@naughtbot/e2ee-payloads 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/dist/index.d.ts +6 -0
  2. package/dist/index.d.ts.map +1 -1
  3. package/dist/schema.d.ts +243 -3
  4. package/dist/schema.d.ts.map +1 -1
  5. package/package.json +1 -1
  6. package/src/index.test.ts +141 -1
  7. package/src/index.ts +6 -0
  8. package/src/schema.ts +243 -3
package/dist/index.d.ts CHANGED
@@ -34,4 +34,10 @@ export type MailboxEnrollRequestPayloadV1 = components["schemas"]["MailboxEnroll
34
34
  export type MailboxEnrollResponsePayloadV1 = components["schemas"]["MailboxEnrollResponsePayloadV1"];
35
35
  export type MailboxEnrollResponseApprovedV1 = components["schemas"]["MailboxEnrollResponseApprovedV1"];
36
36
  export type MailboxEnrollResponseRejectedV1 = components["schemas"]["MailboxEnrollResponseRejectedV1"];
37
+ export type MailboxBrowserApprovalDecision = components["schemas"]["MailboxBrowserApprovalDecision"];
38
+ export type MailboxBrowserApprovalResponseStatus = components["schemas"]["MailboxBrowserApprovalResponseStatus"];
39
+ export type MailboxBrowserApprovalBindingFormat = components["schemas"]["MailboxBrowserApprovalBindingFormat"];
40
+ export type MailboxBrowserApprovalRequestPayloadV1 = components["schemas"]["MailboxBrowserApprovalRequestPayloadV1"];
41
+ export type MailboxBrowserApprovalDecisionBindingV1 = components["schemas"]["MailboxBrowserApprovalDecisionBindingV1"];
42
+ export type MailboxBrowserApprovalResponsePayloadV1 = components["schemas"]["MailboxBrowserApprovalResponsePayloadV1"];
37
43
  //# sourceMappingURL=index.d.ts.map
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC;AAC/E,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,kCAAkC,CAAC,CAAC;AACzG,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,mCAAmC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,qCAAqC,CAAC,CAAC;AAC/G,MAAM,MAAM,oCAAoC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACjH,MAAM,MAAM,oCAAoC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACjH,MAAM,MAAM,oCAAoC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACjH,MAAM,MAAM,6BAA6B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,+BAA+B,CAAC,CAAC;AACnG,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC;AAC/E,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,kCAAkC,CAAC,CAAC;AACzG,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAC3G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,kCAAkC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;AAC7G,MAAM,MAAM,mCAAmC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,qCAAqC,CAAC,CAAC;AAC/G,MAAM,MAAM,oCAAoC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACjH,MAAM,MAAM,oCAAoC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACjH,MAAM,MAAM,oCAAoC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACjH,MAAM,MAAM,6BAA6B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,+BAA+B,CAAC,CAAC;AACnG,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;AACvG,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;AACrG,MAAM,MAAM,oCAAoC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACjH,MAAM,MAAM,mCAAmC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,qCAAqC,CAAC,CAAC;AAC/G,MAAM,MAAM,sCAAsC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,wCAAwC,CAAC,CAAC;AACrH,MAAM,MAAM,uCAAuC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,yCAAyC,CAAC,CAAC;AACvH,MAAM,MAAM,uCAAuC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,yCAAyC,CAAC,CAAC"}
package/dist/schema.d.ts CHANGED
@@ -42,7 +42,7 @@ export interface components {
42
42
  * @example ssh_sign
43
43
  * @enum {string}
44
44
  */
45
- MailboxEnvelopeType: "link_request" | "link_approval" | "link_rejection" | "captcha_request" | "captcha_response" | "ssh_auth" | "ssh_sign" | "gpg_sign" | "gpg_decrypt" | "age_unwrap" | "pkcs11_sign" | "pkcs11_derive" | "enroll";
45
+ MailboxEnvelopeType: "link_request" | "link_approval" | "link_rejection" | "captcha_request" | "captcha_response" | "ssh_auth" | "ssh_sign" | "gpg_sign" | "gpg_decrypt" | "age_unwrap" | "pkcs11_sign" | "pkcs11_derive" | "enroll" | "browser_approval_request" | "browser_approval_response";
46
46
  /**
47
47
  * ApprovalChallenge
48
48
  * @description Canonical Longfellow / attested-key-zk approval challenge. Producer sends this inside the request payload; the approver binds it into the approval proof returned in the response payload.
@@ -305,7 +305,7 @@ export interface components {
305
305
  MailboxSshAuthResponsePayloadV1: components["schemas"]["MailboxSshAuthResponseSuccessV1"] | components["schemas"]["MailboxSshAuthResponseFailureV1"];
306
306
  /**
307
307
  * MailboxSshAuthResponseSuccessV1
308
- * @description Success branch of `MailboxSshAuthResponsePayloadV1`.
308
+ * @description Success branch of `MailboxSshAuthResponsePayloadV1`. Carries the raw SSH signature plus the per-signature SK assertion flags byte and monotonic counter the signer's secure element returned for this signing operation; all three are required so the requester can rebuild the OpenSSH SK signature preimage (`SHA256(application) || flags || counter || SHA256(data)`) and verify against the enrolled credential public key.
309
309
  */
310
310
  MailboxSshAuthResponseSuccessV1: {
311
311
  /**
@@ -313,6 +313,17 @@ export interface components {
313
313
  * @description RFC 4648 standard base64 with `=` padding for the raw SSH signature blob (no SSH-wire framing).
314
314
  */
315
315
  signature: string;
316
+ /**
317
+ * @description Per-signature SK assertion flags byte the signer's secure element actually asserted with. Approvers MUST either (a) assert with at least the bits the request `flags` byte asked for (UP=0x01, UV=0x04) and return the resulting byte here, or (b) return a `MailboxSshAuthResponseFailureV1` / `MailboxSshSignResponseFailureV1` with the appropriate signing error code. Approvers MUST NOT return a success response whose asserted flags byte clears bits the requester set; that would silently downgrade the security posture (e.g. UV-required → UP-only) below what the request agreed to. Receivers MUST embed this asserted byte at the `flags` position of the OpenSSH SK signature preimage; verification fails if the request `flags` byte is used instead. Receivers SHOULD additionally verify that every bit set in the request `flags` byte is also set here as belt-and-suspenders defence against a misbehaving approver.
318
+ * @example 1
319
+ */
320
+ flags: number;
321
+ /**
322
+ * Format: int64
323
+ * @description Monotonic counter (u32) the signer's secure element returned for this SK signing operation. Receivers MUST embed this in the OpenSSH SK signature preimage at the position between `flags` and `SHA256(data)` as a 4-byte big-endian unsigned integer. Successive signatures from the same key handle MUST have strictly increasing counter values. The schema declares `format: int64` so 32-bit Go targets can still represent the full u32 range without overflow.
324
+ * @example 1
325
+ */
326
+ counter: number;
316
327
  approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
317
328
  };
318
329
  /**
@@ -368,7 +379,7 @@ export interface components {
368
379
  MailboxSshSignResponsePayloadV1: components["schemas"]["MailboxSshSignResponseSuccessV1"] | components["schemas"]["MailboxSshSignResponseFailureV1"];
369
380
  /**
370
381
  * MailboxSshSignResponseSuccessV1
371
- * @description Success branch of `MailboxSshSignResponsePayloadV1`.
382
+ * @description Success branch of `MailboxSshSignResponsePayloadV1`. Carries the raw SSH signature plus the per-signature SK assertion flags byte and monotonic counter the signer's secure element returned for this signing operation; all three are required so the requester can rebuild the OpenSSH SK signature preimage (`SHA256(application) || flags || counter || SHA256(data)`) and verify against the enrolled credential public key.
372
383
  */
373
384
  MailboxSshSignResponseSuccessV1: {
374
385
  /**
@@ -376,6 +387,17 @@ export interface components {
376
387
  * @description RFC 4648 standard base64 with `=` padding for the raw SSH signature blob (no SSH-wire framing).
377
388
  */
378
389
  signature: string;
390
+ /**
391
+ * @description Per-signature SK assertion flags byte the signer's secure element actually asserted with. Approvers MUST either (a) assert with at least the bits the request `flags` byte asked for (UP=0x01, UV=0x04) and return the resulting byte here, or (b) return a `MailboxSshAuthResponseFailureV1` / `MailboxSshSignResponseFailureV1` with the appropriate signing error code. Approvers MUST NOT return a success response whose asserted flags byte clears bits the requester set; that would silently downgrade the security posture (e.g. UV-required → UP-only) below what the request agreed to. Receivers MUST embed this asserted byte at the `flags` position of the OpenSSH SK signature preimage; verification fails if the request `flags` byte is used instead. Receivers SHOULD additionally verify that every bit set in the request `flags` byte is also set here as belt-and-suspenders defence against a misbehaving approver.
