ZodOptional<z.ZodEnum<{
+                "jelly-host": "jelly-host";
+                laptop: "laptop";
+                server: "server";
+                other: "other";
+            }>>;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            person: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+            device: z.ZodString;
+            seq: z.ZodNumber;
+        }, z.core.$strip>;
+    };
+    /** Admin tier. This device's person's devices, current first. */
+    readonly "device.list": {
+        readonly params: z.ZodObject<{}, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            devices: z.ZodArray<z.ZodObject<{
+                device: z.ZodString;
+                label: z.ZodString;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    "jelly-host": "jelly-host";
+                    laptop: "laptop";
+                    server: "server";
+                    other: "other";
+                }>>;
+                vouched: z.ZodEnum<{
+                    admin: "admin";
+                    device: "device";
+                    jelly: "jelly";
+                }>;
+                via: z.ZodOptional<z.ZodEnum<{
+                    host: "host";
+                    browser: "browser";
+                }>>;
+                current: z.ZodBoolean;
+                self: z.ZodBoolean;
+                since: z.ZodOptional<z.ZodNumber>;
+                unbound: z.ZodOptional<z.ZodObject<{
+                    at: z.ZodNumber;
+                    reason: z.ZodEnum<{
+                        self: "self";
+                        removed: "removed";
+                        lost: "lost";
+                        replaced: "replaced";
+                        account_deleted: "account_deleted";
+                    }>;
+                    by: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    /**
+     * Admin tier. Removes a device of this device's person: this device itself, or another with a fresh Jelly token
+     * bound to this device (design §2.1). A directory realm only; a roster realm removes machines with `team.remove`.
+     */
+    readonly "device.remove": {
+        readonly params: z.ZodObject<{
+            device: z.ZodString;
+            reason: z.ZodOptional<z.ZodEnum<{
+                self: "self";
+                removed: "removed";
+                lost: "lost";
+            }>>;
+            token: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            seq: z.ZodNumber;
+        }, z.core.$strip>;
+    };
+    /**
+     * Admin tier, on a new device that Jelly ID does not enrol (design §2.5). Makes this device's link request: its
+     * text (shown as a QR code too) and the code to compare, valid until `expires`. The daemon then waits to be
+     * approved, and binds itself when its person's log shows the approval. A directory realm only.
+     */
+    readonly "device.link": {
+        readonly params: z.ZodObject<{
+            label: z.ZodOptional<z.ZodString>;
+            kind: z.ZodOptional<z.ZodEnum<{
+                "jelly-host": "jelly-host";
+                laptop: "laptop";
+                server: "server";
+                other: "other";
+            }>>;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            link: z.ZodString;
+            sas: z.ZodString;
+            expires: z.ZodNumber;
+        }, z.core.$strip>;
+    };
+    /**
+     * Admin tier, in a directory realm, not under a Jelly host (spec §15.9, "Signing in through the browser"). Starts
+     * a sign-in at Jelly ID for this device and returns where the person approves it, the code and this key's
+     * fingerprint to check there, and when it expires. The daemon then polls Jelly ID and, once approved, binds this
+     * device (or attests it again), or with `remove` removes that other device of its person with the token. A newer
+     * call cancels a pending one. Needs Jelly ID's device sign-in (its contract v1.2 §12): `login_unsupported` without.
