@wirebench/engine 2.2.0 → 3.1.0-rc.1

package/dist/server-api/identity.d.ts

@@ -0,0 +1,210 @@
+/**
+ * The identity module's wire shapes (identity spec §3.1), one object per request and response.
+ * The server's routes validate with them (through `z.toJSONSchema`) and the desktop's
+ * `ServerClient` parses answers with them, so a drift between the two fails typecheck.
+ *
+ * Nothing here trims or lower-cases: Fastify validates the JSON Schema rendering, which cannot
+ * carry a transform, so normalisation happens in the handler (`emailKey` in the server).
+ */
+import { z } from 'zod';
+/** §3.4: the only composition rule. Checked in the handler so the problem can name the number. */
+export declare const MIN_PASSWORD_LENGTH = 12;
+export declare const MAX_PASSWORD_LENGTH = 256;
+export declare const MAX_DEVICE_NAME_LENGTH = 80;
+export declare const MAX_DISPLAY_NAME_LENGTH = 120;
+/** 32 random bytes in base64url without padding: invitation secrets, grants, PKCE challenges. */
+export declare const SECRET_PATTERN: RegExp;
+export declare const DEVICE_TOKEN_PATTERN: RegExp;
+/** RFC 7636 §4.1 verifier alphabet and length. */
+export declare const PKCE_VERIFIER_PATTERN: RegExp;
+export declare const emailSchema: z.ZodString;
+export declare const passwordSchema: z.ZodString;
+export declare const deviceSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const identityIdSchema: z.ZodString;
+export declare const serverUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodString;
+    serverAdmin: z.ZodBoolean;
+}, z.core.$strip>;
+export type ServerUser = z.infer<typeof serverUserSchema>;
+export declare const signInResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        displayName: z.ZodString;
+        serverAdmin: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SignInResponse = z.infer<typeof signInResponseSchema>;
+export declare const localSignInRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    device: z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type LocalSignInRequest = z.infer<typeof localSignInRequestSchema>;
+export declare const oidcStartRequestSchema: z.ZodObject<{
+    device: z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strip>;
+    codeChallenge: z.ZodString;
+    loopbackPort: z.ZodNumber;
+}, z.core.$strip>;
+export type OidcStartRequest = z.infer<typeof oidcStartRequestSchema>;
+export declare const oidcStartResponseSchema: z.ZodObject<{
+    flowId: z.ZodString;
+    authorizationUrl: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type OidcStartResponse = z.infer<typeof oidcStartResponseSchema>;
+export declare const oidcCompleteRequestSchema: z.ZodObject<{
+    flowId: z.ZodString;
+    grant: z.ZodString;
+    codeVerifier: z.ZodString;
+}, z.core.$strip>;
+export type OidcCompleteRequest = z.infer<typeof oidcCompleteRequestSchema>;
+/** The IdP's redirect back to the server; `code` and `error` are mutually exclusive in practice. */
+export declare const oidcCallbackQuerySchema: z.ZodObject<{
+    state: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type OidcCallbackQuery = z.infer<typeof oidcCallbackQuerySchema>;
+export declare const signInMethodsSchema: z.ZodObject<{
+    local: z.ZodBoolean;
+    oidc: z.ZodArray<z.ZodObject<{
+        issuer: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const meResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        displayName: z.ZodString;
+        serverAdmin: z.ZodBoolean;
+    }, z.core.$strip>;
+    methods: z.ZodObject<{
+        local: z.ZodBoolean;
+        oidc: z.ZodArray<z.ZodObject<{
+            issuer: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type MeResponse = z.infer<typeof meResponseSchema>;
+export declare const passwordChangeRequestSchema: z.ZodObject<{
+    currentPassword: z.ZodOptional<z.ZodString>;
+    newPassword: z.ZodString;
+}, z.core.$strip>;
