{
	"lexicon": 1,
	"id": "com.fedfork.exec.webrtc.connect",
	"defs": {
		"main": {
			"type": "procedure",
			"description": "Host pseudo-call, never sent to a PDS (like com.fedfork.exec.attest): a module lists it in calls to be allowed to open a WebRTC datachannel to the guest VM of a socialweb.computer receipt. wasm holds no socket, so the host does it all: reads the guest's guest.publicKey and vm.onNetwork (kind webrtc) from the bidder's events, seals {sdp, replyTo} with age to the guest key, publishes it as the session through the module's signed guest.signalWebRTC + market.event (requester `signal`), opens the sealed answer, checks its DTLS fingerprint against vm.onNetwork, and opens the channel labelled tag (non-trickle ICE, STUN only). With a command (tag ssh) it runs it over ssh on the channel and returns the output. The channel stays open in the host (e.g. the page's terminal). Hosts without RTCPeerConnection refuse it.",
			"input": {
				"encoding": "application/json",
				"schema": {
					"type": "object",
					"required": ["receipt", "tag"],
					"properties": {
						"receipt": { "type": "ref", "ref": "com.atproto.repo.strongRef", "description": "The market.receipt of the won VM; its repo is the bidder." },
						"tag": { "type": "string", "minLength": 1, "maxLength": 32, "description": "Datachannel label: a tunnels.json tag in the VM's user_data (e.g. ssh -> 127.0.0.1:22)." },
						"command": { "type": "string", "maxLength": 4096, "description": "Run over ssh on the channel (tag ssh only), with the host's ssh key, as root." },
						"stdin": { "type": "string", "maxLength": 65536, "description": "With a command: written to its stdin, then EOF. Secrets (tokens) go here, never in command: the guest's login shell runs the command as an argument, so ps shows it." }
					}
				}
			},
			"output": {
				"encoding": "application/json",
				"schema": {
					"type": "object",
					"required": ["tag", "fingerprint"],
					"properties": {
						"tag": { "type": "string" },
						"fingerprint": { "type": "string", "description": "The guest's DTLS fingerprint the answer matched (vm.onNetwork address)." },
						"output": { "type": "string", "description": "The command's output, when a command was given." },
						"hostKey": {
							"type": "object",
							"description": "The guest sshd's host key, when a command was given; pinned: it is one of the bidder's vm.hostKeys.",
							"properties": {
								"type": { "type": "string" },
								"fingerprint": { "type": "string" },
								"pinned": { "type": "boolean" }
							}
						}
					}
				}
			}
		}
	}
}