@joe-broadhead/messaging 0.0.0-stage → 0.7.1

package/dist/types/core/schema/jelly.d.ts

@@ -0,0 +1,160 @@
+/**
+ * The shapes of Jelly ID that a hosted realm reads (Jelly's resource-token contract v1.1; spec §15.2). Jelly
+ * owns them; these schemas are what Messaging accepts of them. Jelly's versions are additive, so headers,
+ * claims and key-set entries may carry members a later version adds; the members Messaging reads are strict.
+ */
+import { z } from "zod";
+/** A Jelly account id (contract v1.1 §5 step 6). */
+export declare const JellySubject: z.ZodString;
+export type JellySubject = z.infer<typeof JellySubject>;
+/** A Jelly host id (contract v1.1 §5 step 6). */
+export declare const JellyHost: z.ZodString;
+/** A key id: printable ASCII, 1 to 200 characters. */
+export declare const JellyKid: z.ZodString;
+/** A compact JWS: three base64url segments. The bound is far above a Jelly resource token's size. */
+export declare const Jws: z.ZodString;
+export type Jws = z.infer<typeof Jws>;
+/** The key a token is bound to (RFC 7800 `cnf.jwk`, contract v1.1 §3): exactly these three members. */
+export declare const CnfJwk: z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodLiteral<"Ed25519">;
+    x: z.ZodString;
+}, z.core.$strict>;
+export type CnfJwk = z.infer<typeof CnfJwk>;
+/** The JWS header of a resource token (contract v1.1 §4). */
+export declare const JellyTokenHeader: z.ZodObject<{
+    alg: z.ZodLiteral<"EdDSA">;
+    typ: z.ZodLiteral<"jelly-resource+jwt">;
+    kid: z.ZodString;
+}, z.core.$loose>;
+export type JellyTokenHeader = z.infer<typeof JellyTokenHeader>;
+/**
+ * How a token was minted when it was not by a host (contract v1.2 §12.4): `"device"`, a service's device
+ * that signed in through the browser. Read as a string, so a later value is refused by the verifier, not the schema.
+ */
+export declare const JELLY_DEVICE_SOURCE = "device";
+/**
+ * The claims of a resource token (contract v1.1 §4; v1.2 §12.4). `aud` is one string; `cnf` is exactly
+ * `{jwk}`. A host's token carries `hst`; a device's carries `src: "device"` and no `hst` (`verifyJellyToken`).
+ */
+export declare const JellyClaims: z.ZodObject<{
+    iss: z.ZodString;
+    aud: z.ZodString;
+    sub: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    email_verified: z.ZodOptional<z.ZodLiteral<true>>;
+    name: z.ZodOptional<z.ZodString>;
+    hst: z.ZodOptional<z.ZodString>;
+    src: z.ZodOptional<z.ZodString>;
+    cnf: z.ZodOptional<z.ZodObject<{
+        jwk: z.ZodObject<{
+            kty: z.ZodLiteral<"OKP">;
+            crv: z.ZodLiteral<"Ed25519">;
+            x: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    jti: z.ZodString;
+}, z.core.$loose>;
+export type JellyClaims = z.infer<typeof JellyClaims>;
+/** One public Ed25519 key of Jelly ID's key set (contract v1.1 §5). Entries of other key types are skipped. */
+export declare const JellyJwk: z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodLiteral<"Ed25519">;
+    x: z.ZodString;
+    kid: z.ZodString;
+}, z.core.$loose>;
+export type JellyJwk = z.infer<typeof JellyJwk>;
+/** `<issuer>/.well-known/jwks.json`. Each entry is read with `JellyJwk`; one that does not parse is skipped. */
+export declare const JellyJwks: z.ZodObject<{
+    keys: z.ZodArray<z.ZodUnknown>;
+}, z.core.$loose>;
+/** One key of `<issuer>/.well-known/jwks-history.json` (contract v1.1 §11): times are seconds since the epoch. */
+export declare const JellyHistoryKey: z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodLiteral<"Ed25519">;
+    x: z.ZodString;
+    kid: z.ZodString;
+    nbf: z.ZodNumber;
+    retired_at: z.ZodNullable<z.ZodNumber>;
+    revoked_at: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$loose>;
+export type JellyHistoryKey = z.infer<typeof JellyHistoryKey>;
+/** `<issuer>/.well-known/jwks-history.json`, oldest first; it never shrinks. */
+export declare const JellyKeyHistory: z.ZodObject<{
+    keys: z.ZodArray<z.ZodUnknown>;
+}, z.core.$loose>;
+/**
+ * A Jelly key a client has verified, as it persists it (its Jelly key archive, spec §15.2). `nbf`,
+ * `retiredAt` and `revokedAt` are the key history's (seconds) as last seen; `historyAt` is when that was (ms).
+ */
+export declare const ArchivedJellyKey: z.ZodObject<{
+    kid: z.ZodString;
+    x: z.ZodString;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    retiredAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    historyAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type ArchivedJellyKey = z.infer<typeof ArchivedJellyKey>;
+/** The audience of every action grant and session ticket a Jelly host mints for Messaging (spec §8.11). */
+export declare const JELLY_SERVICE_AUDIENCE = "@joe-broadhead/opencode-messaging#service";
+/** A Jelly agent id (`agt`), the engine a session ticket names. */
+export declare const JellyAgentId: z.ZodString;
+export type JellyAgentId = z.infer<typeof JellyAgentId>;
+/**
+ * The host's public action key (`--act-key`): exactly a public Ed25519 JWK. `kid`, `alg` and `use` may be present;
+ * any other member, a private `d` above all, is refused, and so is the daemon's start.
+ */
+export declare const ActKeyJwk: z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodLiteral<"Ed25519">;
+    x: z.ZodString;
+    kid: z.ZodOptional<z.ZodString>;
+    alg: z.ZodOptional<z.ZodEnum<{
+        Ed25519: "Ed25519";
+        EdDSA: "EdDSA";
+    }>>;
+    use: z.ZodOptional<z.ZodLiteral<"sig">>;
+}, z.core.$strict>;
+export type ActKeyJwk = z.infer<typeof ActKeyJwk>;
+/** The JWS header of an action grant (`jelly-act+jwt`). */
+export declare const JellyActHeader: z.ZodObject<{
+    alg: z.ZodLiteral<"EdDSA">;
+    typ: z.ZodLiteral<"jelly-act+jwt">;
+    kid: z.ZodString;
+}, z.core.$loose>;
+/** The JWS header of a session ticket (`jelly-session+jwt`). */
+export declare const JellySessionHeader: z.ZodObject<{
+    alg: z.ZodLiteral<"EdDSA">;
+    typ: z.ZodLiteral<"jelly-session+jwt">;
+    kid: z.ZodString;
+}, z.core.$loose>;
+/**
+ * The claims of an action grant (spec §8.11). `act` is the IPC method it allows, or `host` for a host-scope grant.
+ * `in` (the digest of the call's params) and `cls` (the action class) are required for a method grant. `iss`, `dev`
+ * and `mbr` (the host's member who acted, Jelly D29) are Jelly's; the daemon takes no authority from them.
+ */
+export declare const JellyActClaims: z.ZodObject<{
+    aud: z.ZodString;
+    act: z.ZodString;
+    in: z.ZodOptional<z.ZodString>;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    jti: z.ZodString;
+    iss: z.ZodOptional<z.ZodString>;
+    dev: z.ZodOptional<z.ZodString>;
+    cls: z.ZodOptional<z.ZodString>;
+    mbr: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type JellyActClaims = z.infer<typeof JellyActClaims>;
+/** The claims of a session ticket (spec §8.11): the agent and the session name it may register. */
+export declare const JellySessionClaims: z.ZodObject<{
+    aud: z.ZodString;
+    agt: z.ZodString;
+    name: z.ZodString;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$loose>;
+export type JellySessionClaims = z.infer<typeof JellySessionClaims>;