+export type PasswordChangeRequest = z.infer<typeof passwordChangeRequestSchema>;
+export declare const deviceSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodString;
+    current: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const devicesResponseSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodString;
+    current: z.ZodBoolean;
+}, z.core.$strip>>;
+export type DeviceSummary = z.infer<typeof deviceSummarySchema>;
+export declare const invitationCreateRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    serverAdmin: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type InvitationCreateRequest = z.infer<typeof invitationCreateRequestSchema>;
+export declare const invitationCreatedSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    url: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type InvitationCreated = z.infer<typeof invitationCreatedSchema>;
+export declare const invitationSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    serverAdmin: z.ZodBoolean;
+    createdBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    acceptedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const invitationsResponseSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    serverAdmin: z.ZodBoolean;
+    createdBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    acceptedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export type InvitationSummary = z.infer<typeof invitationSummarySchema>;
+export declare const invitationLookupQuerySchema: z.ZodObject<{
+    secret: z.ZodString;
+}, z.core.$strip>;
+export declare const invitationLookupResponseSchema: z.ZodObject<{
+    email: z.ZodString;
+    methods: z.ZodObject<{
+        local: z.ZodBoolean;
+        oidc: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type InvitationLookupResponse = z.infer<typeof invitationLookupResponseSchema>;
+export declare const invitationAcceptRequestSchema: z.ZodObject<{
+    secret: z.ZodString;
+    displayName: z.ZodString;
+    password: z.ZodString;
+    device: z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type InvitationAcceptRequest = z.infer<typeof invitationAcceptRequestSchema>;
+export declare const userSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodString;
+    serverAdmin: z.ZodBoolean;
+    disabledAt: z.ZodOptional<z.ZodString>;
+    methods: z.ZodObject<{
+        local: z.ZodBoolean;
+        oidc: z.ZodArray<z.ZodObject<{
+            issuer: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const usersResponseSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodString;
+    serverAdmin: z.ZodBoolean;
+    disabledAt: z.ZodOptional<z.ZodString>;
+    methods: z.ZodObject<{
+        local: z.ZodBoolean;
+        oidc: z.ZodArray<z.ZodObject<{
+            issuer: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>>;
+export type UserSummary = z.infer<typeof userSummarySchema>;
+export declare const userPatchRequestSchema: z.ZodObject<{
+    serverAdmin: z.ZodOptional<z.ZodBoolean>;
+    disabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type UserPatchRequest = z.infer<typeof userPatchRequestSchema>;
+export declare const passwordResetCreatedSchema: z.ZodObject<{
+    url: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type PasswordResetCreated = z.infer<typeof passwordResetCreatedSchema>;
+export declare const identityIdParamsSchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;

package/dist/server-api/identity.js

@@ -0,0 +1,115 @@
+/**
+ * The identity module's wire shapes (identity spec §3.1), one object per request and response.
+ * The server's routes validate with them (through `z.toJSONSchema`) and the desktop's
+ * `ServerClient` parses answers with them, so a drift between the two fails typecheck.
+ *
+ * Nothing here trims or lower-cases: Fastify validates the JSON Schema rendering, which cannot
+ * carry a transform, so normalisation happens in the handler (`emailKey` in the server).
