@nexus-code/remote-protocol 0.0.0-stage → 0.1.0

package/ACCOUNT_KEYS.md

@@ -0,0 +1,83 @@
+# The account key (draft, v1)
+
+A user's devices seal what they send each other with a key only those devices hold. The relay passes the sealed messages on but cannot open them. A new device gets the key when the user signs in with Google and types the **account password**. The server keeps the key locked with that password and never sees the password or the key.
+
+The design is open on purpose: its safety rests on the keys, not on the code being hidden.
+
+## Keys
+
+| Key | What it is | Where it lives |
+|---|---|---|
+| **Account key (AK)** | 32 random bytes, made by the first device. `kid` is its version, from 1. | Each signed-in device, in Electron `safeStorage`. Never on the server unlocked. |
+| **Room key** | `HKDF-SHA256(ikm = AK, salt = empty, info = "nexus-remote/room-key/v1", 32 bytes)` | Made on each device from AK. Seals every frame's content. |
+| **Password key (KEK)** | `Argon2id(password, salt, ops, mem) → 32 bytes`. libsodium's `crypto_pwhash`, `ALG_ARGON2ID13`. New bundles use ops 3 and 64 MiB. The password is NFKC-normalized first. | Made only while unlocking, then dropped. |
+
+## The locked bundle (on the server)
+
+`KeyBundleSchema` in `src/account.ts`:
+
+```json
+{
+  "v": 1,
+  "kid": 1,
+  "kdf": { "alg": "argon2id13", "ops": 3, "mem": 67108864, "salt": "<16 bytes>" },
+  "nonce": "<24 bytes>",
+  "box": "<XChaCha20-Poly1305(KEK, AK, aad = bundleAadOf(userId, kid))>"
+}
+```
+
+- The associated data, `nexus-remote/account-key/v1|<userId>|<kid>`, ties the bundle to its user and key version. The server cannot pass one user's bundle off as another's, or an old key as the current one.
+- A wrong password fails to open the box, because the AEAD check fails. No separate verifier is stored.
+- The bundle keeps its own KDF settings, so new bundles can raise the cost without breaking old ones.
+
+## Sealed frames
+
+- Content: `XChaCha20-Poly1305(room key, json, nonce = 24 random bytes, aad = aadOf({from, to, seq, kid}))`.
+- `kid` in each frame names the AK version it was sealed with.
+- A device that gets a frame with a `kid` it does not hold fetches the bundle again and asks for the password (see "Reset").
+
+## Flows
+
+**First device** (`GET /account/key-bundle` → 404)
+1. The user sets the account password (typed twice) after signing in.
+2. The device makes AK (`kid` 1) and a salt, then derives KEK and seals AK.
+3. It sends `PUT /account/key-bundle` with `{ bundle, expected: null }`. A 409 means another device made one first: fetch it and unlock it instead.
+4. It keeps AK in `safeStorage`.
+
+**Another device** (`GET` → 200)
+1. The user types the account password.
+2. The device derives KEK with the bundle's `kdf` and opens the box.
+3. It keeps AK in `safeStorage`. A wrong password says so and asks again. Argon2id's cost is what slows guessing.
+
+**Changing the password** (a device holding AK, after the user types the current password again)
+- Seal the same AK, same `kid`, under a new salt and the new password.
+- `PUT` with `expected = <version>`.
+- Other devices keep working; they hold AK already.
+
+**Forgotten password: reset**
+1. The device makes a new AK (`kid + 1`) and seals it with a new password.
+2. `PUT` with `expected = <version>`.
+3. Other devices find frames with the new `kid`, fetch the bundle, and ask for the new password.
+4. Nothing is lost: the server keeps no history, only the sealed bundle.
