ticket

Nov 13, 2026

Changes in this version

+ const MaxInputValue

+ const MaxInputs

+ var ErrInputs = errors.New("ticket: typed inputs do not answer the ticket")

+ func InputsAAD(t *Ticket) []byte

+ func SortInputs(names []string) []string

type Context

+ const ContextInputs

type Decision

+ func (d *Decision) OpenInputs(t *Ticket, priv *ecdh.PrivateKey) (map[string][]byte, error)

type Sealed

+ func SealInputs(t *Ticket, values map[string][]byte) (*Sealed, error)

type Subject

+ Inputs []string

type Ticket

+ func (t *Ticket) AsksInputs() bool

Nov 8, 2026

Changes in this version

+ const WithdrawnReason

type Decision

+ func (d *Decision) Withdrawal() bool

Nov 6, 2026

Changes in this version

+ const CredentialAsk

+ const CredentialKeychain

+ const CredentialNone

+ const CredentialVault

+ const RuleAuto

+ const RuleHuman

+ const VersionKinds

+ var ErrAuto = errors.New("ticket: auto decision on a never-auto ticket")

+ var ErrNoSecret = errors.New("ticket: no secret for the lock")

+ var Kinds = []Kind

+ func ConnectPlanHash(subj Subject) (string, error)

+ func EncodeX25519(pub *ecdh.PublicKey) string

+ func SecretAAD(t *Ticket) []byte

type Context

+ const ContextSecret

type Decision

+ Rule *Rule

+ Secret *Sealed

+ func (d *Decision) Auto() bool

+ func (d *Decision) OpenSecret(t *Ticket, priv *ecdh.PrivateKey) ([]byte, error)

+ type Kind string

+ const KindAction

+ const KindConnect

+ const KindDDL

+ const KindEndpoint

+ const KindPolicy

+ const KindRead

+ const KindWrite

+ func ParseKind(s string) (Kind, error)

+ func (k *Kind) UnmarshalJSON(b []byte) error

+ func (k Kind) Valid() bool

type Risk

+ func KindRisks(k Kind) []Risk

+ type Rule struct

+ By string

+ ID string

type Sealed

+ func SealSecret(t *Ticket, secret []byte) (*Sealed, error)

+ type Subject struct

+ Credential string

+ Endpoint string

+ Profile string

+ SecretTo string

+ Target string

+ Verb string

+ func (s *Subject) Validate(k Kind) error

type Ticket

+ Kind Kind

+ Subject *Subject

+ func NewConnectTicket(src Source, risk Risk, subj Subject, policyFP string, now time.Time, ...) (*Ticket, error)

+ func NewKindTicket(src Source, k Kind, risk Risk, subj *Subject, planHash, policyFP string, ...) *Ticket

+ func (t *Ticket) EffectiveKind() Kind

Nov 2, 2026

Changes in this version

type Risk

+ const RiskGrant

Oct 31, 2026

Changes in this version

+ func RiskNames() string

Oct 30, 2026

Changes in this version

+ const ChangeUnchecked

+ const UncheckedInput

Oct 30, 2026

Changes in this version

+ const ChangeChanged

+ const ChangeGone

+ const ChangeNew

+ const FacadeDeck

+ const FacadeTTY

+ const MaxChanges

+ const MaxFacades

+ const RenewApprovalExpired

+ const RenewExpired

+ const RevealTTL

+ var ErrFacade = errors.New("ticket: facade key refused")

+ func CanReveal(facade string) bool

+ func InputDigests(v any) (map[string]string, error)

+ func RevealAAD(r *RevealKey) []byte

+ type Change struct

+ Change string

+ Input string

+ func DiffInputs(before, after map[string]string) []Change

type Context

+ const ContextHubRequest

+ const ContextRevealAnswer

+ const ContextRevealBox

+ const ContextRevealKey

+ type FacadeKey struct

+ Facade string

+ Key string

+ type FacadeSet struct

+ Facades []FacadeKey

+ V int

+ type HubRequest struct

+ Approver Approver

+ At time.Time

+ Facade string

+ HubKeyID string

+ ID string

+ Instance string

+ KeyID string

+ Kind RequestKind

+ Reveal *RevealKey

+ Sig string

+ Ticket string

+ V int

+ func VerifyHubRequest(pub ed25519.PublicKey, data []byte) (*HubRequest, error)