+     */
+    readonly "device.login": {
+        readonly params: z.ZodObject<{
+            label: z.ZodOptional<z.ZodString>;
+            kind: z.ZodOptional<z.ZodEnum<{
+                laptop: "laptop";
+                server: "server";
+                other: "other";
+            }>>;
+            remove: z.ZodOptional<z.ZodObject<{
+                device: z.ZodString;
+                reason: z.ZodOptional<z.ZodEnum<{
+                    removed: "removed";
+                    lost: "lost";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            verificationUri: z.ZodString;
+            userCode: z.ZodString;
+            fingerprint: z.ZodString;
+            expires: z.ZodNumber;
+            purpose: z.ZodEnum<{
+                bind: "bind";
+                replace: "replace";
+                remove: "remove";
+                erase: "erase";
+            }>;
+            interval: z.ZodNumber;
+        }, z.core.$strip>;
+    };
+    /** Admin tier. The sign-in's state; with `waitMs`, answers once it changes or the wait ends. */
+    readonly "device.login.status": {
+        readonly params: z.ZodObject<{
+            waitMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+        readonly result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            state: z.ZodLiteral<"idle">;
+        }, z.core.$strip>, z.ZodObject<{
+            verificationUri: z.ZodString;
+            userCode: z.ZodString;
+            fingerprint: z.ZodString;
+            expires: z.ZodNumber;
+            state: z.ZodLiteral<"pending">;
+            purpose: z.ZodEnum<{
+                bind: "bind";
+                replace: "replace";
+                remove: "remove";
+                erase: "erase";
+            }>;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"done">;
+            purpose: z.ZodEnum<{
+                bind: "bind";
+                replace: "replace";
+                remove: "remove";
+                erase: "erase";
+            }>;
+            person: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+            device: z.ZodString;
+            seq: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"failed">;
+            purpose: z.ZodEnum<{
+                bind: "bind";
+                replace: "replace";
+                remove: "remove";
+                erase: "erase";
+            }>;
+            code: z.ZodEnum<{
+                expired: "expired";
+                invalid_request: "invalid_request";
+                not_member: "not_member";
+                bad_signature: "bad_signature";
+                unknown_session: "unknown_session";
+                ambiguous_address: "ambiguous_address";
+                no_recipients: "no_recipients";
+                unknown_address: "unknown_address";
+                refused: "refused";
+                declined: "declined";
+                request_required: "request_required";
+                rate_limited: "rate_limited";
+                loop_guard: "loop_guard";
+                too_large: "too_large";
+                secret_refused: "secret_refused";
+                duplicate: "duplicate";
+                relay_unavailable: "relay_unavailable";
+                not_found: "not_found";
+                invalid_state: "invalid_state";
+                forbidden: "forbidden";
+                guarded_turn: "guarded_turn";
+                roster_conflict: "roster_conflict";
+                invite_invalid: "invite_invalid";
+                no_identity: "no_identity";
+                binding_invalid: "binding_invalid";
+                jelly_unavailable: "jelly_unavailable";
+                log_conflict: "log_conflict";
+                conv_conflict: "conv_conflict";
+                stale_epoch: "stale_epoch";
+                device_limit: "device_limit";
+                admission_required: "admission_required";
+                admission_invalid: "admission_invalid";
+                directory_inconsistent: "directory_inconsistent";
+                unknown_device: "unknown_device";
+                directory_unavailable: "directory_unavailable";
+                login_unsupported: "login_unsupported";
+                login_denied: "login_denied";
+                grant_required: "grant_required";
+                grant_invalid: "grant_invalid";
+                ticket_required: "ticket_required";
+                ticket_invalid: "ticket_invalid";
+                daemon_unavailable: "daemon_unavailable";
+                daemon_mismatch: "daemon_mismatch";
+                store_refused: "store_refused";
+                internal: "internal";
+            }>;
+            message: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"cancelled">;
+            purpose: z.ZodEnum<{
+                bind: "bind";
+                replace: "replace";
+                remove: "remove";
+                erase: "erase";
+            }>;
+        }, z.core.$strip>], "state">;
+    };
+    /** Admin tier. Cancels a pending sign-in; nothing when none is pending. */
+    readonly "device.login.cancel": {
+        readonly params: z.ZodObject<{}, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    /** Human tier, read-only (design §13.12): what a link request asks for, and its code. Refuses an expired one. */
+    /** `device.approve`'s input (spec §8.2, "Previews"); the code may be left out, and is never checked here. */
+    readonly "device.approve.preview": {
+        readonly params: z.ZodObject<{
+            link: z.ZodString;
+            sas: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            device: z.ZodString;
+            label: z.ZodString;
+            kind: z.ZodEnum<{
+                "jelly-host": "jelly-host";
+                laptop: "laptop";
+                server: "server";
+                other: "other";
+            }>;
+            sas: z.ZodString;
+        }, z.core.$strip>;
+    };
+    /**
+     * Admin tier, on a device of the person that Jelly ID vouched for: approves the link request, whose code the
+     * person compared and gives back as `sas`, by appending the new device's `bind` to the person's log.
+     */
+    readonly "device.approve": {
+        readonly params: z.ZodObject<{
+            link: z.ZodString;
+            sas: z.ZodString;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            device: z.ZodString;
+            seq: z.ZodNumber;
+        }, z.core.$strip>;
+    };
+    /**
+     * Admin tier, a directory realm (design §13.8, A8; spec §15.9 "Replacing this device"): this home gets new keys
+     * and replaces its predecessor, the device its store belongs to (after a restore: `keys_missing` or `restored`; or
+     * on purpose, for a fresh key). Each call moves the replacement on and says where it stands:
+     * - `done`: the new device is bound (a `bind` with a Jelly token for its key) and the predecessor unbound with
+     *   reason `replaced` (signed by the new device, with a Jelly token for it); grants re-signed, conversations kept
+     *   under the successor rule;
+     * - `token`: under a Jelly host, waiting for the host's token for `device` (`device.bind` or this method with it);
+     * - `sign-in`: waiting for the person at Jelly ID; call again once it is done. A sign-in's token vouches for one
+     *   act (spec §15.3), so through the browser the replacement takes two: one binds the new key, one removes the
+     *   predecessor. A Jelly host's token does both.