+
+**Removing a device**
+- `DELETE /devices/:id` ends its sign-in and closes its socket. AK stays the same.
+- For a lost or stolen device, the user should also reset, so the device's copy of AK opens nothing new.
+
+## What the server needs to provide
+
+- `GET /account/key-bundle` → `200 { bundle, version }` or `404`.
+- `PUT /account/key-bundle` with body `{ bundle, expected }` → `200 { version }`, or `409` when `expected` is not the current version (`null` when one exists already).
+- Check the bundle against `KeyBundleSchema` and cap its size (it is well under 1 KB). Store it opaque. Return it only to a signed-in device of the same user.
+- Rate-limit the GET per user. Anyone who gets the bundle can guess passwords offline, so keep it only for the account's own devices.
+
+## On the device
+
+- AK and the session token go in Electron `safeStorage`.
+- On Linux without a keyring, `safeStorage` falls back to plain text (`basic_text`). There, AK is not written to disk; the password is asked at each start.
+- Crypto: `libsodium-wrappers-sumo` (wasm: `crypto_pwhash`, XChaCha20-Poly1305) and Node's `crypto.hkdfSync`. No native modules, so the three OSes and the Store build stay simple.
+
+## Later (not v1)
+
+- Per-device X25519 keys, signed with AK. These allow approving a new device from the phone or a QR code, and removing a device without a reset.
+- Forward secrecy for sealed frames (pairwise ephemeral keys).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 moreih29
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,28 @@
-# Temporary Holding Version
+# @nexus-code/remote-protocol
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The protocol between a NexusCode user's devices and the relay that connects them, as zod schemas.
+
+There are two layers:
+
+- **Relay frames** (`relay.ts`): what a device and its account's room on the relay send each other. The relay reads these: who a message is for, its sequence number, and the account key version it was sealed with. It cannot read the message itself.
+- **Sealed messages** (`sealed.ts`, `rpc.ts`, `view.ts`): what a sealed frame carries between two devices of the account.
+  - A `hello` that says which protocol version and capabilities a device serves.
+  - JSON-RPC 2.0 requests, answers and notifications: list and watch sessions, read and drive chats, read terminals.
+  - The chat view: the conversation as the serving device's app already built it, trimmed for drawing.
+
+Beside them:
+
+- **The account key's bundle** (`account.ts`): the account key locked with the account password, as the server keeps it. See `ACCOUNT_KEYS.md`.
+- **The voice socket** (`voice.ts`): audio to the server, text back while the user speaks.
+
+Sealing is XChaCha20-Poly1305. The key is the room key, derived from the account key. The associated data comes from `aadOf()` and binds a message to its routing.
+
+Until it is published, other repos use it by a local path, e.g. `"@nexus-code/remote-protocol": "file:../nexus-code/packages/remote-protocol"`, after `npm run build` here: its exports point at `dist`. They need `zod` 3.25 or later.
+
+## Use and publish
+
+Published as `@nexus-code/remote-protocol`: ES modules with their type
+declarations in `dist`, and `zod` 3.25 or later as a peer. The desktop app
+imports `src` directly; `npm run build` (run by `prepublishOnly`) makes
+`dist`. Relative imports in `src` end in `.js`, as Node's ES modules need
+them.