392
+ * @example 1
393
+ */
394
+ flags: number;
395
+ /**
396
+ * Format: int64
397
+ * @description Monotonic counter (u32) the signer's secure element returned for this SK signing operation. Receivers MUST embed this in the OpenSSH SK signature preimage at the position between `flags` and `SHA256(data)` as a 4-byte big-endian unsigned integer. Successive signatures from the same key handle MUST have strictly increasing counter values. The schema declares `format: int64` so 32-bit Go targets can still represent the full u32 range without overflow.
398
+ * @example 1
399
+ */
400
+ counter: number;
379
401
  approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
380
402
  };
381
403
  /**
@@ -778,6 +800,11 @@ export interface components {
778
800
  encryption_public_key_hex?: string;
779
801
  /** @description 40-character hex fingerprint of the ECDH encryption subkey. */
780
802
  encryption_fingerprint?: string;
803
+ /**
804
+ * @description Per-credential SSH-SK flags byte the approver baked into a newly enrolled SSH security-key credential. **MUST be present when `purpose` is the SSH signing purpose; absent for all other key purposes.** (The schema cannot express that conditional requirement directly because `MailboxEnrollResponseApprovedV1` is a single monolithic shape with per-type-optional fields like `fingerprint` / `encryption_public_key_hex`; requesters MUST reject SSH-purpose approved responses that omit this field.) The requester MUST persist this byte alongside the credential public key and use it as the request `flags` input on every subsequent `ssh_auth` / `ssh_sign` call. The approver echoes the actual per-signature assertion flags byte back in the success response (see `MailboxSshAuthResponseSuccessV1.flags`); that asserted byte (which MAY differ from this enrollment flags byte when, e.g., the SK could not deliver user verification) is what the requester MUST embed into the OpenSSH SK signature preimage `SHA256(application) || flags || counter || SHA256(data)`. Bit `0x01` is "user presence required" and `0x04` is "user verification required" per the OpenSSH SK protocol.
805
+ * @example 1
806
+ */
807
+ ssh_sk_flags?: number;
781
808
  attestation?: components["schemas"]["KeyMetadataAttestation"];
782
809
  approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
783
810
  };
@@ -798,6 +825,219 @@ export interface components {
798
825
  */
799
826
  error_message?: string;
800
827
  };
828
+ /**
829
+ * MailboxBrowserApprovalDecision
830
+ * @description Mobile user's signed approval decision.
831
+ * @example approved
832
+ * @enum {string}
833
+ */
834
+ MailboxBrowserApprovalDecision: "approved" | "denied";
835
+ /**
836
+ * MailboxBrowserApprovalResponseStatus
837
+ * @description Response lifecycle status. The signed `decision` carries the approval outcome.
838
+ * @example decided
839
+ * @enum {string}
840
+ */
841
+ MailboxBrowserApprovalResponseStatus: "decided";
842
+ /**
843
+ * MailboxBrowserApprovalBindingFormat
844
+ * @description Canonical byte format signed by the mobile approval key.
845
+ * @example browser-approval-decision-binding/v1+json
846
+ * @enum {string}
847
+ */
848
+ MailboxBrowserApprovalBindingFormat: "browser-approval-decision-binding/v1+json";
849
+ /**
850
+ * MailboxBrowserApprovalRequestPayloadV1
851
+ * @description Request payload for the `browser_approval_request` envelope type. A service requester sends this to the paired mobile device when a browser key needs approval for a generic capability.
852
+ */
853
+ MailboxBrowserApprovalRequestPayloadV1: {
854
+ /**
855
+ * @description Opaque service-scoped approval id.
856
+ * @example appr_2af7b1fb2b5b4b5b8c7e9a0d
857
+ */
858
+ approval_id: string;
859
+ /**
860
+ * @description Human-readable browser/device label shown to the mobile user.
861
+ * @example Chrome on MacBook Pro
862
+ */
863
+ browser_display_name: string;
864
+ /**
865
+ * @description Best-effort browser platform hint shown to the mobile user.
866
+ * @example macOS
867
+ */
868
+ browser_platform: string;
869
+ /** @description Optional user-agent hint for display and diagnostics. */
870
+ browser_user_agent?: string;
871
+ /**
872
+ * @description Browser public key algorithm identifier, e.g. `ES256` or `Ed25519`.
873
+ * @example ES256
874
+ */
875
+ browser_public_key_algorithm: string;
876
+ /**
877
+ * @description Thumbprint of the browser public key being approved. Producers SHOULD use `sha256:<base64url-no-padding>` for JWK thumbprints.
878
+ * @example sha256:8uLz73VtBwmU5O_Jr3r2StpLrNxW41Oq9p6FwR2C7xA
879
+ */
880
+ browser_public_key_thumbprint: string;
881
+ /**
882
+ * @description Generic capability requested by the service.
883
+ * @example captcha.browser_credential
884
+ */
885
+ requested_capability: string;
886
+ /**
887
+ * @description Service/requester client id that created the approval request.
888
+ * @example captcha-service
889
+ */
890
+ requester_client_id: string;
891
+ /**
892
+ * @description Human-readable requester name shown to the mobile user.
893
+ * @example NaughtBot Captcha
894
+ */
895
+ requester_display_name: string;
896
+ /**
897
+ * @description Origin of the requester that will receive/use the browser credential.
898
+ * @example https://captcha.naughtbot.com
899
+ */
900
+ requester_origin: string;
901
+ /**
902
+ * @description Opaque nonce bound into the mobile-signed decision.
903
+ * @example m4H2YxTjueEXAMPLE
904
+ */
905
+ nonce: string;
906
+ /**
907
+ * @description RFC 3339 UTC timestamp with canonical `Z` suffix.
908
+ * @example 2026-05-14T19:30:00Z
909
+ */
910
+ issued_at: string;
911
+ /**
912
+ * @description RFC 3339 UTC timestamp after which the request is invalid.
913
+ * @example 2026-05-14T19:35:00Z
914
+ */
915
+ expires_at: string;
916
+ };
917
+ /**
918
+ * MailboxBrowserApprovalDecisionBindingV1
919
+ * @description Canonical JSON object whose UTF-8 bytes are signed by the mobile approval key. Producers encode these fields in lexicographic property order with no insignificant whitespace and place the resulting bytes in `MailboxBrowserApprovalResponsePayloadV1.approval_binding_bytes`.
920
+ */
921
+ MailboxBrowserApprovalDecisionBindingV1: {
922
+ /**
923
+ * @description Approval id copied from the request payload.
924
+ * @example appr_2af7b1fb2b5b4b5b8c7e9a0d
925
+ */
926
+ approval_id: string;
927
+ /**
928
+ * @description Browser public key algorithm copied from the request payload.
929
+ * @example ES256
930
+ */
931
+ browser_public_key_algorithm: string;
932
+ /**
933
+ * @description Browser public key thumbprint copied from the request payload.
934
+ * @example sha256:8uLz73VtBwmU5O_Jr3r2StpLrNxW41Oq9p6FwR2C7xA
935
+ */
936
+ browser_public_key_thumbprint: string;
937
+ /**
938
+ * @description RFC 3339 UTC timestamp of the mobile decision.
939
+ * @example 2026-05-14T19:31:00Z
940
+ */
941
+ decided_at: string;
942
+ decision: components["schemas"]["MailboxBrowserApprovalDecision"];
943
+ /**
944
+ * @description Request expiry copied from the request payload.
945
+ * @example 2026-05-14T19:35:00Z
946
+ */
947
+ expires_at: string;
948
+ /**
949
+ * @description Nonce copied from the request payload.
950
+ * @example m4H2YxTjueEXAMPLE
951
+ */
952
+ nonce: string;
953
+ /**
954
+ * @description SHA-256 hash of the service-mobile pairing transcript.
955
+ * @example sha256:6f5902ac237024bdd0c176cb93063dc4f1e01e1191450b5f8f457c56f48e1f4f
956
+ */
957
+ pairing_transcript_hash: string;
958
+ /**
959
+ * Format: uuid
960
+ * @description Envelope id of the browser approval request being answered.
961
+ * @example 11111111-2222-4333-8444-555555555555
962
+ */
963
+ request_envelope_id: string;
964
+ /**
965
+ * @description Envelope `issued_at` timestamp of the request being answered.
966
+ * @example 2026-05-14T19:30:00Z
967
+ */
968
+ request_envelope_issued_at: string;
969
+ /**
970
+ * @description Envelope type of the request being answered.
971
+ * @example browser_approval_request
972
+ * @enum {string}
973
+ */
974
+ request_envelope_type: "browser_approval_request";
975
+ /**
976
+ * @description Requested capability copied from the request payload.
977
+ * @example captcha.browser_credential
978
+ */
979
+ requested_capability: string;
980
+ /**
981
+ * @description Requester client id copied from the request payload.
