// Code generated by seatgen from the seat definitions; DO NOT EDIT.

// The contract of the seat "mesh-vault", defined whole (seats/mesh-vault/seat.json): The mesh's secrets. accept and move-asks, which no holder served and nothing called, are left out (ADR 0620 §3). The vault's own events stay under its own subjects (ADR 0620 §2).

export const seat = "mesh-vault";

export const verbs = {
  get: "get",
  secretAsk: "secret-ask",
  issued: "issued",
  rotate: "rotate",
  moveIn: "move-in",
  nodeKey: "node-key",
  own: "own",
  issueAccount: "issue-account",
  sign: "sign",
  enrolmentToken: "enrolment-token",
  nodeAccount: "node-account",
  rotateNode: "rotate-node",
  nodeAccountConfirm: "node-account-confirm",
  abandon: "abandon",
  retire: "retire",
} as const;

export const holderEvents = {
  provisioned: "provisioned",
  rotated: "rotated",
  secretChanged: "secret-changed",
  accountHashed: "account-hashed",
  ownReplaced: "own-replaced",
  accountIssued: "account-issued",
  signed: "signed",
  rotationBegun: "rotation-begun",
  nodeAccountReady: "node-account-ready",
  rotationDone: "rotation-done",
  ownRetired: "own-retired",
} as const;

export function provisionedHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.provisioned";
}

export function rotatedHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.rotated";
}

export function secretChangedHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.secret-changed";
}

export function accountHashedHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.account-hashed";
}

export function ownReplacedHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.own-replaced";
}

export function accountIssuedHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.account-issued";
}

export function signedHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.signed";
}

export function rotationBegunHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.rotation-begun";
}

export function nodeAccountReadyHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.node-account-ready";
}

export function rotationDoneHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.rotation-done";
}

export function ownRetiredHolderSubject(holder: string): string {
  return "mesh.mod." + holder + ".event.own-retired";
}

/** is what get takes. */
export interface GetInput {
  /** the secret's name */
  "name": string;
  /** the asker's X25519 public key as SPKI PEM — never a private key */
  "public_key": string;
}

/** is what get answers. */
export type GetAnswer = Record<string, unknown>;

/** is what secret-ask takes. */
export interface SecretAskInput {
  /** who asked, as the bus named its caller */
  "asked_by"?: string;
  /** the second step: the call the first step answered */
  "call"?: string;
  /** the machine whose prompt asks */
  "desk"?: string;
  /** the module */
  "module"?: string;
  /** the secret's name in the module */
  "name"?: string;
  /** the machine the secret is for */
  "node"?: string;
  /** instead of sealed: how the prompt ended */
  "outcome"?: string;
  /** the second step: the value sealed to the call's key — never the value */
  "sealed"?: string;
}

/** is what secret-ask answers. */
export type SecretAskAnswer = Record<string, unknown>;

export interface IssuedInputHoldersItem {
  /** the consuming module */
  "module"?: string;
  /** the holder's machine */
  "node"?: string;
}

/** is what issued takes. */
export interface IssuedInput {
  /** the second step: the call the first step answered */
  "call"?: string;
  /** the provision's holders from that provider, each {node, module}: its tool may answer a value for each, kept as that holder's own and handed to it alone */
  "holders"?: IssuedInputHoldersItem[];
  /** the provider's module */
  "module"?: string;
  /** the provider's machine */
  "provider"?: string;
  /** the provision */
  "provision"?: string;
  /** the second step: the value sealed to the call's key — never the value */
  "sealed"?: string;
}

/** is what issued answers. */
export type IssuedAnswer = Record<string, unknown>;

/** is what rotate takes. */
export interface RotateInput {
  /** who asked, when the controller carries the act */
  "by"?: string;
  /** the module */
  "module"?: string;
  /** the secret's name in the module */
  "name"?: string;
  /** the machine, for a module's own secret */
  "node"?: string;
  /** the provider's machine */
  "provider"?: string;
  /** the provision */
  "provision"?: string;
}

/** is what rotate answers. */
export type RotateAnswer = Record<string, unknown>;

/** is what move-in takes. */
export interface MoveInInput {
  /** the second step: the call the first step answered */
  "call"?: string;
  /** the consumer's machine */
  "consumer"?: string;
  /** the consuming module */
  "consumer_module"?: string;
  /** the controller's generation for the value */
  "generation"?: string;
  /** the credential's local name, when it has one */
  "local"?: string;
  /** when it was made (RFC 3339) */
  "made_at"?: string;
  /** its module */
  "module"?: string;
  /** its name in the module */
  "name"?: string;
  /** a module's own secret: its machine */
  "node"?: string;
  /** made, accepted or issued, as the controller's store says */
  "origin"?: string;
  /** a pair credential: the provider's machine */
  "provider"?: string;
  /** the provision */
  "provision"?: string;
  /** the second step: a raw X25519 public key the read-back is sealed to */
  "read_back_to"?: string;
  /** the second step: the value sealed to the call's key — never the value */
  "sealed"?: string;
}