+     * `no_identity` before this home was bound to an account; `invalid_state` on a removed device.
+     */
+    readonly "identity.replace": {
+        readonly params: z.ZodObject<{
+            token: z.ZodOptional<z.ZodString>;
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        readonly result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            state: z.ZodLiteral<"done">;
+            person: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+            device: z.ZodString;
+            predecessor: z.ZodString;
+            seq: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"token">;
+            device: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            verificationUri: z.ZodString;
+            userCode: z.ZodString;
+            fingerprint: z.ZodString;
+            expires: z.ZodNumber;
+            state: z.ZodLiteral<"sign-in">;
+            purpose: z.ZodEnum<{
+                bind: "bind";
+                replace: "replace";
+                remove: "remove";
+                erase: "erase";
+            }>;
+            interval: z.ZodNumber;
+            device: z.ZodString;
+        }, z.core.$strip>], "state">;
+    };
+    /**
+     * Human tier, read-only: what `identity.replace` would do (design §13.8: the predecessor as `device.remove.preview`
+     * shows a device), why, how many sign-ins it still needs, and the confirmation's fixed sentence.
+     */
+    readonly "identity.replace.preview": {
+        readonly params: z.ZodObject<{
+            token: z.ZodOptional<z.ZodString>;
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            predecessor: z.ZodObject<{
+                device: z.ZodString;
+                label: z.ZodString;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    "jelly-host": "jelly-host";
+                    laptop: "laptop";
+                    server: "server";
+                    other: "other";
+                }>>;
+                vouch: z.ZodEnum<{
+                    device: "device";
+                    jelly: "jelly";
+                }>;
+                via: z.ZodOptional<z.ZodEnum<{
+                    host: "host";
+                    browser: "browser";
+                }>>;
+                since: z.ZodOptional<z.ZodNumber>;
+                current: z.ZodBoolean;
+            }, z.core.$strip>;
+            alarm: z.ZodNullable<z.ZodEnum<{
+                restored: "restored";
+                keys_missing: "keys_missing";
+            }>>;
+            device: z.ZodOptional<z.ZodString>;
+            signIns: z.ZodNumber;
+            sentence: z.ZodString;
+        }, z.core.$strip>;
+    };
+    /**
+     * Admin tier, a directory realm (design §3.7; spec §15.10 `dir.erase`): erases this person's account from
+     * Messaging, from this device: an `unbind` of every current device, with a fresh Jelly token bound to this one (a
+     * Jelly host's `token`, or a sign-in through the browser). The directory deletes the profile, every log body and
+     * keys statement, and the queues; the account can never be bound again. `done`: erased, and this device stops as
+     * removed. `rate_limited` (with `retryAfterMs`) past the directory's 10 erasures per person a day.
+     */
+    readonly "directory.erase": {
+        readonly params: z.ZodObject<{
+            token: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        readonly result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            state: z.ZodLiteral<"done">;
+            person: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+            devices: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            verificationUri: z.ZodString;
+            userCode: z.ZodString;
+            fingerprint: z.ZodString;
+            expires: z.ZodNumber;
+            state: z.ZodLiteral<"sign-in">;
+            purpose: z.ZodEnum<{
+                bind: "bind";
+                replace: "replace";
+                remove: "remove";
+                erase: "erase";
+            }>;
+            interval: z.ZodNumber;
+        }, z.core.$strip>], "state">;
+    };
+    /** Human tier, read-only: exactly what `directory.erase` deletes, and what stays. */
+    readonly "directory.erase.preview": {
+        readonly params: z.ZodObject<{
+            token: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        readonly result: z.ZodObject<{
+            person: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+            devices: z.ZodArray<z.ZodObject<{
+                device: z.ZodString;
+                label: z.ZodString;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    "jelly-host": "jelly-host";
+                    laptop: "laptop";
+                    server: "server";
+                    other: "other";
+                }>>;
+                self: z.ZodBoolean;
+            }, z.core.$strip>>;
+            signIns: z.ZodNumber;
+            perDay: z.ZodNumber;
+            lost: z.ZodArray<z.ZodString>;
+            kept: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+    };
+};