982
+ * @example captcha-service
983
+ */
984
+ requester_client_id: string;
985
+ /**
986
+ * @description Requester origin copied from the request payload.
987
+ * @example https://captcha.naughtbot.com
988
+ */
989
+ requester_origin: string;
990
+ /**
991
+ * @description Stable id for the service-mobile E2EE mailbox pairing.
992
+ * @example pair_9d58fb4c6ff84f46
993
+ */
994
+ service_mobile_pairing_id: string;
995
+ /**
996
+ * @description Canonical decision binding schema version.
997
+ * @enum {string}
998
+ */
999
+ version: "browser-approval-decision-binding/v1";
1000
+ };
1001
+ /**
1002
+ * MailboxBrowserApprovalResponsePayloadV1
1003
+ * @description Response payload for the `browser_approval_response` envelope type. The response carries the mobile decision plus the exact canonical bytes and signature over `MailboxBrowserApprovalDecisionBindingV1`.
1004
+ */
1005
+ MailboxBrowserApprovalResponsePayloadV1: {
1006
+ /**
1007
+ * Format: byte
1008
+ * @description RFC 4648 standard base64 with `=` padding for the canonical `MailboxBrowserApprovalDecisionBindingV1` UTF-8 JSON bytes.
1009
+ */
1010
+ approval_binding_bytes: string;
1011
+ approval_binding_format: components["schemas"]["MailboxBrowserApprovalBindingFormat"];
1012
+ /**
1013
+ * @description Approval id copied from the request payload.
1014
+ * @example appr_2af7b1fb2b5b4b5b8c7e9a0d
1015
+ */
1016
+ approval_id: string;
1017
+ /**
1018
+ * Format: byte
1019
+ * @description RFC 4648 standard base64 with `=` padding for the signature over `approval_binding_bytes`.
1020
+ */
1021
+ approval_signature: string;
1022
+ /**
1023
+ * @description RFC 3339 UTC timestamp of the mobile decision.
1024
+ * @example 2026-05-14T19:31:00Z
1025
+ */
1026
+ decided_at: string;
1027
+ decision: components["schemas"]["MailboxBrowserApprovalDecision"];
1028
+ /**
1029
+ * Format: uuid
1030
+ * @description Envelope id of the browser approval request being answered.
1031
+ * @example 11111111-2222-4333-8444-555555555555
1032
+ */
1033
+ request_envelope_id: string;
1034
+ /**
1035
+ * @description Mobile signing key id that produced `approval_signature`.
1036
+ * @example mobile-key-browser-approval-1
1037
+ */
1038
+ signing_key_id: string;
1039
+ status: components["schemas"]["MailboxBrowserApprovalResponseStatus"];
1040
+ };
801
1041
  };
802
1042
  responses: never;
803
1043
  parameters: never;
package/dist/schema.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC1C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7C,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE;QACL;;;WAGG;QACH,iBAAiB,EAAE;YACf;;;eAGG;YACH,CAAC,EAAE,CAAC,CAAC;YACL;;;eAGG;YACH,IAAI,EAAE,MAAM,CAAC;YACb;;;eAGG;YACH,EAAE,EAAE,MAAM,CAAC;YACX;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,mPAAmP;YACnP,OAAO,EAAE;gBACL,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;aAC1B,CAAC;SACL,CAAC;QACF;;;;;WAKG;QACH,mBAAmB,EAAE,cAAc,GAAG,eAAe,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,aAAa,GAAG,eAAe,GAAG,QAAQ,CAAC;QACrO;;;WAGG;QACH,iBAAiB,EAAE;YACf;;;eAGG;YACH,OAAO,EAAE,uBAAuB,CAAC;YACjC,uFAAuF;YACvF,KAAK,EAAE,MAAM,CAAC;YACd,oEAAoE;YACpE,UAAU,EAAE,MAAM,CAAC;YACnB,0FAA0F;YAC1F,cAAc,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,sBAAsB,EAAE;YACpB,0HAA0H;YAC1H,qBAAqB,EAAE,MAAM,CAAC;YAC9B,oFAAoF;YACpF,eAAe,EAAE,MAAM,CAAC;YACxB;;;eAGG;YACH,cAAc,EAAE,MAAM,CAAC;YACvB;;;eAGG;YACH,GAAG,EAAE,MAAM,CAAC;YACZ,oFAAoF;YACpF,mBAAmB,EAAE,MAAM,CAAC;YAC5B,uFAAuF;YACvF,iBAAiB,EAAE,MAAM,CAAC;YAC1B,gGAAgG;YAChG,iBAAiB,EAAE,MAAM,CAAC;SAC7B,CAAC;QACF;;;WAGG;QACH,qBAAqB,EAAE;YACnB;;;eAGG;YACH,OAAO,EAAE,yBAAyB,CAAC;YACnC;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;SACrB,CAAC;QACF;;;WAGG;QACH,wBAAwB,EAAE;YACtB;;;eAGG;YACH,OAAO,EAAE,gCAAgC,CAAC;YAC1C,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACtD,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC5D;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;SACjB,CAAC;QACF;;;;WAIG;QACH,uBAAuB,EAAE,oBAAoB,GAAG,aAAa,GAAG,mBAAmB,GAAG,UAAU,GAAG,gBAAgB,CAAC;QACpH;;;WAGG;QACH,sBAAsB,EAAE;YACpB,6JAA6J;YAC7J,cAAc,EAAE,MAAM,CAAC;YACvB;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,gBAAgB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,yBAAyB,CAAC,CAAC;YACnE;;;eAGG;YACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;eAGG;YACH,qBAAqB,EAAE,MAAM,CAAC;YAC9B,qHAAqH;YACrH,0BAA0B,CAAC,EAAE,MAAM,CAAC;SACvC,CAAC;QACF;;;;;WAKG;QACH,gBAAgB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC;;;;;WAKG;QACH,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;QAClC;;;WAGG;QACH,YAAY,EAAE;YACV;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,SAAS,CAAC,EAAE,OAAO,CAAC;YACpB;;;eAGG;YACH,UAAU,CAAC,EAAE,OAAO,CAAC;YACrB;;;eAGG;YACH,SAAS,CAAC,EAAE,OAAO,CAAC;YACpB;;;eAGG;YACH,SAAS,CAAC,EAAE,OAAO,CAAC;YACpB,6DAA6D;YAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF;;;WAGG;QACH,aAAa,EAAE;YACX;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd,4DAA4D;YAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,qDAAqD;YACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,uCAAuC;YACvC,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;SACnD,CAAC;QACF;;;WAGG;QACH,YAAY,EAAE;YACV;;;eAGG;YACH,GAAG,EAAE,MAAM,CAAC;YACZ,iDAAiD;YACjD,QAAQ,EAAE,MAAM,CAAC;YACjB,gDAAgD;YAChD,OAAO,EAAE,MAAM,CAAC;SACnB,CAAC;QACF;;;WAGG;QACH,UAAU,EAAE;YACR,4CAA4C;YAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,6CAA6C;YAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,wDAAwD;YACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,wDAAwD;YACxD,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0EAA0E;YAC1E,aAAa,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE;YAC5B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB;;;eAGG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB;;;eAGG;YACH,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;;;;eAKG;YACH,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,2IAA2I;YAC3I,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACrJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE;YAC5B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB;;;eAGG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB;;;eAGG;YACH,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;;;;eAKG;YACH,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,2IAA2I;YAC3I,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACrJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE;YAC5B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB;;;eAGG;YACH,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACrJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,iBAAiB,EAAE,MAAM,CAAC;YAC1B,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE;YAC/B;;;;eAIG;YACH,cAAc,EAAE,MAAM,CAAC;YACvB,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1C;;;eAGG;YACH,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAC9J;;;WAGG;QACH,kCAAkC,EAAE;YAChC;;;;eAIG;YACH,WAAW,EAAE,MAAM,CAAC;YACpB;;;;eAIG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE;YAChC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,SAAS,EAAE;YACP;;;;eAIG;YACH,OAAO,EAAE,MAAM,CAAC;YAChB;;;;eAIG;YACH,MAAM,EAAE,MAAM,CAAC;YACf;;;;eAIG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;;eAIG;YACH,eAAe,EAAE,MAAM,CAAC;YACxB;;;;eAIG;YACH,WAAW,EAAE,MAAM,CAAC;SACvB,CAAC;QACF;;;WAGG;QACH,gCAAgC,EAAE;YAC9B;;;eAGG;YACH,oBAAoB,EAAE,MAAM,CAAC;YAC7B;;;;eAIG;YACH,gBAAgB,EAAE,MAAM,CAAC;YACzB;;;eAGG;YACH,oBAAoB,EAAE,MAAM,CAAC;YAC7B,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;QAC3J;;;WAGG;QACH,iCAAiC,EAAE;YAC/B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE;YAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE;YAC/B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB,6GAA6G;YAC7G,aAAa,EAAE,MAAM,CAAC;YACtB,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAC9J;;;WAGG;QACH,kCAAkC,EAAE;YAChC;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE;YAChC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,mCAAmC,EAAE;YACjC;;;eAGG;YACH,eAAe,EAAE,MAAM,CAAC;YACxB,0GAA0G;YAC1G,aAAa,EAAE,MAAM,CAAC;YACtB,GAAG,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,uBAAuB,CAAC,CAAC;YACrD,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,oCAAoC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;QACpK;;;WAGG;QACH,oCAAoC,EAAE;YAClC;;;;eAIG;YACH,aAAa,EAAE,MAAM,CAAC;YACtB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,oCAAoC,EAAE;YAClC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,qBAAqB,EAAE;YACnB;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;;eAIG;YACH,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB;;;eAGG;YACH,IAAI,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF;;;WAGG;QACH,6BAA6B,EAAE;YAC3B,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;YAC7C;;;eAGG;YACH,KAAK,CAAC,EAAE,MAAM,CAAC;YACf;;;eAGG;YACH,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB;;;eAGG;YACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;YAChC,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACpJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,MAAM,EAAE,UAAU,CAAC;YACnB;;;eAGG;YACH,EAAE,EAAE,MAAM,CAAC;YACX,6IAA6I;YAC7I,cAAc,EAAE,MAAM,CAAC;YACvB,qJAAqJ;YACrJ,aAAa,EAAE,MAAM,CAAC;YACtB;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,gEAAgE;YAChE,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;;;eAIG;YACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;YAChC;;;eAGG;YACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;YAC3B;;;eAGG;YACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,4HAA4H;YAC5H,yBAAyB,CAAC,EAAE,MAAM,CAAC;YACnC,+EAA+E;YAC/E,sBAAsB,CAAC,EAAE,MAAM,CAAC;YAChC,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC9D,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,MAAM,EAAE,UAAU,CAAC;YACnB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;KACL,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;IACjB,UAAU,EAAE,KAAK,CAAC;IAClB,aAAa,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,SAAS,EAAE,KAAK,CAAC;CACpB;AACD,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC1C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC1C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7C,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE;QACL;;;WAGG;QACH,iBAAiB,EAAE;YACf;;;eAGG;YACH,CAAC,EAAE,CAAC,CAAC;YACL;;;eAGG;YACH,IAAI,EAAE,MAAM,CAAC;YACb;;;eAGG;YACH,EAAE,EAAE,MAAM,CAAC;YACX;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,mPAAmP;YACnP,OAAO,EAAE;gBACL,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;aAC1B,CAAC;SACL,CAAC;QACF;;;;;WAKG;QACH,mBAAmB,EAAE,cAAc,GAAG,eAAe,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,aAAa,GAAG,eAAe,GAAG,QAAQ,GAAG,0BAA0B,GAAG,2BAA2B,CAAC;QAChS;;;WAGG;QACH,iBAAiB,EAAE;YACf;;;eAGG;YACH,OAAO,EAAE,uBAAuB,CAAC;YACjC,uFAAuF;YACvF,KAAK,EAAE,MAAM,CAAC;YACd,oEAAoE;YACpE,UAAU,EAAE,MAAM,CAAC;YACnB,0FAA0F;YAC1F,cAAc,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,sBAAsB,EAAE;YACpB,0HAA0H;YAC1H,qBAAqB,EAAE,MAAM,CAAC;YAC9B,oFAAoF;YACpF,eAAe,EAAE,MAAM,CAAC;YACxB;;;eAGG;YACH,cAAc,EAAE,MAAM,CAAC;YACvB;;;eAGG;YACH,GAAG,EAAE,MAAM,CAAC;YACZ,oFAAoF;YACpF,mBAAmB,EAAE,MAAM,CAAC;YAC5B,uFAAuF;YACvF,iBAAiB,EAAE,MAAM,CAAC;YAC1B,gGAAgG;YAChG,iBAAiB,EAAE,MAAM,CAAC;SAC7B,CAAC;QACF;;;WAGG;QACH,qBAAqB,EAAE;YACnB;;;eAGG;YACH,OAAO,EAAE,yBAAyB,CAAC;YACnC;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;SACrB,CAAC;QACF;;;WAGG;QACH,wBAAwB,EAAE;YACtB;;;eAGG;YACH,OAAO,EAAE,gCAAgC,CAAC;YAC1C,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACtD,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC5D;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;SACjB,CAAC;QACF;;;;WAIG;QACH,uBAAuB,EAAE,oBAAoB,GAAG,aAAa,GAAG,mBAAmB,GAAG,UAAU,GAAG,gBAAgB,CAAC;QACpH;;;WAGG;QACH,sBAAsB,EAAE;YACpB,6JAA6J;YAC7J,cAAc,EAAE,MAAM,CAAC;YACvB;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,gBAAgB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,yBAAyB,CAAC,CAAC;YACnE;;;eAGG;YACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;eAGG;YACH,qBAAqB,EAAE,MAAM,CAAC;YAC9B,qHAAqH;YACrH,0BAA0B,CAAC,EAAE,MAAM,CAAC;SACvC,CAAC;QACF;;;;;WAKG;QACH,gBAAgB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC;;;;;WAKG;QACH,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;QAClC;;;WAGG;QACH,YAAY,EAAE;YACV;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,SAAS,CAAC,EAAE,OAAO,CAAC;YACpB;;;eAGG;YACH,UAAU,CAAC,EAAE,OAAO,CAAC;YACrB;;;eAGG;YACH,SAAS,CAAC,EAAE,OAAO,CAAC;YACpB;;;eAGG;YACH,SAAS,CAAC,EAAE,OAAO,CAAC;YACpB,6DAA6D;YAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF;;;WAGG;QACH,aAAa,EAAE;YACX;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd,4DAA4D;YAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,qDAAqD;YACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,uCAAuC;YACvC,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;SACnD,CAAC;QACF;;;WAGG;QACH,YAAY,EAAE;YACV;;;eAGG;YACH,GAAG,EAAE,MAAM,CAAC;YACZ,iDAAiD;YACjD,QAAQ,EAAE,MAAM,CAAC;YACjB,gDAAgD;YAChD,OAAO,EAAE,MAAM,CAAC;SACnB,CAAC;QACF;;;WAGG;QACH,UAAU,EAAE;YACR,4CAA4C;YAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,6CAA6C;YAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,wDAAwD;YACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,wDAAwD;YACxD,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,0EAA0E;YAC1E,aAAa,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE;YAC5B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB;;;eAGG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB;;;eAGG;YACH,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;;;;eAKG;YACH,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,2IAA2I;YAC3I,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACrJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;;eAIG;YACH,OAAO,EAAE,MAAM,CAAC;YAChB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE;YAC5B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB;;;eAGG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB;;;eAGG;YACH,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;;;;eAKG;YACH,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,2IAA2I;YAC3I,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACrJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;;eAIG;YACH,OAAO,EAAE,MAAM,CAAC;YAChB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE;YAC5B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB;;;eAGG;YACH,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACrJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,iBAAiB,EAAE,MAAM,CAAC;YAC1B,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE;YAC/B;;;;eAIG;YACH,cAAc,EAAE,MAAM,CAAC;YACvB,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1C;;;eAGG;YACH,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAC9J;;;WAGG;QACH,kCAAkC,EAAE;YAChC;;;;eAIG;YACH,WAAW,EAAE,MAAM,CAAC;YACpB;;;;eAIG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE;YAChC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,SAAS,EAAE;YACP;;;;eAIG;YACH,OAAO,EAAE,MAAM,CAAC;YAChB;;;;eAIG;YACH,MAAM,EAAE,MAAM,CAAC;YACf;;;;eAIG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;;eAIG;YACH,eAAe,EAAE,MAAM,CAAC;YACxB;;;;eAIG;YACH,WAAW,EAAE,MAAM,CAAC;SACvB,CAAC;QACF;;;WAGG;QACH,gCAAgC,EAAE;YAC9B;;;eAGG;YACH,oBAAoB,EAAE,MAAM,CAAC;YAC7B;;;;eAIG;YACH,gBAAgB,EAAE,MAAM,CAAC;YACzB;;;eAGG;YACH,oBAAoB,EAAE,MAAM,CAAC;YAC7B,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,mCAAmC,CAAC,CAAC;QAC3J;;;WAGG;QACH,iCAAiC,EAAE;YAC/B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE;YAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,iCAAiC,EAAE;YAC/B;;;;eAIG;YACH,QAAQ,EAAE,MAAM,CAAC;YACjB,6GAA6G;YAC7G,aAAa,EAAE,MAAM,CAAC;YACtB,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAC9J;;;WAGG;QACH,kCAAkC,EAAE;YAChC;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,kCAAkC,EAAE;YAChC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,mCAAmC,EAAE;YACjC;;;eAGG;YACH,eAAe,EAAE,MAAM,CAAC;YACxB,0GAA0G;YAC1G,aAAa,EAAE,MAAM,CAAC;YACtB,GAAG,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,uBAAuB,CAAC,CAAC;YACrD,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,oCAAoC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;QACpK;;;WAGG;QACH,oCAAoC,EAAE;YAClC;;;;eAIG;YACH,aAAa,EAAE,MAAM,CAAC;YACtB,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,oCAAoC,EAAE;YAClC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;WAGG;QACH,qBAAqB,EAAE;YACnB;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;;eAIG;YACH,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB;;;eAGG;YACH,IAAI,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF;;;WAGG;QACH,6BAA6B,EAAE;YAC3B,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;YAC7C;;;eAGG;YACH,KAAK,CAAC,EAAE,MAAM,CAAC;YACf;;;eAGG;YACH,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB;;;eAGG;YACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;YAChC,kBAAkB,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;YACjD,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;SACrD,CAAC;QACF;;;WAGG;QACH,8BAA8B,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACpJ;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,MAAM,EAAE,UAAU,CAAC;YACnB;;;eAGG;YACH,EAAE,EAAE,MAAM,CAAC;YACX,6IAA6I;YAC7I,cAAc,EAAE,MAAM,CAAC;YACvB,qJAAqJ;YACrJ,aAAa,EAAE,MAAM,CAAC;YACtB;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB,gEAAgE;YAChE,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;;;eAIG;YACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;YAChC;;;eAGG;YACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;YAC3B;;;eAGG;YACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,4HAA4H;YAC5H,yBAAyB,CAAC,EAAE,MAAM,CAAC;YACnC,+EAA+E;YAC/E,sBAAsB,CAAC,EAAE,MAAM,CAAC;YAChC;;;eAGG;YACH,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,WAAW,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC9D,cAAc,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC;QACF;;;WAGG;QACH,+BAA+B,EAAE;YAC7B;;;eAGG;YACH,MAAM,EAAE,UAAU,CAAC;YACnB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACtD;;;eAGG;YACH,aAAa,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF;;;;;WAKG;QACH,8BAA8B,EAAE,UAAU,GAAG,QAAQ,CAAC;QACtD;;;;;WAKG;QACH,oCAAoC,EAAE,SAAS,CAAC;QAChD;;;;;WAKG;QACH,mCAAmC,EAAE,2CAA2C,CAAC;QACjF;;;WAGG;QACH,sCAAsC,EAAE;YACpC;;;eAGG;YACH,WAAW,EAAE,MAAM,CAAC;YACpB;;;eAGG;YACH,oBAAoB,EAAE,MAAM,CAAC;YAC7B;;;eAGG;YACH,gBAAgB,EAAE,MAAM,CAAC;YACzB,yEAAyE;YACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B;;;eAGG;YACH,4BAA4B,EAAE,MAAM,CAAC;YACrC;;;eAGG;YACH,6BAA6B,EAAE,MAAM,CAAC;YACtC;;;eAGG;YACH,oBAAoB,EAAE,MAAM,CAAC;YAC7B;;;eAGG;YACH,mBAAmB,EAAE,MAAM,CAAC;YAC5B;;;eAGG;YACH,sBAAsB,EAAE,MAAM,CAAC;YAC/B;;;eAGG;YACH,gBAAgB,EAAE,MAAM,CAAC;YACzB;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,SAAS,EAAE,MAAM,CAAC;YAClB;;;eAGG;YACH,UAAU,EAAE,MAAM,CAAC;SACtB,CAAC;QACF;;;WAGG;QACH,uCAAuC,EAAE;YACrC;;;eAGG;YACH,WAAW,EAAE,MAAM,CAAC;YACpB;;;eAGG;YACH,4BAA4B,EAAE,MAAM,CAAC;YACrC;;;eAGG;YACH,6BAA6B,EAAE,MAAM,CAAC;YACtC;;;eAGG;YACH,UAAU,EAAE,MAAM,CAAC;YACnB,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;YAClE;;;eAGG;YACH,UAAU,EAAE,MAAM,CAAC;YACnB;;;eAGG;YACH,KAAK,EAAE,MAAM,CAAC;YACd;;;eAGG;YACH,uBAAuB,EAAE,MAAM,CAAC;YAChC;;;;eAIG;YACH,mBAAmB,EAAE,MAAM,CAAC;YAC5B;;;eAGG;YACH,0BAA0B,EAAE,MAAM,CAAC;YACnC;;;;eAIG;YACH,qBAAqB,EAAE,0BAA0B,CAAC;YAClD;;;eAGG;YACH,oBAAoB,EAAE,MAAM,CAAC;YAC7B;;;eAGG;YACH,mBAAmB,EAAE,MAAM,CAAC;YAC5B;;;eAGG;YACH,gBAAgB,EAAE,MAAM,CAAC;YACzB;;;eAGG;YACH,yBAAyB,EAAE,MAAM,CAAC;YAClC;;;eAGG;YACH,OAAO,EAAE,sCAAsC,CAAC;SACnD,CAAC;QACF;;;WAGG;QACH,uCAAuC,EAAE;YACrC;;;eAGG;YACH,sBAAsB,EAAE,MAAM,CAAC;YAC/B,uBAAuB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,qCAAqC,CAAC,CAAC;YACtF;;;eAGG;YACH,WAAW,EAAE,MAAM,CAAC;YACpB;;;eAGG;YACH,kBAAkB,EAAE,MAAM,CAAC;YAC3B;;;eAGG;YACH,UAAU,EAAE,MAAM,CAAC;YACnB,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,gCAAgC,CAAC,CAAC;YAClE;;;;eAIG;YACH,mBAAmB,EAAE,MAAM,CAAC;YAC5B;;;eAGG;YACH,cAAc,EAAE,MAAM,CAAC;YACvB,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,sCAAsC,CAAC,CAAC;SACzE,CAAC;KACL,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;IACjB,UAAU,EAAE,KAAK,CAAC;IAClB,aAAa,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,SAAS,EAAE,KAAK,CAAC;CACpB;AACD,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC1C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@naughtbot/e2ee-payloads",
3
- "version": "0.1.0",
3
+ "version": "0.3.0",
4
4
  "description": "Generated TypeScript types for the NaughtBot mailbox envelope and per-type payload schemas.",
5
5
  "type": "module",
6
6
  "license": "MIT",
package/src/index.test.ts CHANGED
@@ -6,13 +6,21 @@ import { describe, it } from "node:test";
6
6
 
7
7
  import type {
8
8
  MailboxAgeUnwrapRequestPayloadV1,
9
+ MailboxBrowserApprovalDecisionBindingV1,
10
+ MailboxBrowserApprovalResponsePayloadV1,
11
+ MailboxEnrollResponseApprovedV1,
9
12
  MailboxEnrollResponsePayloadV1,
10
13
  MailboxEnvelopeV1,
11
14
  MailboxGpgDecryptResponseSuccessV1,
15
+ MailboxSshAuthResponseSuccessV1,
12
16
  MailboxSshSignRequestPayloadV1,
13
17
  MailboxSshSignResponsePayloadV1,
18
+ MailboxSshSignResponseSuccessV1,
14
19
  } from "./index.ts";
15
20
 
21
+ const browserApprovalDecisionBindingFixtureJSON =
22
+ '{"approval_id":"appr_browser_approval_fixture","browser_public_key_algorithm":"ES256","browser_public_key_thumbprint":"sha256:8uLz73VtBwmU5O_Jr3r2StpLrNxW41Oq9p6FwR2C7xA","decided_at":"2026-05-14T19:31:00Z","decision":"approved","expires_at":"2026-05-14T19:35:00Z","nonce":"m4H2YxTjueEXAMPLE","pairing_transcript_hash":"sha256:6f5902ac237024bdd0c176cb93063dc4f1e01e1191450b5f8f457c56f48e1f4f","request_envelope_id":"11111111-2222-4333-8444-555555555555","request_envelope_issued_at":"2026-05-14T19:30:00Z","request_envelope_type":"browser_approval_request","requested_capability":"captcha.browser_credential","requester_client_id":"captcha-service","requester_origin":"https://captcha.naughtbot.com","service_mobile_pairing_id":"pair_9d58fb4c6ff84f46","version":"browser-approval-decision-binding/v1"}';
23
+
16
24
  describe("MailboxEnvelopeV1", () => {
17
25
  it("round-trips the literal RFC 3339 issued_at string", () => {
18
26
  const envelope: MailboxEnvelopeV1 = {
@@ -62,9 +70,11 @@ describe("MailboxSshSignRequestPayloadV1", () => {
62
70
 
63
71
  describe("MailboxSshSignResponsePayloadV1", () => {
64
72
  it("decodes success branch by structural narrowing", () => {
65
- const json = '{"signature":"YWJj"}';
73
+ const json = '{"signature":"YWJj","flags":1,"counter":7}';
66
74
  const resp = JSON.parse(json) as MailboxSshSignResponsePayloadV1;
67
75
  assert.ok("signature" in resp && resp.signature !== undefined);
76
+ assert.ok("flags" in resp && resp.flags === 1);
77
+ assert.ok("counter" in resp && resp.counter === 7);
68
78
  assert.ok(!("error_code" in resp) || resp.error_code === undefined);
69
79
  });
70
80
 
@@ -75,6 +85,103 @@ describe("MailboxSshSignResponsePayloadV1", () => {
75
85
  });
76
86
  });
77
87
 
88
+ // Regression test for NaughtBot/e2ee-payloads#17. The SK monotonic counter
89
+ // and per-signature flags byte are now required on both `ssh_auth` and
90
+ // `ssh_sign` success branches. The compile-time bindings below also pin
91
+ // that `counter` and `flags` are required (a regression that makes either
92
+ // optional turns this file into a `tsc` error).