+ */
+import { z } from 'zod';
+/** §3.4: the only composition rule. Checked in the handler so the problem can name the number. */
+export const MIN_PASSWORD_LENGTH = 12;
+export const MAX_PASSWORD_LENGTH = 256;
+export const MAX_DEVICE_NAME_LENGTH = 80;
+export const MAX_DISPLAY_NAME_LENGTH = 120;
+/** 32 random bytes in base64url without padding: invitation secrets, grants, PKCE challenges. */
+export const SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+export const DEVICE_TOKEN_PATTERN = /^wbs_[A-Za-z0-9_-]{43}$/;
+/** RFC 7636 §4.1 verifier alphabet and length. */
+export const PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+export const emailSchema = z.string().min(3).max(254).email();
+export const passwordSchema = z.string().min(1).max(MAX_PASSWORD_LENGTH);
+export const deviceSchema = z.object({ name: z.string().min(1).max(MAX_DEVICE_NAME_LENGTH) });
+export const identityIdSchema = z.string().min(1).max(64);
+export const serverUserSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    displayName: z.string(),
+    serverAdmin: z.boolean(),
+});
+export const signInResponseSchema = z.object({ token: z.string().regex(DEVICE_TOKEN_PATTERN), user: serverUserSchema });
+export const localSignInRequestSchema = z.object({
+    email: emailSchema,
+    password: passwordSchema,
+    device: deviceSchema,
+});
+export const oidcStartRequestSchema = z.object({
+    device: deviceSchema,
+    codeChallenge: z.string().regex(SECRET_PATTERN),
+    loopbackPort: z.number().int().min(1).max(65_535),
+});
+export const oidcStartResponseSchema = z.object({
+    flowId: z.string(),
+    authorizationUrl: z.string().url(),
+    expiresAt: z.string(),
+});
+export const oidcCompleteRequestSchema = z.object({
+    flowId: identityIdSchema,
+    grant: z.string().regex(SECRET_PATTERN),
+    codeVerifier: z.string().regex(PKCE_VERIFIER_PATTERN),
+});
+/** The IdP's redirect back to the server; `code` and `error` are mutually exclusive in practice. */
+export const oidcCallbackQuerySchema = z.object({
+    state: z.string().min(1).max(256),
+    code: z.string().min(1).max(4096).optional(),
+    error: z.string().max(256).optional(),
+    error_description: z.string().max(1024).optional(),
+});
+export const signInMethodsSchema = z.object({ local: z.boolean(), oidc: z.array(z.object({ issuer: z.string() })) });
+export const meResponseSchema = z.object({ user: serverUserSchema, methods: signInMethodsSchema });
+export const passwordChangeRequestSchema = z.object({
+    currentPassword: passwordSchema.optional(),
+    newPassword: passwordSchema,
+});
+export const deviceSummarySchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    createdAt: z.string(),
+    lastUsedAt: z.string(),
+    current: z.boolean(),
+});
+export const devicesResponseSchema = z.array(deviceSummarySchema);
+export const invitationCreateRequestSchema = z.object({ email: emailSchema, serverAdmin: z.boolean().optional() });
+export const invitationCreatedSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    url: z.string().url(),
+    expiresAt: z.string(),
+});
+export const invitationSummarySchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    serverAdmin: z.boolean(),
+    /** `null` for one created from the console (`admin invite`). */
+    createdBy: z.string().nullable(),
+    createdAt: z.string(),
+    expiresAt: z.string(),
+    acceptedAt: z.string().optional(),
+});
+export const invitationsResponseSchema = z.array(invitationSummarySchema);
+export const invitationLookupQuerySchema = z.object({ secret: z.string().regex(SECRET_PATTERN) });
+export const invitationLookupResponseSchema = z.object({
+    email: z.string(),
+    methods: z.object({ local: z.boolean(), oidc: z.boolean() }),
+});
+export const invitationAcceptRequestSchema = z.object({
+    secret: z.string().regex(SECRET_PATTERN),
+    displayName: z.string().min(1).max(MAX_DISPLAY_NAME_LENGTH),
+    password: passwordSchema,
+    device: deviceSchema,
+});
+export const userSummarySchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    displayName: z.string(),
+    serverAdmin: z.boolean(),
+    disabledAt: z.string().optional(),
+    methods: signInMethodsSchema,
+});
+export const usersResponseSchema = z.array(userSummarySchema);
+export const userPatchRequestSchema = z.object({
+    serverAdmin: z.boolean().optional(),
+    disabled: z.boolean().optional(),
+});
+export const passwordResetCreatedSchema = z.object({ url: z.string().url(), expiresAt: z.string() });
+export const identityIdParamsSchema = z.object({ id: identityIdSchema });

package/dist/server-api/licensing.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The licensing wire shapes (licensing spec §3.1, §3.3, §3.6). The server verifies and stores a license;
+ * the desktop parses a pasted one before sending it and reads the state back. Plain zod only (ADR-0009).