package/dist/account.d.ts

@@ -0,0 +1,261 @@
+/**
+ * The account key, locked with the account password: the server keeps the
+ * locked bundle and hands it to the account's devices, which open it on
+ * their own (see ../ACCOUNT_KEYS.md). The server never sees the password,
+ * the key, or anything made from them; it only checks the bundle's shape.
+ */
+import { z } from "zod";
+/** The associated data the key is sealed with: the user's id and the key's version, so a bundle cannot pass for another's. */
+export declare function bundleAadOf(userId: string, kid: number): string;
+/** Argon2id's settings, as libsodium's crypto_pwhash takes them (ALG_ARGON2ID13). */
+export declare const KdfSchema: z.ZodObject<{
+    alg: z.ZodLiteral<"argon2id13">;
+    /** crypto_pwhash's opslimit. */
+    ops: z.ZodNumber;
+    /** crypto_pwhash's memlimit, in bytes. */
+    mem: z.ZodNumber;
+    /** 16 random bytes. */
+    salt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    alg: "argon2id13";
+    ops: number;
+    mem: number;
+    salt: string;
+}, {
+    alg: "argon2id13";
+    ops: number;
+    mem: number;
+    salt: string;
+}>;
+export type Kdf = z.infer<typeof KdfSchema>;
+/** The settings a new bundle is locked with; a bundle keeps its own, so these can grow. */
+export declare const DEFAULT_KDF: {
+    readonly alg: "argon2id13";
+    readonly ops: 3;
+    readonly mem: number;
+};
+/**
+ * The account key (32 bytes) sealed with XChaCha20-Poly1305 under the key
+ * the password makes with `kdf`, with bundleAadOf(userId, kid) as the
+ * associated data. `kid` is the account key's version, which sealed frames
+ * name; it goes up when the key is made anew.
+ */
+export declare const KeyBundleSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kid: z.ZodNumber;
+    kdf: z.ZodObject<{
+        alg: z.ZodLiteral<"argon2id13">;
+        /** crypto_pwhash's opslimit. */
+        ops: z.ZodNumber;
+        /** crypto_pwhash's memlimit, in bytes. */
+        mem: z.ZodNumber;
+        /** 16 random bytes. */
+        salt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        alg: "argon2id13";
+        ops: number;
+        mem: number;
+        salt: string;
+    }, {
+        alg: "argon2id13";
+        ops: number;
+        mem: number;
+        salt: string;
+    }>;
+    /** 24 random bytes. */
+    nonce: z.ZodString;
+    box: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    kid: number;
+    nonce: string;
+    box: string;
+    v: 1;
+    kdf: {
+        alg: "argon2id13";
+        ops: number;
+        mem: number;
+        salt: string;
+    };
+}, {
+    kid: number;
+    nonce: string;
+    box: string;
+    v: 1;
+    kdf: {
+        alg: "argon2id13";
+        ops: number;
+        mem: number;
+        salt: string;
+    };
+}>;
+export type KeyBundle = z.infer<typeof KeyBundleSchema>;
+/** GET /account/key-bundle: the bundle and its version on the server, or 404 before there is one. */
+export declare const KeyBundleResponseSchema: z.ZodObject<{
+    bundle: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        kid: z.ZodNumber;
+        kdf: z.ZodObject<{
+            alg: z.ZodLiteral<"argon2id13">;
+            /** crypto_pwhash's opslimit. */
+            ops: z.ZodNumber;
+            /** crypto_pwhash's memlimit, in bytes. */
+            mem: z.ZodNumber;
+            /** 16 random bytes. */
+            salt: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        }, {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        }>;
+        /** 24 random bytes. */
+        nonce: z.ZodString;
+        box: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    }, {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    }>;
+    /** Counts the bundle's writes, for the next PUT to say which one it replaces. */
+    version: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    bundle: {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    };
+    version: number;
+}, {
+    bundle: {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    };
+    version: number;
+}>;
+export type KeyBundleResponse = z.infer<typeof KeyBundleResponseSchema>;
+/**
+ * PUT /account/key-bundle. `expected` is the version it replaces, or null
+ * for the first bundle; the server answers 409 when another write came
+ * first. A new password locks the same key (same kid); a reset puts a new
+ * key (kid + 1), which the account's other devices take once they are told
+ * the new password.
+ */
+export declare const KeyBundlePutSchema: z.ZodObject<{
+    bundle: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        kid: z.ZodNumber;
+        kdf: z.ZodObject<{
+            alg: z.ZodLiteral<"argon2id13">;
+            /** crypto_pwhash's opslimit. */
+            ops: z.ZodNumber;
+            /** crypto_pwhash's memlimit, in bytes. */
+            mem: z.ZodNumber;
+            /** 16 random bytes. */
+            salt: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        }, {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        }>;
+        /** 24 random bytes. */
+        nonce: z.ZodString;
+        box: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    }, {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    }>;
+    expected: z.ZodNullable<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    expected: number | null;
+    bundle: {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    };
+}, {
+    expected: number | null;
+    bundle: {
+        kid: number;
+        nonce: string;
+        box: string;
+        v: 1;
+        kdf: {
+            alg: "argon2id13";
+            ops: number;
+            mem: number;
+            salt: string;
+        };
+    };
+}>;
+export type KeyBundlePut = z.infer<typeof KeyBundlePutSchema>;
+//# sourceMappingURL=account.d.ts.map

