jschoubben
c7fb8d6689
go/seats the seat list every reader compiles and every seat's name; a package per whole seat with its names, subjects, types and a test of its fixtures; ts/ the same as a TypeScript package. Written by seatgen, never by hand. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
346 lines
10 KiB
TypeScript
346 lines
10 KiB
TypeScript
// Code generated by seatgen from the seat definitions; DO NOT EDIT.
|
|
|
|
// The contract of the seat "mesh-vault", defined whole (seats/mesh-vault/seat.json): The mesh's secrets. accept and move-asks, which no holder served and nothing called, are left out (ADR 0620 §3). The vault's own events stay under its own subjects (ADR 0620 §2).
|
|
|
|
export const seat = "mesh-vault";
|
|
|
|
export const verbs = {
|
|
get: "get",
|
|
secretAsk: "secret-ask",
|
|
issued: "issued",
|
|
rotate: "rotate",
|
|
moveIn: "move-in",
|
|
nodeKey: "node-key",
|
|
own: "own",
|
|
issueAccount: "issue-account",
|
|
sign: "sign",
|
|
enrolmentToken: "enrolment-token",
|
|
nodeAccount: "node-account",
|
|
rotateNode: "rotate-node",
|
|
nodeAccountConfirm: "node-account-confirm",
|
|
abandon: "abandon",
|
|
retire: "retire",
|
|
} as const;
|
|
|
|
export const holderEvents = {
|
|
provisioned: "provisioned",
|
|
rotated: "rotated",
|
|
secretChanged: "secret-changed",
|
|
accountHashed: "account-hashed",
|
|
ownReplaced: "own-replaced",
|
|
accountIssued: "account-issued",
|
|
signed: "signed",
|
|
rotationBegun: "rotation-begun",
|
|
nodeAccountReady: "node-account-ready",
|
|
rotationDone: "rotation-done",
|
|
ownRetired: "own-retired",
|
|
} as const;
|
|
|
|
export function provisionedHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.provisioned";
|
|
}
|
|
|
|
export function rotatedHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.rotated";
|
|
}
|
|
|
|
export function secretChangedHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.secret-changed";
|
|
}
|
|
|
|
export function accountHashedHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.account-hashed";
|
|
}
|
|
|
|
export function ownReplacedHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.own-replaced";
|
|
}
|
|
|
|
export function accountIssuedHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.account-issued";
|
|
}
|
|
|
|
export function signedHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.signed";
|
|
}
|
|
|
|
export function rotationBegunHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.rotation-begun";
|
|
}
|
|
|
|
export function nodeAccountReadyHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.node-account-ready";
|
|
}
|
|
|
|
export function rotationDoneHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.rotation-done";
|
|
}
|
|
|
|
export function ownRetiredHolderSubject(holder: string): string {
|
|
return "mesh.mod." + holder + ".event.own-retired";
|
|
}
|
|
|
|
/** is what get takes. */
|
|
export interface GetInput {
|
|
/** the secret's name */
|
|
"name": string;
|
|
/** the asker's X25519 public key as SPKI PEM — never a private key */
|
|
"public_key": string;
|
|
}
|
|
|
|
/** is what get answers. */
|
|
export type GetAnswer = Record<string, unknown>;
|
|
|
|
/** is what secret-ask takes. */
|
|
export interface SecretAskInput {
|
|
/** who asked, as the bus named its caller */
|
|
"asked_by"?: string;
|
|
/** the second step: the call the first step answered */
|
|
"call"?: string;
|
|
/** the machine whose prompt asks */
|
|
"desk"?: string;
|
|
/** the module */
|
|
"module"?: string;
|
|
/** the secret's name in the module */
|
|
"name"?: string;
|
|
/** the machine the secret is for */
|
|
"node"?: string;
|
|
/** instead of sealed: how the prompt ended */
|
|
"outcome"?: string;
|
|
/** the second step: the value sealed to the call's key — never the value */
|
|
"sealed"?: string;
|
|
}
|
|
|
|
/** is what secret-ask answers. */
|
|