+ func (q *HubRequest) Fresh(now time.Time) bool

+ func (q *HubRequest) Marshal() ([]byte, error)

+ func (q *HubRequest) Sign(key ed25519.PrivateKey) error

+ func (q *HubRequest) Validate() error

+ type PinnedFacade struct

+ Facade string

+ Key ed25519.PublicKey

+ func ParseFacades(data []byte) ([]PinnedFacade, error)

+ type Renewal struct

+ ApprovedAt *time.Time

+ Changes []Change

+ Checked bool

+ Of string

+ Reason string

+ func (r *Renewal) Unchanged() bool

+ type RequestKind string

+ const RequestRenew

+ const RequestReveal

+ type RevealAnswer struct

+ Box *Sealed

+ Instance string

+ KeyID string

+ Request string

+ Reveal string

+ Sig string

+ Ticket string

+ V int

+ func SealReveal(key ed25519.PrivateKey, q *HubRequest, epk *ecdh.PublicKey, clear Screen) (*RevealAnswer, error)

+ func (a *RevealAnswer) Marshal() ([]byte, error)

+ type RevealKey struct

+ At time.Time

+ EPK string

+ Facade string

+ FacadeKeyID string

+ ID string

+ Instance string

+ KeyID string

+ Sig string

+ Ticket string

+ V int

+ func NewRevealKey(key ed25519.PrivateKey, facade string, t *Ticket, now time.Time) (*RevealKey, *ecdh.PrivateKey, error)

+ func (r *RevealKey) Verify(pinned []PinnedFacade) (*ecdh.PublicKey, error)

type Screen

+ func OpenReveal(lockPub ed25519.PublicKey, priv *ecdh.PrivateKey, r *RevealKey, data []byte) (Screen, error)

type Ticket

+ Renews *Renewal

Oct 30, 2026

Changes in this version

+ const FacadeMobile

+ const MaxClearScreen

+ const MaxDevices

+ const SealAlgGCM

+ var ErrDevice = errors.New("ticket: device signature refused")

+ var ErrTooLarge = errors.New("ticket: clear screen too large to seal")

+ func ClearScreenAAD(id, dev string) []byte

+ func DeviceID(cred []byte) string

+ func MarshalDevices(devs []Device) ([]byte, error)

+ func TicketHash(signed []byte) string

+ func ValidDeviceID(s string) bool

+ func VerifyAssertion(dev *Device, challenge []byte, a *DeviceAssertion) (uint32, error)

+ func VerifyDevice(dev *Device, d *Decision, signed []byte) error

type Context

+ const ContextClearScreen

+ const ContextDeviceDecision

type Decision

+ Device *DeviceAssertion

+ func (d *Decision) Statement(dev, ticketHash string) DeviceStatement

+ type Device struct

+ Credential string

+ ES256 string

+ ID string

+ Name string

+ Origin string

+ RPID string

+ V int

+ X25519 string

+ func ParseDevices(data []byte) ([]Device, error)

+ func (d *Device) Fingerprint() (string, error)

+ func (d *Device) SealingKey() (*ecdh.PublicKey, error)

+ func (d *Device) Validate() error

+ type DeviceAssertion struct

+ AuthData string

+ ClientData string

+ Device string

+ Sig string

+ type DeviceBox struct

+ Box Sealed

+ Device string

+ func SealClearScreen(dev *Device, id string, s Screen) (*DeviceBox, error)

+ type DeviceSet struct

+ Devices []Device

+ V int

+ type DeviceStatement struct

+ Approver string

+ At time.Time

+ Decision Outcome

+ Device string

+ Display string

+ Facade string

+ HubKeyID string

+ Instance string

+ KeyID string

+ Nonce string

+ PlanHash string

+ Reason string

+ Ticket string

+ TicketHash string

+ V int

+ func (s DeviceStatement) Challenge() ([]byte, error)

type PII

+ SealedFor []DeviceBox

type Screen

+ func OpenClearScreen(priv *ecdh.PrivateKey, id, dev string, b *DeviceBox) (Screen, error)

type Sealed

+ func SealGCM(to *ecdh.PublicKey, plaintext, aad []byte) (*Sealed, error)

Oct 29, 2026

Changes in this version

+ const SealAlg

+ const Version

+ var ErrBadSignature = errors.New("ticket: bad signature")

+ var ErrDenied = errors.New("ticket: not approved")