package/dist/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,8HAA8H;AAC9H,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,qFAAqF;AACrF,eAAO,MAAM,SAAS;;IAEpB,gCAAgC;;IAEhC,0CAA0C;;IAM1C,uBAAuB;;;;;;;;;;;;EAEvB,CAAC;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAE5C,2FAA2F;AAC3F,eAAO,MAAM,WAAW;;;;CAAgE,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;QAtB1B,gCAAgC;;QAEhC,0CAA0C;;QAM1C,uBAAuB;;;;;;;;;;;;;IAkBvB,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;EAGvB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,uBAAuB;;;;;;YAjClC,gCAAgC;;YAEhC,0CAA0C;;YAM1C,uBAAuB;;;;;;;;;;;;;QAkBvB,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;IASvB,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjF,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;;YA/C7B,gCAAgC;;YAEhC,0CAA0C;;YAM1C,uBAAuB;;;;;;;;;;;;;QAkBvB,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/account.js

@@ -0,0 +1,60 @@
+/**
+ * The account key, locked with the account password: the server keeps the
+ * locked bundle and hands it to the account's devices, which open it on
+ * their own (see ../ACCOUNT_KEYS.md). The server never sees the password,
+ * the key, or anything made from them; it only checks the bundle's shape.
+ */
+import { z } from "zod";
+import { Base64UrlSchema } from "./relay.js";
+/** The associated data the key is sealed with: the user's id and the key's version, so a bundle cannot pass for another's. */
+export function bundleAadOf(userId, kid) {
+    return `nexus-remote/account-key/v1|${userId}|${kid}`;
+}
+/** Argon2id's settings, as libsodium's crypto_pwhash takes them (ALG_ARGON2ID13). */
+export const KdfSchema = z.object({
+    alg: z.literal("argon2id13"),
+    /** crypto_pwhash's opslimit. */
+    ops: z.number().int().min(1).max(10),
+    /** crypto_pwhash's memlimit, in bytes. */
+    mem: z
+        .number()
+        .int()
+        .min(16 * 1024 * 1024)
+        .max(1024 * 1024 * 1024),
+    /** 16 random bytes. */
+    salt: Base64UrlSchema,
+});
+/** The settings a new bundle is locked with; a bundle keeps its own, so these can grow. */
+export const DEFAULT_KDF = { alg: "argon2id13", ops: 3, mem: 64 * 1024 * 1024 };
+/**
+ * The account key (32 bytes) sealed with XChaCha20-Poly1305 under the key
+ * the password makes with `kdf`, with bundleAadOf(userId, kid) as the
+ * associated data. `kid` is the account key's version, which sealed frames
+ * name; it goes up when the key is made anew.
+ */
+export const KeyBundleSchema = z.object({
+    v: z.literal(1),
+    kid: z.number().int().positive(),
+    kdf: KdfSchema,
+    /** 24 random bytes. */
+    nonce: Base64UrlSchema,
+    box: Base64UrlSchema,
+});
+/** GET /account/key-bundle: the bundle and its version on the server, or 404 before there is one. */
+export const KeyBundleResponseSchema = z.object({
+    bundle: KeyBundleSchema,
+    /** Counts the bundle's writes, for the next PUT to say which one it replaces. */
+    version: z.number().int().positive(),
+});
+/**
+ * PUT /account/key-bundle. `expected` is the version it replaces, or null
+ * for the first bundle; the server answers 409 when another write came
+ * first. A new password locks the same key (same kid); a reset puts a new
+ * key (kid + 1), which the account's other devices take once they are told
+ * the new password.
+ */
+export const KeyBundlePutSchema = z.object({
+    bundle: KeyBundleSchema,
+    expected: z.number().int().positive().nullable(),
+});
+//# sourceMappingURL=account.js.map