export type SecretAskAnswer = Record<string, unknown>;
|
|
|
|
export interface IssuedInputHoldersItem {
|
|
/** the consuming module */
|
|
"module"?: string;
|
|
/** the holder's machine */
|
|
"node"?: string;
|
|
}
|
|
|
|
/** is what issued takes. */
|
|
export interface IssuedInput {
|
|
/** the second step: the call the first step answered */
|
|
"call"?: string;
|
|
/** the provision's holders from that provider, each {node, module}: its tool may answer a value for each, kept as that holder's own and handed to it alone */
|
|
"holders"?: IssuedInputHoldersItem[];
|
|
/** the provider's module */
|
|
"module"?: string;
|
|
/** the provider's machine */
|
|
"provider"?: string;
|
|
/** the provision */
|
|
"provision"?: string;
|
|
/** the second step: the value sealed to the call's key — never the value */
|
|
"sealed"?: string;
|
|
}
|
|
|
|
/** is what issued answers. */
|
|
export type IssuedAnswer = Record<string, unknown>;
|
|
|
|
/** is what rotate takes. */
|
|
export interface RotateInput {
|
|
/** who asked, when the controller carries the act */
|
|
"by"?: string;
|
|
/** the module */
|
|
"module"?: string;
|
|
/** the secret's name in the module */
|
|
"name"?: string;
|
|
/** the machine, for a module's own secret */
|
|
"node"?: string;
|
|
/** the provider's machine */
|
|
"provider"?: string;
|
|
/** the provision */
|
|
"provision"?: string;
|
|
}
|
|
|
|
/** is what rotate answers. */
|
|
export type RotateAnswer = Record<string, unknown>;
|
|
|
|
/** is what move-in takes. */
|
|
export interface MoveInInput {
|
|
/** the second step: the call the first step answered */
|
|
"call"?: string;
|
|
/** the consumer's machine */
|
|
"consumer"?: string;
|
|
/** the consuming module */
|
|
"consumer_module"?: string;
|
|
/** the controller's generation for the value */
|
|
"generation"?: string;
|
|
/** the credential's local name, when it has one */
|
|
"local"?: string;
|
|
/** when it was made (RFC 3339) */
|
|
"made_at"?: string;
|
|
/** its module */
|
|
"module"?: string;
|
|
/** its name in the module */
|
|
"name"?: string;
|
|
/** a module's own secret: its machine */
|
|
"node"?: string;
|
|
/** made, accepted or issued, as the controller's store says */
|
|
"origin"?: string;
|
|
/** a pair credential: the provider's machine */
|
|
"provider"?: string;
|
|
/** the provision */
|
|
"provision"?: string;
|
|
/** the second step: a raw X25519 public key the read-back is sealed to */
|
|
"read_back_to"?: string;
|
|
/** the second step: the value sealed to the call's key — never the value */
|
|
"sealed"?: string;
|
|
}
|
|
|
|
/** is what move-in answers. */
|
|
export type MoveInAnswer = Record<string, unknown>;
|
|
|
|
/** is what node-key takes. */
|
|
export interface NodeKeyInput {
|
|
/** the machine's sealing key, a raw X25519 public key in base64 */
|
|
"key"?: string;
|
|
}
|
|
|
|
/** is what node-key answers. */
|
|
export type NodeKeyAnswer = Record<string, unknown>;
|
|
|
|
/** is what own takes. */
|
|
export interface OwnInput {
|
|
/** the pair credentials the machine's composition reads, each {role: consumer|provider, provision, consumer, consumer_module, provider, local} */
|
|
"credentials"?: Record<string, unknown>[];
|
|
}
|
|
|
|
/** is what own answers. */
|
|
export type OwnAnswer = Record<string, unknown>;
|
|
|
|
/** is what issue-account takes. */
|
|
export interface IssueAccountInput {
|
|
/** the bus user, e.g. ace.mesh-build-go */
|
|
"user": string;
|
|
}
|
|
|
|
/** is what issue-account answers. */
|
|
export type IssueAccountAnswer = Record<string, unknown>;
|
|
|
|
/** is what sign takes. */
|
|
export interface SignInput {
|
|
/** node-certificate or enrolment */
|
|
"kind": string;
|
|
/** the machine, for a node certificate: the caller's own, or the node mesh-enrolment enrols */
|
|
"node"?: string;
|
|
/** the redeem answer's bytes in base64, for an enrolment */