/** is what move-in answers. */
export type MoveInAnswer = Record<string, unknown>;

/** is what node-key takes. */
export interface NodeKeyInput {
  /** the machine's sealing key, a raw X25519 public key in base64 */
  "key"?: string;
}

/** is what node-key answers. */
export type NodeKeyAnswer = Record<string, unknown>;

/** is what own takes. */
export interface OwnInput {
  /** the pair credentials the machine's composition reads, each {role: consumer|provider, provision, consumer, consumer_module, provider, local} */
  "credentials"?: Record<string, unknown>[];
}

/** is what own answers. */
export type OwnAnswer = Record<string, unknown>;

/** is what issue-account takes. */
export interface IssueAccountInput {
  /** the bus user, e.g. ace.mesh-build-go */
  "user": string;
}

/** is what issue-account answers. */
export type IssueAccountAnswer = Record<string, unknown>;

/** is what sign takes. */
export interface SignInput {
  /** node-certificate or enrolment */
  "kind": string;
  /** the machine, for a node certificate: the caller's own, or the node mesh-enrolment enrols */
  "node"?: string;
  /** the redeem answer's bytes in base64, for an enrolment */
  "reply"?: string;
  /** from mesh-enrolment: the serving key's public half the enrolling node presented */
  "serving_key"?: string;
}

/** is what sign answers. */
export type SignAnswer = Record<string, unknown>;

/** the node's first tunnel, built by mesh-enrolment at issue and carried in the token: the hub's public key, the hub's endpoint, the node's tunnel address, its own tunnel key and the network's range */
export interface EnrolmentTokenInputTunnel {
  /** the joining node's tunnel address */
  "address": string;
  /** the hub's endpoint, host:port */
  "hub_endpoint": string;
  /** the hub's tunnel public key */
  "hub_key": string;
  /** the joining machine's own tunnel public key, as given at issue */
  "key": string;
  /** the private network's range, a prefix */
  "range": string;
}

/** is what enrolment-token takes. */
export interface EnrolmentTokenInput {
  /** "true": drop the node's token and its hash */
  "drop"?: "true" | "false";
  /** when the token expires (RFC 3339), as the enrolment's key says */
  "expires"?: string;
  /** the node the token is for */
  "node": string;
  /** "true": answer the token sealed to the operator key */
  "sealed"?: "true" | "false";
  /** the node's first tunnel, built by mesh-enrolment at issue and carried in the token: the hub's public key, the hub's endpoint, the node's tunnel address, its own tunnel key and the network's range */
  "tunnel"?: EnrolmentTokenInputTunnel;
}

/** is what enrolment-token answers. */
export type EnrolmentTokenAnswer = Record<string, unknown>;

/** is what node-account takes. */
export interface NodeAccountInput {
  /** the digest of every public key the node presented (delivery.KeysDigest) */
  "keys_digest"?: string;
  /** the joining node */
  "node": string;
  /** "true": retire the account minted for this node */
  "retire"?: "true" | "false";
  /** the sealing key's public half the node presented, which the account is sealed to */
  "sealing_key"?: string;
}

/** is what node-account answers. */
export type NodeAccountAnswer = Record<string, unknown>;

/** is what rotate-node takes. */
export interface RotateNodeInput {
  /** the id of the hand act recorded for it in mesh-hand-acts */
  "act": string;
  /** the node whose account rotates */
  "node": string;
  /** why, in a sentence */
  "why": string;
}

/** is what rotate-node answers. */
export type RotateNodeAnswer = Record<string, unknown>;

/** is what node-account-confirm takes. */
export interface NodeAccountConfirmInput {
}

/** is what node-account-confirm answers. */
export type NodeAccountConfirmAnswer = Record<string, unknown>;

/** is what abandon takes. */
export interface AbandonInput {
  /** the node whose rotation is abandoned */
  "node": string;
}

/** is what abandon answers. */
export type AbandonAnswer = Record<string, unknown>;

/** is what retire takes. */
export interface RetireInput {
  /** the module */
  "module": string;
  /** the own secret's name */
  "name": string;
  /** the node */
  "node": string;
  /** the operator's warrant for this node, module and name */
  "warrant": string;
}

/** is what retire answers. */
export interface RetireAnswer {
  /** the secret is gone */
  "retired": boolean;
}

/** is the body of the holder's event own-retired. */
export interface OwnRetiredHolderEvent {
  /** the ask's id */
  "ask"?: string;
  /** the caller the vault proved */
  "caller": string;
  /** the module */
  "module": string;
  /** the secret's name */
  "name": string;
  /** the node */
  "node": string;
}