protocol

type ApproveNamespaceJoinRequestRequest struct {
	InviteServerSecret string `json:"inviteServerSecret"`
	WrappedDEK         string `json:"wrappedDek"`
}

type ApproveNamespaceJoinRequestResponse struct {
	NamespaceID     string `json:"namespaceId"`
	MemberKind      string `json:"memberKind"`
	MemberKeyID     string `json:"memberKeyId"`
	JoinRequestHash string `json:"joinRequestHash"`
}

type ChallengeRequest struct {
	// Purpose selects the auth flow the challenge is for, such as login or
	// refresh.
	Purpose string `json:"purpose"`
	// Kind identifies the auth-key kind requesting the challenge.
	Kind string `json:"kind"`
	// Action optionally binds a sensitive-action challenge to one action name.
	Action string `json:"action,omitempty"`
	// ActionFieldsHash is the optional lowercase-hex SHA-256 hash of the
	// canonical sensitive-action fields.
	ActionFieldsHash string `json:"actionFieldsHash,omitempty"`
}

type ChallengeResponse struct {
	// Challenge is the base64-encoded random challenge payload to sign.
	Challenge string `json:"challenge"`
	// ExpiresAt is when the challenge becomes invalid server-side.
	ExpiresAt time.Time `json:"expiresAt"`
	// SpamControl tells the client what additional proof to attach.
	SpamControl SpamControl `json:"spamControl"`
}

type CreateNamespaceInviteRequest struct {
	Kind                   string `json:"kind"`
	KeyID                  string `json:"keyId"`
	InviteID               string `json:"inviteId"`
	InviteServerSecretHash string `json:"inviteServerSecretHash"`
	Challenge              string `json:"challenge"`
	IntentSignature        string `json:"intentSignature"`
	ExpiresAt              int64  `json:"expiresAt"`
	MaxAccepted            int    `json:"maxAccepted"`
}

type CreateNamespaceInviteResponse struct {
	NamespaceID string `json:"namespaceId"`
	InviteID    string `json:"inviteId"`
	ExpiresAt   int64  `json:"expiresAt"`
	MaxAccepted int    `json:"maxAccepted"`
}

type CreateSharedNamespaceRequest struct {
	// NamespaceID is the caller-chosen hex-encoded namespace identifier.
	NamespaceID string `json:"namespaceId"`
	// WrappedDEK is the base64-encoded namespace DEK wrapped for the caller.
	WrappedDEK string `json:"wrappedDek"`
}

type CreateSharedNamespaceResponse struct {
	// NamespaceID is the hex-encoded identifier of the created namespace.
	NamespaceID string `json:"namespaceId"`
	// Kind is the namespace kind and is expected to be "shared".
	Kind string `json:"kind"`
	// Created reports whether the namespace was created by this call.
	Created bool `json:"created"`
}

type DefaultNamespaceResponse struct {
	// NamespaceID is the hex-encoded identifier of the default namespace.
	NamespaceID string `json:"namespaceId"`
	// Kind is the namespace kind and is expected to be "default".
	Kind string `json:"kind"`
}

type EnsureDefaultNamespaceRequest struct {
	// ProposedNamespaceID is the caller-chosen namespace ID to create if the
	// default namespace does not already exist.
	ProposedNamespaceID string `json:"proposedNamespaceId"`
	// WrappedDEK is the base64-encoded namespace DEK wrapped for the caller.
	WrappedDEK string `json:"wrappedDek"`
}

type EnsureDefaultNamespaceResponse struct {
	// NamespaceID is the hex-encoded identifier of the default namespace.
	NamespaceID string `json:"namespaceId"`
	// Kind is the namespace kind and is expected to be "default".
	Kind string `json:"kind"`
	// WrappedDEK is the base64-encoded namespace DEK wrapped for the caller.
	WrappedDEK string `json:"wrappedDek"`
	// Created reports whether the namespace was created by this call.
	Created bool `json:"created"`
}

type GetItemResponse struct {
	// NamespaceID is the hex-encoded namespace identifier.
	NamespaceID string `json:"namespaceId"`
	// ItemID is the hex-encoded item identifier.
	ItemID string `json:"itemId"`
	// Version is the current stored version of the item.
	Version uint64 `json:"version"`
	// Nonce is the base64-encoded AEAD nonce used for Ciphertext.
	Nonce string `json:"nonce"`
	// AAD is the base64-encoded associated data bound to NamespaceID, ItemID, and
	// Version.
	AAD string `json:"aad"`
	// Ciphertext is the base64-encoded encrypted item payload.
	Ciphertext string `json:"ciphertext"`
}