package/dist/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,8HAA8H;AAC9H,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,GAAW;IACrD,OAAO,+BAA+B,MAAM,IAAI,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5B,gCAAgC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,0CAA0C;IAC1C,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;SACrB,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC1B,uBAAuB;IACvB,IAAI,EAAE,eAAe;CACtB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAW,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,SAAS;IACd,uBAAuB;IACvB,KAAK,EAAE,eAAe;IACtB,GAAG,EAAE,eAAe;CACrB,CAAC,CAAC;AAGH,qGAAqG;AACrG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,eAAe;IACvB,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * NexusCode's remote protocol, in two layers, and the account key's bundle:
+ * - ./relay: the frames between a device and its account's room on the
+ *   relay, which the relay reads and routes;
+ * - ./sealed, ./rpc, ./view: what a sealed frame carries between two
+ *   devices of the account, which only they can open;
+ * - ./account: the account key, locked with the account password, as the
+ *   server keeps it;
+ * - ./voice: the voice socket, speech to text while the user speaks;
+ * - ./info: what the server offers (GET /info).
+ */
+export * from "./account.js";
+export * from "./info.js";
+export * from "./relay.js";
+export * from "./rpc.js";
+export * from "./sealed.js";
+export * from "./view.js";
+export * from "./voice.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * NexusCode's remote protocol, in two layers, and the account key's bundle:
+ * - ./relay: the frames between a device and its account's room on the
+ *   relay, which the relay reads and routes;
+ * - ./sealed, ./rpc, ./view: what a sealed frame carries between two
+ *   devices of the account, which only they can open;
+ * - ./account: the account key, locked with the account password, as the
+ *   server keeps it;
+ * - ./voice: the voice socket, speech to text while the user speaks;
+ * - ./info: what the server offers (GET /info).
+ */
+export * from "./account.js";
+export * from "./info.js";
+export * from "./relay.js";
+export * from "./rpc.js";
+export * from "./sealed.js";
+export * from "./view.js";
+export * from "./voice.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/info.d.ts

@@ -0,0 +1,46 @@
+/**
+ * GET /info, signed in or not: what the server offers, so a device shows
+ * only what works there.
+ */
+import { z } from "zod";
+export declare const ServerInfoSchema: z.ZodObject<{
+    /**
+     * The sign-ins the server has, each its own /auth/<name>/start: "google",
+     * "github", and "dev" only on a server at localhost. A device offers one
+     * button for each it knows.
+     */
+    signIn: z.ZodArray<z.ZodString, "many">;
+    relay: z.ZodNullable<z.ZodObject<{
+        version: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        version: number;
+    }, {
+        version: number;
+    }>>;
+    /** Null where the server has no speech-to-text provider: no microphone then. */
+    voice: z.ZodNullable<z.ZodObject<{
+        version: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        version: number;
+    }, {
+        version: number;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    signIn: string[];
+    relay: {
+        version: number;
+    } | null;
+    voice: {
+        version: number;
+    } | null;
+}, {
+    signIn: string[];
+    relay: {
+        version: number;
+    } | null;
+    voice: {
+        version: number;
+    } | null;
+}>;
+export type ServerInfo = z.infer<typeof ServerInfoSchema>;
+//# sourceMappingURL=info.d.ts.map

package/dist/info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"info.d.ts","sourceRoot":"","sources":["../src/info.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB;IAC3B;;;;OAIG;;;;;;;;;IAGH,gFAAgF;;;;;;;;;;;;;;;;;;;;;;;;EAEhF,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/info.js

@@ -0,0 +1,17 @@
+/**
+ * GET /info, signed in or not: what the server offers, so a device shows
+ * only what works there.
+ */
+import { z } from "zod";
+export const ServerInfoSchema = z.object({
+    /**
+     * The sign-ins the server has, each its own /auth/<name>/start: "google",
+     * "github", and "dev" only on a server at localhost. A device offers one
+     * button for each it knows.
+     */
+    signIn: z.array(z.string()),
+    relay: z.object({ version: z.number().int() }).nullable(),
+    /** Null where the server has no speech-to-text provider: no microphone then. */
+    voice: z.object({ version: z.number().int() }).nullable(),
+});
+//# sourceMappingURL=info.js.map

package/dist/info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"info.js","sourceRoot":"","sources":["../src/info.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzD,gFAAgF;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC"}