+ */
+import { z } from 'zod';
+export declare const LICENSE_FORMAT = "wbl1";
+/** `wbl1.<base64url payload>.<base64url signature>`: the shape only; verification is the server's. */
+export declare const LICENSE_TEXT_PATTERN: RegExp;
+/** Far above any real license line; bounds the body a server admin can send. */
+export declare const LICENSE_TEXT_MAX_LENGTH = 8192;
+/** Seats on a server with no license, or a lapsed one. A product term, not a setting. */
+export declare const COMMUNITY_SEATS = 5;
+/** Days after `expiresAt` that the license's edition still holds. A product term, not a setting. */
+export declare const GRACE_DAYS = 30;
+export declare const EDITIONS: readonly ["community", "team", "enterprise"];
+export declare const editionSchema: z.ZodEnum<{
+    community: "community";
+    team: "team";
+    enterprise: "enterprise";
+}>;
+export type Edition = z.infer<typeof editionSchema>;
+/** Names a route or module checks. Later modules add `scim`, `policies`, `scheduled-runs`. */
+export declare const FEATURES: readonly ["audit-log"];
+export declare const featureSchema: z.ZodEnum<{
+    "audit-log": "audit-log";
+}>;
+export type Feature = z.infer<typeof featureSchema>;
+export declare const LICENSE_STATUSES: readonly ["none", "active", "grace", "expired", "invalid"];
+export type LicenseStatus = (typeof LICENSE_STATUSES)[number];
+export type LicenseInvalidReason = 'malformed' | 'bad-signature' | 'not-yet-valid';
+/**
+ * The signed payload. Unknown keys are refused: the format version is what grows the payload.
+ * `features` stays a list of strings so that a feature a newer signer names does not make the whole
+ * license unreadable to an older server, which grants only the features it knows.
+ */
+export declare const licensePayloadSchema: z.ZodObject<{
+    id: z.ZodString;
+    customer: z.ZodString;
+    edition: z.ZodEnum<{
+        team: "team";
+        enterprise: "enterprise";
+    }>;
+    seats: z.ZodNullable<z.ZodNumber>;
+    issuedAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+    features: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type LicensePayload = z.infer<typeof licensePayloadSchema>;
+/** `GET /license` and the answer to `PUT /license` (§3.3). Fields past `features` are absent with no license. */
+export declare const licenseStateSchema: z.ZodObject<{
+    edition: z.ZodEnum<{
+        community: "community";
+        team: "team";
+        enterprise: "enterprise";
+    }>;
+    status: z.ZodEnum<{
+        none: "none";
+        invalid: "invalid";
+        active: "active";
+        grace: "grace";
+        expired: "expired";
+    }>;
+    seats: z.ZodObject<{
+        used: z.ZodNumber;
+        limit: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>;
+    features: z.ZodArray<z.ZodString>;
+    licenseId: z.ZodOptional<z.ZodString>;
+    customer: z.ZodOptional<z.ZodString>;
+    issuedAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    graceUntil: z.ZodOptional<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type LicenseState = z.infer<typeof licenseStateSchema>;
+export declare const licenseInstallRequestSchema: z.ZodObject<{
+    license: z.ZodString;
+}, z.core.$strip>;
+export type LicenseInstallRequest = z.infer<typeof licenseInstallRequestSchema>;

package/dist/server-api/licensing.js

@@ -0,0 +1,53 @@
+/**
+ * The licensing wire shapes (licensing spec §3.1, §3.3, §3.6). The server verifies and stores a license;
+ * the desktop parses a pasted one before sending it and reads the state back. Plain zod only (ADR-0009).
+ */
+import { z } from 'zod';
+export const LICENSE_FORMAT = 'wbl1';
+/** `wbl1.<base64url payload>.<base64url signature>`: the shape only; verification is the server's. */
+export const LICENSE_TEXT_PATTERN = /^wbl1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+/** Far above any real license line; bounds the body a server admin can send. */
+export const LICENSE_TEXT_MAX_LENGTH = 8192;
+/** Seats on a server with no license, or a lapsed one. A product term, not a setting. */
+export const COMMUNITY_SEATS = 5;
+/** Days after `expiresAt` that the license's edition still holds. A product term, not a setting. */
+export const GRACE_DAYS = 30;
+export const EDITIONS = ['community', 'team', 'enterprise'];
+export const editionSchema = z.enum(EDITIONS);
+/** Names a route or module checks. Later modules add `scim`, `policies`, `scheduled-runs`. */
+export const FEATURES = ['audit-log'];
+export const featureSchema = z.enum(FEATURES);
+export const LICENSE_STATUSES = ['none', 'active', 'grace', 'expired', 'invalid'];
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+/**
+ * The signed payload. Unknown keys are refused: the format version is what grows the payload.
