Module tree 

The ownership tree over HTTP: creating an account beneath a creator, parking a key for the operator to admit, and a session from a proof.

A creator is whatever authenticates as an account, in one of three shapes (Proof): a session this server issued, a JWT signed by a key the account’s credential records name, or an OpenID Connect token one of those records describes, for the account the request names. The deployment’s operator, who holds no account here, presents the operator session this server minted at sign-in (see crate::operator), and the bot.did.operator record this server reads from their repository is what lets them create. Every other creator’s record is written here, by this server, as the creator.

proof is the verifier, which createSession uses as well as createAccount; oidc is its OpenID Connect half, parked holds keys waiting for the operator, and names splits a requested name. This file holds the routes and what they share.

Modules

credentials 🔒

bot.did.updateCredentials: what logs in as an account, changed after it is created.

names 🔒

Splitting a requested name into the label it adds and the zone it sits under.

oidc 🔒

The OpenID Connect half of the proof check: an issuer’s discovery document, its key set, and the claims the named account’s bot.did.credential identities say must match.

parked 🔒

A key held for the operator to admit later.

proof 🔒

Who a caller is, before anything is created for them.

Structs

JwksCache

The key sets of the issuers this server has read, each for ten minutes (JWKS_TTL).

ParkedKey

A public key parked at this server, waiting for the operator to admit it under a name.

ParkedKeys

Keys parked at this server, in memory, keyed by name and fingerprint.

Replay

Proofs already spent, each until its own expiry.

TreeState

What the tree’s routes hold between requests.

Enums

NotSpent

Why a proof could not be spent.

Proof

What a credential on the tree’s routes resolved to.

Constants

ALLOWANCE_REREAD_WAIT 🔒

The most a create refused for want of an allowance waits for the operator poll to re-read the operator’s records before it answers.

DEFAULT_OIDC_FRESHNESS

How old an OpenID Connect token’s iat may be, absent configuration.

DEFAULT_PARK_TTL

How long a parked key is held, absent configuration: ten minutes.

MAX_PROOF_LIFETIME

The furthest into the future a proof’s exp may sit.

PARK_RATE_LIMIT

How many bot.did.parkKey and describeParkedKey calls one caller address may make per PARK_RATE_WINDOW, absent configuration.

PARK_RATE_WINDOW

The window PARK_RATE_LIMIT is measured over, absent configuration.

RESERVED_LABELS

Labels no account may take directly under a zone, absent configuration: the hostnames a deployment answers at itself, the DNS conventions beside them, and the names a browser or resolver asks for without being told to. [tree].reserved_labels replaces the list.

TOP_EDGE_TTL 🔒

How long a re-read of the operator’s record for a root creator is reused across creates beneath it.

Functions

create_account 🔒

POST /xrpc/bot.did.createAccount

create_account_inner 🔒

create_session 🔒

POST /xrpc/bot.did.createSession?did=

create_session_inner 🔒

describe_parked_key 🔒

GET /xrpc/bot.did.describeParkedKey?name=&fingerprint=

fingerprint

The fingerprint a parked key is shown by: SHA256: and the base64url digest of the multibase text, the way OpenSSH shows a key.

fragments_of 🔒

A create’s fragments, by slot: given only with a pool, and never with a name, each slot once.

listing_holds 🔒

Whether the operator poll’s last listing held a record at rkey. No listing yet holds none.

operator_creator 🔒

The operator, whose own repository has to name name before anything is minted beneath them.

operator_unreachable 🔒

The operator’s repository could not be read for the record a creation rests on.

park_key 🔒

POST /xrpc/bot.did.parkKey

park_key_inner 🔒

refuse_operators_name 🔒

Refuses a create of name, by any creator but the operator, when the operator’s repository holds bot.did.operator/<name>: the name is the operator’s to create, and taking it first would leave the operator’s own create refused as AccountAlreadyExists.

require_park_budget 🔒

Refuses a caller address past its park budget.

require_top_edge 🔒

Re-reads the operator’s record for the root above a creator — the account with no hosted parent, other than the server itself — inside TOP_EDGE_TTL, and refuses a creation beneath a root the operator no longer names. A creator deeper down is on the same chain, so its root is read the same way; the hosted edges between are the provisioner’s to check. A repository that cannot be read leaves the poll’s last verdict standing: a lapsed root is already quarantined, and the registry refuses it.