package/dist/types/core/schema/realm.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Realms (spec §5, "Realm and anchor"). A realm is the trust domain one daemon home belongs to: who the
+ * persons and their machines are, and which keys to seal to. A roster realm's id is the team id (§4) and its
+ * authority is the team's roster; a directory realm's id derives from its directory (§15.8) and its authority is
+ * the key directory's epoch log (§15).
+ */
+import { z } from "zod";
+/** A realm's id. For a roster realm, the team id: the hash of the genesis entry; for a directory realm, `directoryRealmId`. */
+export declare const RealmId: z.ZodString;
+export type RealmId = z.infer<typeof RealmId>;
+/** A roster realm's anchor: the sender's roster head (spec §4, §5). */
+export declare const RosterAnchor: z.ZodObject<{
+    kind: z.ZodLiteral<"roster">;
+    seq: z.ZodNumber;
+    hash: z.ZodString;
+}, z.core.$strip>;
+export type RosterAnchor = z.infer<typeof RosterAnchor>;
+/** A directory realm's anchor (spec §5, §15.6): the sender's adopted signed tree head, by its size and root. */
+export declare const EpochAnchor: z.ZodObject<{
+    kind: z.ZodLiteral<"epoch">;
+    size: z.ZodNumber;
+    root: z.ZodString;
+}, z.core.$strip>;
+export type EpochAnchor = z.infer<typeof EpochAnchor>;
+/**
+ * What an envelope commits to of its sender's view of the realm, so a receiver can tell whether the
+ * sender saw more than it has (catch up first) or something else (a divergence).
+ */
+export declare const Anchor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"roster">;
+    seq: z.ZodNumber;
+    hash: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"epoch">;
+    size: z.ZodNumber;
+    root: z.ZodString;
+}, z.core.$strip>], "kind">;
+export type Anchor = z.infer<typeof Anchor>;