+ * `features` stays a list of strings so that a feature a newer signer names does not make the whole
+ * license unreadable to an older server, which grants only the features it knows.
+ */
+export const licensePayloadSchema = z.strictObject({
+    id: z.string().regex(ULID),
+    customer: z.string().min(1).max(200),
+    edition: z.enum(['team', 'enterprise']),
+    seats: z.number().int().positive().nullable(),
+    issuedAt: z.iso.datetime(),
+    expiresAt: z.iso.datetime(),
+    features: z.array(z.string().min(1).max(64)).max(64).optional(),
+});
+/** `GET /license` and the answer to `PUT /license` (§3.3). Fields past `features` are absent with no license. */
+export const licenseStateSchema = z.object({
+    edition: editionSchema,
+    status: z.enum(LICENSE_STATUSES),
+    /** `limit: null` is unlimited. */
+    seats: z.object({ used: z.number().int().nonnegative(), limit: z.number().int().positive().nullable() }),
+    /** The granted set: empty on Community and Team unless the license lists features. Open strings: a newer server may grant a feature this build does not know. */
+    features: z.array(z.string()),
+    licenseId: z.string().optional(),
+    customer: z.string().optional(),
+    issuedAt: z.string().optional(),
+    expiresAt: z.string().optional(),
+    graceUntil: z.string().optional(),
+    /** Only with `status: 'invalid'`. Open for the same reason as `features`; the server produces a `LicenseInvalidReason`. */
+    reason: z.string().optional(),
+    message: z.string().optional(),
+});
+export const licenseInstallRequestSchema = z.object({ license: z.string().min(1).max(LICENSE_TEXT_MAX_LENGTH) });

package/dist/server-api/live.d.ts

@@ -0,0 +1,132 @@
+/**
+ * The live-updates protocol (live-updates spec §3.1, §4): one WebSocket at `GET /api/v1/live`, one
+ * UTF-8 JSON text message per frame. The server's socket loop parses client messages with
+ * {@link liveClientMessageSchema} and the desktop's `LiveClient` parses server messages with
+ * {@link liveServerMessageSchema}, so a drift between the two fails typecheck.
+ *
+ * Plain zod only (ADR-0009). Tokens are on `DEVICE_TOKEN_PATTERN`, workspace ids on `TEAMS_ID_PATTERN`,
+ * user ids on `identityIdSchema` and heads on `SYNC_COMMIT_ID_PATTERN`. No message carries a role, an
+ * email or file content (§6):
+ * HTTP stays the source of truth, and a message only ever says "ask again".
+ *
+ * The server union is closed on purpose. `LiveClient` skips a `type` it does not know before it parses
+ * (§3.1, *Unknown types*), so a newer server can add a message without breaking an older app. zod's
+ * default strip drops unknown fields from a known message for the same reason.
+ */
+import { z } from 'zod';
+/** §3.3's limits, shared so the desktop never sends what the server would refuse. */
+export declare const LIVE_LIMITS: {
+    /** A client message's largest size (`maxPayload`); a larger one closes `1009`. Server messages are not capped. */
+    readonly maxMessageBytes: 4096;
+    /** Across every socket of one device token; the next subscribe is `refused … live-too-many-subscriptions`. */
+    readonly maxSubscriptionsPerSession: 200;
+    /** Authenticated sockets per user; the next one closes `4429`. */
+    readonly maxSocketsPerUser: 32;
+    /** How long a socket may wait before its `auth` (then `4408`), and how long the desktop waits for `ready` or `pong`. */
+    readonly authTimeoutMs: 10000;
+    /** The server's protocol-ping interval, and the desktop's `ping` interval. */
+    readonly heartbeatMs: 30000;
+};
+/**
+ * The close codes of §3.1. `1000`–`1011` are the protocol's own. The `44xx` codes mirror the HTTP
+ * status each stands for. Only `4401` stops the desktop from reconnecting: it runs the token check
+ * instead.