93
+ describe("SSH-SK counter + flags (issue #17)", () => {
94
+ it("requires counter + flags on MailboxSshAuthResponseSuccessV1", () => {
95
+ const success: MailboxSshAuthResponseSuccessV1 = {
96
+ signature: "YWJj",
97
+ flags: 1,
98
+ counter: 7,
99
+ };
100
+ const parsed = JSON.parse(
101
+ JSON.stringify(success),
102
+ ) as MailboxSshAuthResponseSuccessV1;
103
+ assert.equal(parsed.counter, 7);
104
+ assert.equal(parsed.flags, 1);
105
+ assert.equal(parsed.signature, "YWJj");
106
+
107
+ // u32 max counter + u8 max flags round-trip without overflow.
108
+ const maxBoundary: MailboxSshAuthResponseSuccessV1 = {
109
+ signature: "YWJj",
110
+ flags: 255,
111
+ counter: 4294967295,
112
+ };
113
+ const parsedMax = JSON.parse(
114
+ JSON.stringify(maxBoundary),
115
+ ) as MailboxSshAuthResponseSuccessV1;
116
+ assert.equal(parsedMax.counter, 4294967295);
117
+ assert.equal(parsedMax.flags, 255);
118
+ });
119
+
120
+ it("requires counter + flags on MailboxSshSignResponseSuccessV1", () => {
121
+ const success: MailboxSshSignResponseSuccessV1 = {
122
+ signature: "YWJj",
123
+ flags: 1,
124
+ counter: 42,
125
+ };
126
+ const parsed = JSON.parse(
127
+ JSON.stringify(success),
128
+ ) as MailboxSshSignResponseSuccessV1;
129
+ assert.equal(parsed.counter, 42);
130
+ assert.equal(parsed.flags, 1);
131
+ });
132
+ });
133
+
134
+ describe("MailboxBrowserApprovalDecisionBindingV1", () => {
135
+ it("matches the cross-language canonical JSON fixture", () => {
136
+ const binding: MailboxBrowserApprovalDecisionBindingV1 = {
137
+ approval_id: "appr_browser_approval_fixture",
138
+ browser_public_key_algorithm: "ES256",
139
+ browser_public_key_thumbprint:
140
+ "sha256:8uLz73VtBwmU5O_Jr3r2StpLrNxW41Oq9p6FwR2C7xA",
141
+ decided_at: "2026-05-14T19:31:00Z",
142
+ decision: "approved",
143
+ expires_at: "2026-05-14T19:35:00Z",
144
+ nonce: "m4H2YxTjueEXAMPLE",
145
+ pairing_transcript_hash:
146
+ "sha256:6f5902ac237024bdd0c176cb93063dc4f1e01e1191450b5f8f457c56f48e1f4f",
147
+ request_envelope_id: "11111111-2222-4333-8444-555555555555",
148
+ request_envelope_issued_at: "2026-05-14T19:30:00Z",
149
+ request_envelope_type: "browser_approval_request",
150
+ requested_capability: "captcha.browser_credential",
151
+ requester_client_id: "captcha-service",
152
+ requester_origin: "https://captcha.naughtbot.com",
153
+ service_mobile_pairing_id: "pair_9d58fb4c6ff84f46",
154
+ version: "browser-approval-decision-binding/v1",
155
+ };
156
+ const json = JSON.stringify(binding);
157
+ assert.equal(json, browserApprovalDecisionBindingFixtureJSON);
158
+
159
+ const response: MailboxBrowserApprovalResponsePayloadV1 = {
160
+ approval_binding_bytes: Buffer.from(json, "utf8").toString("base64"),
161
+ approval_binding_format: "browser-approval-decision-binding/v1+json",
162
+ approval_id: binding.approval_id,
163
+ approval_signature: Buffer.from(
164
+ "approval-signature-fixture",
165
+ "utf8",
166
+ ).toString("base64"),
167
+ decided_at: binding.decided_at,
168
+ decision: binding.decision,
169
+ request_envelope_id: binding.request_envelope_id,
170
+ signing_key_id: "mobile-key-browser-approval-1",
171
+ status: "decided",
172
+ };
173
+ const parsed = JSON.parse(
174
+ JSON.stringify(response),
175
+ ) as MailboxBrowserApprovalResponsePayloadV1;
176
+ assert.equal(
177
+ Buffer.from(parsed.approval_binding_bytes, "base64").toString("utf8"),
178
+ browserApprovalDecisionBindingFixtureJSON,
179
+ );
180
+ assert.equal(parsed.decision, "approved");
181
+ assert.equal(parsed.status, "decided");
182
+ });
183
+ });
184
+
78
185
  describe("MailboxGpgDecryptResponseSuccessV1", () => {
79
186
  it("requires both session_key and algorithm on success", () => {
80
187
  // Bind to the success branch directly so the compile-time check is
@@ -133,4 +240,37 @@ describe("MailboxEnrollResponsePayloadV1", () => {
133
240
  assert.equal(rejected.error_code, 1);
134
241
  }
135
242
  });
243
+
244
+ // Regression test for NaughtBot/e2ee-payloads#17. The per-credential
245
+ // SSH-SK flags byte must be carried back to the requester on approved
246
+ // SSH-SK enrollments so the requester can rebuild the OpenSSH SK
247
+ // signature preimage on every subsequent `ssh_auth` / `ssh_sign` call.
248
+ it("round-trips per-credential ssh_sk_flags on SSH-SK enrollments", () => {
249
+ const approved: MailboxEnrollResponseApprovedV1 = {
250
+ status: "approved",
251
+ id: "550e8400-e29b-41d4-a716-446655440000",
252
+ public_key_hex:
253
+ "02a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
254
+ device_key_id: "dev-1",
255
+ algorithm: "ed25519",
256
+ ssh_sk_flags: 5, // 0x05 = user presence + user verification
257
+ };
258
+ const json = JSON.stringify(approved);
259
+ assert.ok(json.includes('"ssh_sk_flags":5'));
260
+ const parsed = JSON.parse(json) as MailboxEnrollResponseApprovedV1;
261
+ assert.equal(parsed.ssh_sk_flags, 5);
262
+
263
+ // Non-SSH enrollments omit the field; verify the surface stays
264
+ // optional (a regression that makes it required turns this into a
265
+ // `tsc` error rather than a silent on-the-wire change).