type GetNamespaceItemsResponse struct {
	// NamespaceID is the hex-encoded namespace identifier.
	NamespaceID string `json:"namespaceId"`
	// NamespaceHead is the current namespace change counter.
	NamespaceHead uint64 `json:"namespaceHead"`
	// Items maps each hex-encoded item ID to its current version metadata.
	Items map[string]NamespaceItemVersion `json:"items"`
}

type GetNamespaceMembersResponse struct {
	// NamespaceID is the hex-encoded namespace identifier.
	NamespaceID string `json:"namespaceId"`
	// Members lists all current namespace members.
	Members []NamespaceMember `json:"members"`
}

type GetWrappedDEKResponse struct {
	// NamespaceID is the hex-encoded namespace identifier.
	NamespaceID string `json:"namespaceId"`
	// KeyID is the hex-encoded member key identifier.
	KeyID string `json:"keyId"`
	// WrappedDEK is the base64-encoded namespace DEK wrapped for KeyID.
	WrappedDEK string `json:"wrappedDek"`
}

type HealthResponse struct {
	// Status is the process health string. The server returns "ok" when ready.
	Status string `json:"status"`
}

type ListNamespaceInvitesResponse struct {
	NamespaceID string                   `json:"namespaceId"`
	Invites     []NamespaceInviteSummary `json:"invites"`
}

type ListNamespaceJoinRequestsResponse struct {
	NamespaceID string                      `json:"namespaceId"`
	Requests    []NamespaceJoinRequestEntry `json:"requests"`
}

type ListNamespacesResponse struct {
	// Namespaces contains one summary per namespace visible to the caller.
	Namespaces []NamespaceSummary `json:"namespaces"`
}

type LoginRequest struct {
	// Kind identifies the auth-key kind being used to log in.
	Kind string `json:"kind"`
	// KeyID is the hex-encoded key identifier derived from AuthPublicKey.
	KeyID string `json:"keyId"`
	// AuthPublicKey is the hex-encoded Ed25519 public key for auth intents.
	AuthPublicKey string `json:"authPublicKey"`
	// WrapPublicKey is the hex-encoded X25519 public key for namespace DEK
	// wrapping.
	WrapPublicKey string `json:"wrapPublicKey"`
	// Challenge is the base64-encoded challenge received from Challenge.
	Challenge string `json:"challenge"`
	// IntentSignature is the hex-encoded signature over the canonical login
	// intent.
	IntentSignature string `json:"intentSignature"`
	// Attestation is an optional base64-encoded anti-abuse proof required when
	// spam control is set to attestation.
	Attestation string `json:"attestation,omitempty"`
}

type LoginResponse struct {
	// Kind echoes the authenticated auth-key kind.
	Kind string `json:"kind"`
	// AccessToken is the opaque bearer token to use for authenticated API calls.
	AccessToken string `json:"accessToken"`
	// ExpiresAt is when AccessToken expires server-side.
	ExpiresAt time.Time `json:"expiresAt"`
	// DefaultNamespaceID, when non-nil, names the caller's default namespace.
	DefaultNamespaceID *string `json:"defaultNamespaceId"`
}

type NamespaceInviteSummary struct {
	InviteID           string     `json:"inviteId"`
	CreatedByKeyID     string     `json:"createdByKeyId"`
	CreatedAt          time.Time  `json:"createdAt"`
	ExpiresAt          int64      `json:"expiresAt"`
	MaxAccepted        int        `json:"maxAccepted"`
	ActiveRequestCount int        `json:"activeRequestCount"`
	AcceptedCount      int        `json:"acceptedCount"`
	RevokedAt          *time.Time `json:"revokedAt"`
}

type NamespaceInviteToken struct {
	Version      int
	ServerOrigin string
	NamespaceID  string
	InviteID     string
	ExpiresAt    int64
	InviteSecret string
}

type NamespaceItemVersion struct {
	// Version is the current monotonically increasing version of the item.
	Version uint64 `json:"version"`
}

type NamespaceJoinRequest struct {
	Version       int    `json:"version"`
	NamespaceID   string `json:"namespaceId"`
	InviteID      string `json:"inviteId"`
	ServerOrigin  string `json:"serverOrigin"`
	Kind          string `json:"kind"`
	KeyID         string `json:"keyId"`
	AuthPublicKey string `json:"authPublicKey"`
	WrapPublicKey string `json:"wrapPublicKey"`
	ExpiresAt     int64  `json:"expiresAt"`
	Signature     string `json:"signature"`
	InviteProof   string `json:"inviteProof"`
}

type NamespaceJoinRequestEntry struct {
	InviteID        string               `json:"inviteId"`
	JoinRequestHash string               `json:"joinRequestHash"`
	CreatedAt       time.Time            `json:"createdAt"`
	Status          string               `json:"status"`
	JoinRequest     NamespaceJoinRequest `json:"joinRequest"`
}