+ */
+export declare const LIVE_CLOSE: {
+    /** The desktop closed it: no open workspace on that server, sign-out, or quit. */
+    readonly normal: 1000;
+    /** The server is shutting down; the desktop reconnects with back-off. */
+    readonly goingAway: 1001;
+    /** A client message over `LIVE_LIMITS.maxMessageBytes`. */
+    readonly tooBig: 1009;
+    /** An unexpected server error on this socket. */
+    readonly serverError: 1011;
+    /** A malformed or out-of-order message, or a binary frame. */
+    readonly badMessage: 4400;
+    /** A bad token, an ended session, or the token's maximum age reached. */
+    readonly unauthenticated: 4401;
+    /** No `auth` within `LIVE_LIMITS.authTimeoutMs`. */
+    readonly authTimeout: 4408;
+    /** The user already has `LIVE_LIMITS.maxSocketsPerUser` sockets; the desktop waits 60 s. */
+    readonly tooManySockets: 4429;
+};
+/** The `capabilities` entry of `GET /api/v1/meta` that says a server serves {@link LIVE_PATH}. */
+export declare const LIVE_CAPABILITY = "live";
+/** The socket's path on the server's origin. */
+export declare const LIVE_PATH = "/api/v1/live";
+/** Why a subscribe was refused. `teams-workspace-not-found` also means "no access", as HTTP does, so an id reveals nothing. */
+export declare const LIVE_REFUSED_CODES: readonly ["teams-workspace-not-found", "live-too-many-subscriptions"];
+export type LiveRefusedCode = (typeof LIVE_REFUSED_CODES)[number];
+/**
+ * One user with a subscribed socket on a workspace: an id and a display name, never an email (§6).
+ * - `id` is `identityIdSchema`: bounded in length and otherwise opaque, as HTTP treats user ids. Nothing
+ *   on the client uses it as a path or a storage key, and the e2e fake's ids are `u-<email>`.
+ * - `name` is the user's display name, which is never empty.
+ */
+export declare const livePresenceUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type LivePresenceUser = z.infer<typeof livePresenceUserSchema>;
+/** Client → server (§3.1). `auth` comes first, within `authTimeoutMs`, and the token travels nowhere else. */
+export declare const liveClientMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"auth">;
+    token: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"subscribe">;
+    workspaceId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"unsubscribe">;
+    workspaceId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"ping">;
+}, z.core.$strip>], "type">;
+export type LiveClientMessage = z.infer<typeof liveClientMessageSchema>;
+/**
+ * Server → client (§3.1, R6).
+ * - `ready` answers a valid `auth` and `pong` answers `ping`. Together they let the desktop tell
+ *   *connecting* from *connected*, and a dead server from a quiet one.
+ * - `presence` includes the recipient, whom the desktop removes.
+ * - `session-ended` is always followed by a `4401` close.
+ * - `capture` and `hooks` (webhook-capture spec §3.6) say "a catch URL of this workspace caught
+ *   something" and "the workspace's catch URLs changed". Like every message they carry ids only; the
+ *   desktop fetches. The hub sends at most one `capture` per catch URL every 250 ms, carrying the
+ *   newest id. An app older than them skips both types.
+ */
+export declare const liveServerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"ready">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"head">;
+    workspaceId: z.ZodString;
+    head: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"access">;
+    workspaceId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"presence">;
+    workspaceId: z.ZodString;
+    users: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"refused">;
+    workspaceId: z.ZodString;
+    code: z.ZodEnum<{
+        "teams-workspace-not-found": "teams-workspace-not-found";
+        "live-too-many-subscriptions": "live-too-many-subscriptions";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"session-ended">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"pong">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"capture">;
+    workspaceId: z.ZodString;
+    hookId: z.ZodString;
+    captureId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"hooks">;
+    workspaceId: z.ZodString;
+}, z.core.$strip>], "type">;
+export type LiveServerMessage = z.infer<typeof liveServerMessageSchema>;