266
+ const noFlags: MailboxEnrollResponseApprovedV1 = {
267
+ status: "approved",
268
+ id: "550e8400-e29b-41d4-a716-446655440000",
269
+ public_key_hex:
270
+ "02a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
271
+ device_key_id: "dev-1",
272
+ algorithm: "ed25519",
273
+ };
274
+ assert.ok(!JSON.stringify(noFlags).includes("ssh_sk_flags"));
275
+ });
136
276
  });
package/src/index.ts CHANGED
@@ -38,3 +38,9 @@ export type MailboxEnrollRequestPayloadV1 = components["schemas"]["MailboxEnroll
38
38
  export type MailboxEnrollResponsePayloadV1 = components["schemas"]["MailboxEnrollResponsePayloadV1"];
39
39
  export type MailboxEnrollResponseApprovedV1 = components["schemas"]["MailboxEnrollResponseApprovedV1"];
40
40
  export type MailboxEnrollResponseRejectedV1 = components["schemas"]["MailboxEnrollResponseRejectedV1"];
41
+ export type MailboxBrowserApprovalDecision = components["schemas"]["MailboxBrowserApprovalDecision"];
42
+ export type MailboxBrowserApprovalResponseStatus = components["schemas"]["MailboxBrowserApprovalResponseStatus"];
43
+ export type MailboxBrowserApprovalBindingFormat = components["schemas"]["MailboxBrowserApprovalBindingFormat"];
44
+ export type MailboxBrowserApprovalRequestPayloadV1 = components["schemas"]["MailboxBrowserApprovalRequestPayloadV1"];
45
+ export type MailboxBrowserApprovalDecisionBindingV1 = components["schemas"]["MailboxBrowserApprovalDecisionBindingV1"];
46
+ export type MailboxBrowserApprovalResponsePayloadV1 = components["schemas"]["MailboxBrowserApprovalResponsePayloadV1"];
package/src/schema.ts CHANGED
@@ -43,7 +43,7 @@ export interface components {
43
43
  * @example ssh_sign
44
44
  * @enum {string}
45
45
  */
46
- MailboxEnvelopeType: "link_request" | "link_approval" | "link_rejection" | "captcha_request" | "captcha_response" | "ssh_auth" | "ssh_sign" | "gpg_sign" | "gpg_decrypt" | "age_unwrap" | "pkcs11_sign" | "pkcs11_derive" | "enroll";
46
+ MailboxEnvelopeType: "link_request" | "link_approval" | "link_rejection" | "captcha_request" | "captcha_response" | "ssh_auth" | "ssh_sign" | "gpg_sign" | "gpg_decrypt" | "age_unwrap" | "pkcs11_sign" | "pkcs11_derive" | "enroll" | "browser_approval_request" | "browser_approval_response";
47
47
  /**
48
48
  * ApprovalChallenge
49
49
  * @description Canonical Longfellow / attested-key-zk approval challenge. Producer sends this inside the request payload; the approver binds it into the approval proof returned in the response payload.
@@ -306,7 +306,7 @@ export interface components {
306
306
  MailboxSshAuthResponsePayloadV1: components["schemas"]["MailboxSshAuthResponseSuccessV1"] | components["schemas"]["MailboxSshAuthResponseFailureV1"];
307
307
  /**
308
308
  * MailboxSshAuthResponseSuccessV1
309
- * @description Success branch of `MailboxSshAuthResponsePayloadV1`.
309
+ * @description Success branch of `MailboxSshAuthResponsePayloadV1`. Carries the raw SSH signature plus the per-signature SK assertion flags byte and monotonic counter the signer's secure element returned for this signing operation; all three are required so the requester can rebuild the OpenSSH SK signature preimage (`SHA256(application) || flags || counter || SHA256(data)`) and verify against the enrolled credential public key.
310
310
  */
311
311
  MailboxSshAuthResponseSuccessV1: {
312
312
  /**
@@ -314,6 +314,17 @@ export interface components {
314
314
  * @description RFC 4648 standard base64 with `=` padding for the raw SSH signature blob (no SSH-wire framing).
315
315
  */
316
316
  signature: string;
317
+ /**
318
+ * @description Per-signature SK assertion flags byte the signer's secure element actually asserted with. Approvers MUST either (a) assert with at least the bits the request `flags` byte asked for (UP=0x01, UV=0x04) and return the resulting byte here, or (b) return a `MailboxSshAuthResponseFailureV1` / `MailboxSshSignResponseFailureV1` with the appropriate signing error code. Approvers MUST NOT return a success response whose asserted flags byte clears bits the requester set; that would silently downgrade the security posture (e.g. UV-required → UP-only) below what the request agreed to. Receivers MUST embed this asserted byte at the `flags` position of the OpenSSH SK signature preimage; verification fails if the request `flags` byte is used instead. Receivers SHOULD additionally verify that every bit set in the request `flags` byte is also set here as belt-and-suspenders defence against a misbehaving approver.
319
+ * @example 1
320
+ */
321
+ flags: number;
322
+ /**
323
+ * Format: int64
324
+ * @description Monotonic counter (u32) the signer's secure element returned for this SK signing operation. Receivers MUST embed this in the OpenSSH SK signature preimage at the position between `flags` and `SHA256(data)` as a 4-byte big-endian unsigned integer. Successive signatures from the same key handle MUST have strictly increasing counter values. The schema declares `format: int64` so 32-bit Go targets can still represent the full u32 range without overflow.
325
+ * @example 1
326
+ */
327
+ counter: number;
317
328
  approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
318
329
  };
319
330
  /**
@@ -369,7 +380,7 @@ export interface components {
369
380
  MailboxSshSignResponsePayloadV1: components["schemas"]["MailboxSshSignResponseSuccessV1"] | components["schemas"]["MailboxSshSignResponseFailureV1"];
370
381
  /**
371
382
  * MailboxSshSignResponseSuccessV1
372
- * @description Success branch of `MailboxSshSignResponsePayloadV1`.
383
+ * @description Success branch of `MailboxSshSignResponsePayloadV1`. Carries the raw SSH signature plus the per-signature SK assertion flags byte and monotonic counter the signer's secure element returned for this signing operation; all three are required so the requester can rebuild the OpenSSH SK signature preimage (`SHA256(application) || flags || counter || SHA256(data)`) and verify against the enrolled credential public key.
373
384
  */
374
385
  MailboxSshSignResponseSuccessV1: {
375
386
  /**
@@ -377,6 +388,17 @@ export interface components {
377
388
  * @description RFC 4648 standard base64 with `=` padding for the raw SSH signature blob (no SSH-wire framing).
378
389
  */
379
390
  signature: string;
391
+ /**
392
+ * @description Per-signature SK assertion flags byte the signer's secure element actually asserted with. Approvers MUST either (a) assert with at least the bits the request `flags` byte asked for (UP=0x01, UV=0x04) and return the resulting byte here, or (b) return a `MailboxSshAuthResponseFailureV1` / `MailboxSshSignResponseFailureV1` with the appropriate signing error code. Approvers MUST NOT return a success response whose asserted flags byte clears bits the requester set; that would silently downgrade the security posture (e.g. UV-required → UP-only) below what the request agreed to. Receivers MUST embed this asserted byte at the `flags` position of the OpenSSH SK signature preimage; verification fails if the request `flags` byte is used instead. Receivers SHOULD additionally verify that every bit set in the request `flags` byte is also set here as belt-and-suspenders defence against a misbehaving approver.
393
+ * @example 1
394
+ */
395
+ flags: number;
396
+ /**
397
+ * Format: int64
398
+ * @description Monotonic counter (u32) the signer's secure element returned for this SK signing operation. Receivers MUST embed this in the OpenSSH SK signature preimage at the position between `flags` and `SHA256(data)` as a 4-byte big-endian unsigned integer. Successive signatures from the same key handle MUST have strictly increasing counter values. The schema declares `format: int64` so 32-bit Go targets can still represent the full u32 range without overflow.
399
+ * @example 1
400
+ */
401
+ counter: number;
380
402
  approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
381
403
  };
382
404
  /**
@@ -779,6 +801,11 @@ export interface components {
779
801
  encryption_public_key_hex?: string;
780
802
  /** @description 40-character hex fingerprint of the ECDH encryption subkey. */
781
803
  encryption_fingerprint?: string;
804
+ /**
805
+ * @description Per-credential SSH-SK flags byte the approver baked into a newly enrolled SSH security-key credential. **MUST be present when `purpose` is the SSH signing purpose; absent for all other key purposes.** (The schema cannot express that conditional requirement directly because `MailboxEnrollResponseApprovedV1` is a single monolithic shape with per-type-optional fields like `fingerprint` / `encryption_public_key_hex`; requesters MUST reject SSH-purpose approved responses that omit this field.) The requester MUST persist this byte alongside the credential public key and use it as the request `flags` input on every subsequent `ssh_auth` / `ssh_sign` call. The approver echoes the actual per-signature assertion flags byte back in the success response (see `MailboxSshAuthResponseSuccessV1.flags`); that asserted byte (which MAY differ from this enrollment flags byte when, e.g., the SK could not deliver user verification) is what the requester MUST embed into the OpenSSH SK signature preimage `SHA256(application) || flags || counter || SHA256(data)`. Bit `0x01` is "user presence required" and `0x04` is "user verification required" per the OpenSSH SK protocol.
806
+ * @example 1
807
+ */
808
+ ssh_sk_flags?: number;
782
809
  attestation?: components["schemas"]["KeyMetadataAttestation"];
783
810
  approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
784
811
  };
@@ -799,6 +826,219 @@ export interface components {
799
826
  */
800
827
  error_message?: string;
801
828
  };
829
+ /**
830
+ * MailboxBrowserApprovalDecision
831
+ * @description Mobile user's signed approval decision.
832
+ * @example approved
833
+ * @enum {string}
834
+ */
835
+ MailboxBrowserApprovalDecision: "approved" | "denied";
836
+ /**
837
+ * MailboxBrowserApprovalResponseStatus
838
+ * @description Response lifecycle status. The signed `decision` carries the approval outcome.