type NamespaceMember struct {
	// Kind is the member's auth-key kind.
	Kind string `json:"kind"`
	// KeyID is the member's hex-encoded key identifier.
	KeyID string `json:"keyId"`
}

type NamespaceSummary struct {
	// NamespaceID is the hex-encoded namespace identifier.
	NamespaceID string `json:"namespaceId"`
	// Kind is the namespace kind, such as "default" or "shared".
	Kind string `json:"kind"`
	// NamespaceHead is the current namespace change counter.
	NamespaceHead uint64 `json:"namespaceHead"`
}

type PutItemRequest struct {
	// Nonce is the base64-encoded AEAD nonce used for Ciphertext.
	Nonce string `json:"nonce"`
	// AAD is the base64-encoded associated data bound to the target version.
	AAD string `json:"aad"`
	// Ciphertext is the base64-encoded encrypted item payload.
	Ciphertext string `json:"ciphertext"`
}

type PutItemResponse struct {
	// NamespaceID is the hex-encoded namespace identifier.
	NamespaceID string `json:"namespaceId"`
	// ItemID is the hex-encoded item identifier.
	ItemID string `json:"itemId"`
	// Version is the version stored by the server after the write.
	Version uint64 `json:"version"`
}

type RefreshRequest struct {
	// Kind identifies the auth-key kind being refreshed.
	Kind string `json:"kind"`
	// KeyID is the hex-encoded key identifier derived from the auth public key.
	KeyID string `json:"keyId"`
	// Challenge is the base64-encoded challenge received from Challenge.
	Challenge string `json:"challenge"`
	// IntentSignature is the hex-encoded signature over the canonical refresh
	// intent.
	IntentSignature string `json:"intentSignature"`
	// Attestation is an optional base64-encoded anti-abuse proof required when
	// spam control is set to attestation.
	Attestation string `json:"attestation,omitempty"`
}

type RefreshResponse struct {
	// Kind echoes the authenticated auth-key kind.
	Kind string `json:"kind"`
	// AccessToken is the new opaque bearer token.
	AccessToken string `json:"accessToken"`
	// ExpiresAt is when AccessToken expires server-side.
	ExpiresAt time.Time `json:"expiresAt"`
}

type RejectNamespaceJoinRequestResponse struct {
	NamespaceID     string `json:"namespaceId"`
	RequesterKeyID  string `json:"requesterKeyId"`
	JoinRequestHash string `json:"joinRequestHash"`
	Rejected        bool   `json:"rejected"`
}

type RevokeAllTokensRequest struct {
	// Kind identifies the auth-key kind authorizing token revocation.
	Kind string `json:"kind"`
	// KeyID is the hex-encoded key identifier of the authenticated identity.
	KeyID string `json:"keyId"`
	// Challenge is the base64-encoded sensitive-action challenge.
	Challenge string `json:"challenge"`
	// IntentSignature is the hex-encoded signature over the canonical sensitive
	// action intent for revoke-all-tokens.
	IntentSignature string `json:"intentSignature"`
}

type RevokeNamespaceInviteResponse struct {
	NamespaceID string `json:"namespaceId"`
	InviteID    string `json:"inviteId"`
	Revoked     bool   `json:"revoked"`
}

type SpamControl struct {
	// Kind names the anti-abuse mode, such as "none" or "attestation".
	Kind string `json:"kind"`
}

type SubmitNamespaceJoinRequestRequest struct {
	InviteServerSecret string               `json:"inviteServerSecret"`
	JoinRequest        NamespaceJoinRequest `json:"joinRequest"`
}

type SubmitNamespaceJoinRequestResponse struct {
	NamespaceID     string `json:"namespaceId"`
	InviteID        string `json:"inviteId"`
	RequesterKind   string `json:"requesterKind"`
	RequesterKeyID  string `json:"requesterKeyId"`
	JoinRequestHash string `json:"joinRequestHash"`
	Status          string `json:"status"`
}

type VersionResponse struct {
	// GitCommit is the git commit hash the server binary was built from.
	GitCommit string `json:"gitCommit"`
}

type WatchNamespacesRequest struct {
	// KnownHeads maps namespace IDs to the latest namespaceHead value the
	// client has already reconciled. Visible namespaces missing from this map are
	// treated as changed and are returned immediately.
	KnownHeads map[string]uint64 `json:"knownHeads"`
}

type WatchNamespacesResponse struct {
	// Namespaces contains visible namespaces whose namespaceHead differs from
	// the request's knownHeads map, including newly visible namespaces.
	Namespaces []NamespaceSummary `json:"namespaces"`
	// TimedOut reports that the long poll reached the server-side timeout
	// without observing a relevant change.
	TimedOut bool `json:"timedOut"`
}