From d3aae8c3aaef561ff81a0b6bab5ccb547b0a2b75 Mon Sep 17 00:00:00 2001 From: zzstoatzz Date: Sun, 21 Jun 2026 23:34:31 -0500 Subject: [PATCH] trim public api surface --- devlog/013-doors.md | 4 ++-- src/internal/oauth.zig | 4 ++-- src/internal/streaming/firehose.zig | 4 ++-- src/root.zig | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/devlog/013-doors.md b/devlog/013-doors.md index de13747..983f0a8 100644 --- a/devlog/013-doors.md +++ b/devlog/013-doors.md @@ -6,7 +6,7 @@ devlog 012 ended at `v0.3.5`. this covers `v0.3.6` and `v0.3.7`, and there is no the new consumer this cycle is [leaflet-search](https://tangled.org/zzstoatzz.io/leaflet-search) (now pub-search), which grew its own firehose ingester to replace indigo's `tap`. the ingester's last blocker was verification: it wanted to consume the firehose and verify each commit in-process before trusting it. -zat already had the verifier for exactly this. `repo_verifier.verifyCommitCar` says so in its own doc comment — "used by the relay to verify firehose commit frames directly" — and takes the raw CAR bytes from a frame's `blocks` field plus a resolved signing key. the function was right there. +zat already had the verifier for exactly this. `verifyCommitCar` says so in its own doc comment — "used by the relay to verify firehose commit frames directly" — and takes the raw CAR bytes from a frame's `blocks` field plus a resolved signing key. the function was right there. the problem was that you could not get the bytes to it. every prior verification story in these notes is *low-level*: the relay (devlog 006), zlay, and zds all decode firehose frames themselves, so they were already holding the raw CAR when it came time to verify. a high-level `FirehoseClient` consumer was not. `decodeFrame` read the `blocks`, parsed the CAR to hydrate each op's record, and then **discarded the raw bytes**. `CommitEvent` exposed `seq`, `repo`, `rev`, `ops`, `blobs`, `too_big` — and nothing you could hand to `verifyCommitCar`. the documented path was real and unreachable at the same time. @@ -27,7 +27,7 @@ pub const CommitEvent = struct { now the high-level consumer does what the relay always could: ```zig -try zat.repo_verifier.verifyCommitCar(allocator, event.commit.blocks, signing_key, .{}); +try zat.verifyCommitCar(allocator, event.commit.blocks, signing_key, .{}); ``` the same change carries `prev_data` and the per-op `prev` CIDs through, adds a `toMstOperations()` helper, and decodes `#sync` events — so a consumer that wants the stronger [`verifyCommitDiff`](https://tangled.org/zat.dev/zat/blob/main/src/internal/repo/repo_verifier.zig) (invert the ops, prove the previous root) has the inputs for that too. CAR parse failure during hydration is now non-fatal: the wire event still surfaces, and a consumer rejects it by verifying `blocks` explicitly rather than by never seeing it. leaflet-search's ingester verifies in-consumer now, which was the sole thing standing between it and replacing `tap`. diff --git a/src/internal/oauth.zig b/src/internal/oauth.zig index 2bf054d..0f162fc 100644 --- a/src/internal/oauth.zig +++ b/src/internal/oauth.zig @@ -3,8 +3,8 @@ //! `primitives` contains PKCE, DPoP, client assertions, and form/JWKS helpers. //! `client` contains framework-neutral ATProto OAuth client ceremony. -pub const primitives = @import("oauth/primitives.zig"); -pub const client = @import("oauth/client.zig"); +const primitives = @import("oauth/primitives.zig"); +const client = @import("oauth/client.zig"); pub const createJwt = primitives.createJwt; pub const createDpopProof = primitives.createDpopProof; diff --git a/src/internal/streaming/firehose.zig b/src/internal/streaming/firehose.zig index f3a26c7..77e56a8 100644 --- a/src/internal/streaming/firehose.zig +++ b/src/internal/streaming/firehose.zig @@ -160,7 +160,7 @@ const FrameHeader = struct { t: ?[]const u8 = null, }; -pub const FrameOp = enum(i64) { +const FrameOp = enum(i64) { message = 1, err = -1, }; @@ -450,7 +450,7 @@ fn decodeAccount(payload: cbor.Value) DecodeError!Event { // === encoder === /// encode a firehose Event into a wire frame: [DAG-CBOR header] [DAG-CBOR payload] -pub fn encodeFrame(allocator: Allocator, event: Event) ![]u8 { +fn encodeFrame(allocator: Allocator, event: Event) ![]u8 { var aw: std.Io.Writer.Allocating = .init(allocator); errdefer aw.deinit(); diff --git a/src/root.zig b/src/root.zig index bb3f148..13c1ad3 100644 --- a/src/root.zig +++ b/src/root.zig @@ -39,7 +39,7 @@ pub const cbor = @import("internal/repo/cbor.zig"); pub const car = @import("internal/repo/car.zig"); // repo verification -pub const repo_verifier = @import("internal/repo/repo_verifier.zig"); +const repo_verifier = @import("internal/repo/repo_verifier.zig"); pub const verifyRepo = repo_verifier.verifyRepo; pub const VerifyResult = repo_verifier.VerifyResult; pub const verifyCommitCar = repo_verifier.verifyCommitCar; -- 2.51.2