|
|
"reply"?: string;
|
|
/** from mesh-enrolment: the serving key's public half the enrolling node presented */
|
|
"serving_key"?: string;
|
|
}
|
|
|
|
/** is what sign answers. */
|
|
export type SignAnswer = Record<string, unknown>;
|
|
|
|
/** the node's first tunnel, built by mesh-enrolment at issue and carried in the token: the hub's public key, the hub's endpoint, the node's tunnel address, its own tunnel key and the network's range */
|
|
export interface EnrolmentTokenInputTunnel {
|
|
/** the joining node's tunnel address */
|
|
"address": string;
|
|
/** the hub's endpoint, host:port */
|
|
"hub_endpoint": string;
|
|
/** the hub's tunnel public key */
|
|
"hub_key": string;
|
|
/** the joining machine's own tunnel public key, as given at issue */
|
|
"key": string;
|
|
/** the private network's range, a prefix */
|
|
"range": string;
|
|
}
|
|
|
|
/** is what enrolment-token takes. */
|
|
export interface EnrolmentTokenInput {
|
|
/** "true": drop the node's token and its hash */
|
|
"drop"?: "true" | "false";
|
|
/** when the token expires (RFC 3339), as the enrolment's key says */
|
|
"expires"?: string;
|
|
/** the node the token is for */
|
|
"node": string;
|
|
/** "true": answer the token sealed to the operator key */
|
|
"sealed"?: "true" | "false";
|
|
/** the node's first tunnel, built by mesh-enrolment at issue and carried in the token: the hub's public key, the hub's endpoint, the node's tunnel address, its own tunnel key and the network's range */
|
|
"tunnel"?: EnrolmentTokenInputTunnel;
|
|
}
|
|
|
|
/** is what enrolment-token answers. */
|
|
export type EnrolmentTokenAnswer = Record<string, unknown>;
|
|
|
|
/** is what node-account takes. */
|
|
export interface NodeAccountInput {
|
|
/** the digest of every public key the node presented (delivery.KeysDigest) */
|
|
"keys_digest"?: string;
|
|
/** the joining node */
|
|
"node": string;
|
|
/** "true": retire the account minted for this node */
|
|
"retire"?: "true" | "false";
|
|
/** the sealing key's public half the node presented, which the account is sealed to */
|
|
"sealing_key"?: string;
|
|
}
|
|
|
|
/** is what node-account answers. */
|
|
export type NodeAccountAnswer = Record<string, unknown>;
|
|
|
|
/** is what rotate-node takes. */
|
|
export interface RotateNodeInput {
|
|
/** the id of the hand act recorded for it in mesh-hand-acts */
|
|
"act": string;
|
|
/** the node whose account rotates */
|
|
"node": string;
|
|
/** why, in a sentence */
|
|
"why": string;
|
|
}
|
|
|
|
/** is what rotate-node answers. */
|
|
export type RotateNodeAnswer = Record<string, unknown>;
|
|
|
|
/** is what node-account-confirm takes. */
|
|
export interface NodeAccountConfirmInput {
|
|
}
|
|
|
|
/** is what node-account-confirm answers. */
|
|
export type NodeAccountConfirmAnswer = Record<string, unknown>;
|
|
|
|
/** is what abandon takes. */
|
|
export interface AbandonInput {
|
|
/** the node whose rotation is abandoned */
|
|
"node": string;
|
|
}
|
|
|
|
/** is what abandon answers. */
|
|
export type AbandonAnswer = Record<string, unknown>;
|
|
|
|
/** is what retire takes. */
|
|
export interface RetireInput {
|
|
/** the module */
|
|
"module": string;
|
|
/** the own secret's name */
|
|
"name": string;
|
|
/** the node */
|
|
"node": string;
|
|
/** the operator's warrant for this node, module and name */
|
|
"warrant": string;
|
|
}
|
|
|
|
/** is what retire answers. */
|
|
export interface RetireAnswer {
|
|
/** the secret is gone */
|
|
"retired": boolean;
|
|
}
|
|
|
|
/** is the body of the holder's event own-retired. */
|
|
export interface OwnRetiredHolderEvent {
|
|
/** the ask's id */
|
|
"ask"?: string;
|
|
/** the caller the vault proved */
|
|
"caller": string;
|
|
/** the module */
|
|
"module": string;
|
|
/** the secret's name */
|
|
"name": string;
|
|
/** the node */
|
|
"node": string;
|
|
}
|
|
|