839
+ * @example decided
840
+ * @enum {string}
841
+ */
842
+ MailboxBrowserApprovalResponseStatus: "decided";
843
+ /**
844
+ * MailboxBrowserApprovalBindingFormat
845
+ * @description Canonical byte format signed by the mobile approval key.
846
+ * @example browser-approval-decision-binding/v1+json
847
+ * @enum {string}
848
+ */
849
+ MailboxBrowserApprovalBindingFormat: "browser-approval-decision-binding/v1+json";
850
+ /**
851
+ * MailboxBrowserApprovalRequestPayloadV1
852
+ * @description Request payload for the `browser_approval_request` envelope type. A service requester sends this to the paired mobile device when a browser key needs approval for a generic capability.
853
+ */
854
+ MailboxBrowserApprovalRequestPayloadV1: {
855
+ /**
856
+ * @description Opaque service-scoped approval id.
857
+ * @example appr_2af7b1fb2b5b4b5b8c7e9a0d
858
+ */
859
+ approval_id: string;
860
+ /**
861
+ * @description Human-readable browser/device label shown to the mobile user.
862
+ * @example Chrome on MacBook Pro
863
+ */
864
+ browser_display_name: string;
865
+ /**
866
+ * @description Best-effort browser platform hint shown to the mobile user.
867
+ * @example macOS
868
+ */
869
+ browser_platform: string;
870
+ /** @description Optional user-agent hint for display and diagnostics. */
871
+ browser_user_agent?: string;
872
+ /**
873
+ * @description Browser public key algorithm identifier, e.g. `ES256` or `Ed25519`.
874
+ * @example ES256
875
+ */
876
+ browser_public_key_algorithm: string;
877
+ /**
878
+ * @description Thumbprint of the browser public key being approved. Producers SHOULD use `sha256:<base64url-no-padding>` for JWK thumbprints.
879
+ * @example sha256:8uLz73VtBwmU5O_Jr3r2StpLrNxW41Oq9p6FwR2C7xA
880
+ */
881
+ browser_public_key_thumbprint: string;
882
+ /**
883
+ * @description Generic capability requested by the service.
884
+ * @example captcha.browser_credential
885
+ */
886
+ requested_capability: string;
887
+ /**
888
+ * @description Service/requester client id that created the approval request.
889
+ * @example captcha-service
890
+ */
891
+ requester_client_id: string;
892
+ /**
893
+ * @description Human-readable requester name shown to the mobile user.
894
+ * @example NaughtBot Captcha
895
+ */
896
+ requester_display_name: string;
897
+ /**
898
+ * @description Origin of the requester that will receive/use the browser credential.
899
+ * @example https://captcha.naughtbot.com
900
+ */
901
+ requester_origin: string;
902
+ /**
903
+ * @description Opaque nonce bound into the mobile-signed decision.
904
+ * @example m4H2YxTjueEXAMPLE
905
+ */
906
+ nonce: string;
907
+ /**
908
+ * @description RFC 3339 UTC timestamp with canonical `Z` suffix.
909
+ * @example 2026-05-14T19:30:00Z
910
+ */
911
+ issued_at: string;
912
+ /**
913
+ * @description RFC 3339 UTC timestamp after which the request is invalid.
914
+ * @example 2026-05-14T19:35:00Z
915
+ */
916
+ expires_at: string;
917
+ };
918
+ /**
919
+ * MailboxBrowserApprovalDecisionBindingV1
920
+ * @description Canonical JSON object whose UTF-8 bytes are signed by the mobile approval key. Producers encode these fields in lexicographic property order with no insignificant whitespace and place the resulting bytes in `MailboxBrowserApprovalResponsePayloadV1.approval_binding_bytes`.
921
+ */
922
+ MailboxBrowserApprovalDecisionBindingV1: {
923
+ /**
924
+ * @description Approval id copied from the request payload.
925
+ * @example appr_2af7b1fb2b5b4b5b8c7e9a0d
926
+ */
927
+ approval_id: string;
928
+ /**
929
+ * @description Browser public key algorithm copied from the request payload.
930
+ * @example ES256
931
+ */
932
+ browser_public_key_algorithm: string;
933
+ /**
934
+ * @description Browser public key thumbprint copied from the request payload.
935
+ * @example sha256:8uLz73VtBwmU5O_Jr3r2StpLrNxW41Oq9p6FwR2C7xA
936
+ */
937
+ browser_public_key_thumbprint: string;
938
+ /**
939
+ * @description RFC 3339 UTC timestamp of the mobile decision.
940
+ * @example 2026-05-14T19:31:00Z
941
+ */
942
+ decided_at: string;
943
+ decision: components["schemas"]["MailboxBrowserApprovalDecision"];
944
+ /**
945
+ * @description Request expiry copied from the request payload.
946
+ * @example 2026-05-14T19:35:00Z
947
+ */
948
+ expires_at: string;
949
+ /**
950
+ * @description Nonce copied from the request payload.
951
+ * @example m4H2YxTjueEXAMPLE
952
+ */
953
+ nonce: string;
954
+ /**
955
+ * @description SHA-256 hash of the service-mobile pairing transcript.
956
+ * @example sha256:6f5902ac237024bdd0c176cb93063dc4f1e01e1191450b5f8f457c56f48e1f4f
957
+ */
958
+ pairing_transcript_hash: string;
959
+ /**
960
+ * Format: uuid
961
+ * @description Envelope id of the browser approval request being answered.
962
+ * @example 11111111-2222-4333-8444-555555555555
963
+ */
964
+ request_envelope_id: string;
965
+ /**
966
+ * @description Envelope `issued_at` timestamp of the request being answered.
967
+ * @example 2026-05-14T19:30:00Z
968
+ */
969
+ request_envelope_issued_at: string;
970
+ /**
971
+ * @description Envelope type of the request being answered.
972
+ * @example browser_approval_request
973
+ * @enum {string}
974
+ */
975
+ request_envelope_type: "browser_approval_request";
976
+ /**
977
+ * @description Requested capability copied from the request payload.
978
+ * @example captcha.browser_credential
979
+ */
980
+ requested_capability: string;
981
+ /**
982
+ * @description Requester client id copied from the request payload.
983
+ * @example captcha-service
984
+ */
985
+ requester_client_id: string;
986
+ /**
987
+ * @description Requester origin copied from the request payload.
988
+ * @example https://captcha.naughtbot.com
989
+ */
990
+ requester_origin: string;
991
+ /**
992
+ * @description Stable id for the service-mobile E2EE mailbox pairing.
993
+ * @example pair_9d58fb4c6ff84f46
994
+ */
995
+ service_mobile_pairing_id: string;
996
+ /**
997
+ * @description Canonical decision binding schema version.
998
+ * @enum {string}
999
+ */
1000
+ version: "browser-approval-decision-binding/v1";
1001
+ };
1002
+ /**
1003
+ * MailboxBrowserApprovalResponsePayloadV1
1004
+ * @description Response payload for the `browser_approval_response` envelope type. The response carries the mobile decision plus the exact canonical bytes and signature over `MailboxBrowserApprovalDecisionBindingV1`.
1005
+ */
1006
+ MailboxBrowserApprovalResponsePayloadV1: {
1007
+ /**
1008
+ * Format: byte
1009
+ * @description RFC 4648 standard base64 with `=` padding for the canonical `MailboxBrowserApprovalDecisionBindingV1` UTF-8 JSON bytes.
1010
+ */
1011
+ approval_binding_bytes: string;
1012
+ approval_binding_format: components["schemas"]["MailboxBrowserApprovalBindingFormat"];
1013
+ /**
1014
+ * @description Approval id copied from the request payload.
1015
+ * @example appr_2af7b1fb2b5b4b5b8c7e9a0d
1016
+ */
1017
+ approval_id: string;
1018
+ /**
1019
+ * Format: byte
1020
+ * @description RFC 4648 standard base64 with `=` padding for the signature over `approval_binding_bytes`.
1021
+ */
1022
+ approval_signature: string;
1023
+ /**
1024
+ * @description RFC 3339 UTC timestamp of the mobile decision.
1025
+ * @example 2026-05-14T19:31:00Z
1026
+ */
1027
+ decided_at: string;
1028
+ decision: components["schemas"]["MailboxBrowserApprovalDecision"];
1029
+ /**
1030
+ * Format: uuid
1031
+ * @description Envelope id of the browser approval request being answered.
1032
+ * @example 11111111-2222-4333-8444-555555555555
1033
+ */
1034
+ request_envelope_id: string;
1035
+ /**
1036
+ * @description Mobile signing key id that produced `approval_signature`.
1037
+ * @example mobile-key-browser-approval-1
1038
+ */
1039
+ signing_key_id: string;
1040
+ status: components["schemas"]["MailboxBrowserApprovalResponseStatus"];
1041
+ };
802
1042
  };
803
1043
  responses: never;
804
1044
  parameters: never;