+ var ErrExpired = errors.New("ticket: expired")

+ var ErrInvalid = errors.New("ticket: invalid")

+ var ErrMismatch = errors.New("ticket: decision does not match the ticket")

+ var ErrNotCanonicalizable = errors.New("ticket: not canonicalizable JSON")

+ var ErrOpen = errors.New("ticket: sealed box does not open")

+ var Risks = []Risk

+ func Canonical(v any) ([]byte, error)

+ func CanonicalizeJSON(b []byte) ([]byte, error)

+ func ClampTTL(r Risk, configured time.Duration) time.Duration

+ func HashOf(v any) (string, error)

+ func KeyID(pub ed25519.PublicKey) string

+ func NewID(now time.Time) string

+ func NewNonce() string

+ func Open(priv *ecdh.PrivateKey, s *Sealed, aad []byte) ([]byte, error)

+ func RequestMessage(method, pathQuery, instance string, at time.Time, nonce string, body []byte) []byte

+ func SignBytes(key ed25519.PrivateKey, c Context, msg []byte) string

+ func ValidID(s string) bool

+ func VerifyBytes(pub ed25519.PublicKey, c Context, msg []byte, sig string) error

+ func VerifyKeyCert(signer ed25519.PublicKey, c Context, bind string, data []byte) (*ecdh.PublicKey, error)

+ type Approver struct

+ Display string

+ ID string

+ type Context string

+ const ContextDecision

+ const ContextKeyCert

+ const ContextRequest

+ const ContextReveal

+ const ContextTicket

+ type Decision struct

+ Approver Approver

+ At time.Time

+ Decision Outcome

+ Facade string

+ HubKeyID string

+ Instance string

+ KeyID string

+ Nonce string

+ PlanHash string

+ Reason string

+ Sig string

+ Ticket string

+ V int

+ func VerifyDecision(pub ed25519.PublicKey, data []byte) (*Decision, error)

+ func (d *Decision) Marshal() ([]byte, error)

+ func (d *Decision) Match(t *Ticket) error

+ func (d *Decision) Sign(key ed25519.PrivateKey) error

+ func (d *Decision) Usable(t *Ticket, now time.Time, ttl time.Duration) error

+ func (d *Decision) Validate() error

+ type Flags struct

+ NeverAuto bool

+ Production bool

+ Retype string

+ type KeyCert struct

+ Bind string

+ KeyID string

+ Sig string

+ V int

+ X25519 string

+ func CertifyX25519(key ed25519.PrivateKey, c Context, pub *ecdh.PublicKey, bind string) (*KeyCert, error)

+ type Outcome string

+ const Approved

+ const Denied

+ func (o *Outcome) UnmarshalJSON(b []byte) error

+ type PII struct

+ ClearSealed *Sealed

+ Touched []string

+ type Requester struct

+ Agent string

+ Session string

+ type Risk string

+ const RiskPolicyLoosen

+ const RiskProdWrite

+ const RiskRead

+ const RiskReadPII

+ const RiskUnlock

+ const RiskWrite

+ func ParseRisk(s string) (Risk, error)

+ func (r *Risk) UnmarshalJSON(b []byte) error

+ func (r Risk) TTL() time.Duration

+ func (r Risk) Valid() bool

+ type Screen struct

+ Body []string

+ Header string

+ Note string

+ Red bool

+ Warnings []string

+ type Sealed struct

+ Alg string

+ CT string

+ EPK string

+ Nonce string

+ func Seal(to *ecdh.PublicKey, plaintext, aad []byte) (*Sealed, error)

+ type Source struct

+ Instance string

+ KeyID string

+ Lock string

+ type Ticket struct

+ Created time.Time

+ Expires *time.Time

+ Flags Flags

+ ID string

+ PII PII

+ PlanHash string

+ PolicyFP string

+ Requester Requester

+ Risk Risk

+ Screen Screen

+ Sig string

+ Source Source

+ V int

+ Workspace string

+ func NewTicket(src Source, risk Risk, planHash, policyFP string, now time.Time, ...) *Ticket

+ func VerifyTicket(pub ed25519.PublicKey, data []byte) (*Ticket, error)

+ func (t *Ticket) Expired(now time.Time) bool

+ func (t *Ticket) Marshal() ([]byte, error)

+ func (t *Ticket) Sign(key ed25519.PrivateKey) error

+ func (t *Ticket) Validate() error