@naughtbot/e2ee-payloads 0.1.0

package/src/schema.ts

@@ -0,0 +1,810 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export type paths = Record<string, never>;
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /**
+         * MailboxEnvelopeV1
+         * @description Typed plaintext envelope for NaughtBot mailbox payloads. Receivers dispatch on `type`. The schema is documentary — the auth/mailbox backend never sees the envelope (it is inside HPKE plaintext) and no endpoint accepts it directly. See `core/memories/mailbox-envelope.md` for the canonical decode rules until that memory migrates here with the rest of the schema-relocation follow-up.
+         */
+        MailboxEnvelopeV1: {
+            /**
+             * @description Envelope version. Receivers reject unknown versions.
+             * @enum {integer}
+             */
+            v: 1;
+            /**
+             * @description Registered type discriminator. Receivers SHOULD validate against the `MailboxEnvelopeType` registry enum at runtime; unknown values MUST be logged and dropped without rejecting the envelope.
+             * @example ssh_sign
+             */
+            type: string;
+            /**
+             * Format: uuid
+             * @description Canonical lower-case RFC 4122 UUID string for idempotency / dedup on the receiver.
+             */
+            id: string;
+            /**
+             * @description RFC 3339 UTC timestamp with the canonical `Z` suffix. Senders SHOULD emit fractional seconds (`2026-05-03T05:00:00.123Z`); receivers MUST also accept the plain second-precision form (`2026-05-03T05:00:00Z`). Times outside UTC and timestamps lacking the `T` delimiter are rejected.
+             * @example 2026-05-03T05:00:00.123Z
+             */
+            issued_at: string;
+            /** @description Type-specific payload, MUST be a JSON object (`{...}`); scalar / array / string roots are not valid envelopes. The internal schema is validated by the per-`type` handler defined under `payloads/`, not by the envelope codec. */
+            payload: {
+                [key: string]: unknown;
+            };
+        };
+        /**
+         * MailboxEnvelopeType
+         * @description Registered set of envelope `type` discriminators. Receivers may decode the envelope successfully but log+drop on unknown values. Adding a new type requires adding it here and shipping the matching payload schema under `payloads/<surface>.yaml`.
+         * @example ssh_sign
+         * @enum {string}
+         */
+        MailboxEnvelopeType: "link_request" | "link_approval" | "link_rejection" | "captcha_request" | "captcha_response" | "ssh_auth" | "ssh_sign" | "gpg_sign" | "gpg_decrypt" | "age_unwrap" | "pkcs11_sign" | "pkcs11_derive" | "enroll";
+        /**
+         * ApprovalChallenge
+         * @description Canonical Longfellow / attested-key-zk approval challenge. Producer sends this inside the request payload; the approver binds it into the approval proof returned in the response payload.
+         */
+        ApprovalChallenge: {
+            /**
+             * @description Canonical approval challenge format version.
+             * @enum {string}
+             */
+            version: "approval-challenge/v1";
+            /** @description Opaque nonce bound into the approval challenge and proof statement. */
+            nonce: string;
+            /** @description Relay request id that scopes the approval proof. */
+            request_id: string;
+            /** @description SHA-256 digest of the approved plaintext, formatted as `sha256:<hex>`. */
+            plaintext_hash: string;
+        };
+        /**
+         * ApprovalProofStatement
+         * @description Public Longfellow statement bound into the zero-knowledge proof.
+         */
+        ApprovalProofStatement: {
+            /** @description Lowercase hex-encoded compressed P-256 issuer public key (66 hex chars, 33 bytes: `0x02`/`0x03` || X). */
+            issuer_public_key_hex: string;
+            /** @description Lowercase hex-encoded SHA-256 hash of the mobile app identifier. */
+            app_id_hash_hex: string;
+            /**
+             * Format: int32
+             * @description Policy version embedded into the approval proof statement.
+             */
+            policy_version: number;
+            /**
+             * Format: int64
+             * @description Unix timestamp in seconds embedded into the approval proof statement.
+             */
+            now: number;
+            /** @description Lowercase hex-encoded SHA-256 hash of `ApprovalChallenge.nonce`. */
+            challenge_nonce_hex: string;
+            /** @description Lowercase hex-encoded SHA-256 hash of the verifier audience string. */
+            audience_hash_hex: string;
+            /** @description Lowercase hex-encoded SHA-256 hash of the canonical approval challenge JSON. */
+            approval_hash_hex: string;
+        };
+        /**
+         * ApprovalAttestationV1
+         * @description Service-issued approval attestation embedded into the Longfellow proof witness.
+         */
+        ApprovalAttestationV1: {
+            /**
+             * @description Canonical approval attestation format version.
+             * @enum {string}
+             */
+            version: "approval-attestation/v1";
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the `approval-attestation/v1` bytes embedded into the Longfellow proof witness.
+             */
+            bytes: string;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw 64-byte P-256 `r || s` signature over `SHA256(bytes)`.
+             */
+            signature: string;
+        };
+        /**
+         * ApprovalAttestedKeyProof
+         * @description Canonical Longfellow approval proof carried inside encrypted approval responses.
+         */
+        ApprovalAttestedKeyProof: {
+            /**
+             * @description Canonical approval proof format version.
+             * @enum {string}
+             */
+            version: "approval-attested-key-proof/v1";
+            challenge: components["schemas"]["ApprovalChallenge"];
+            statement: components["schemas"]["ApprovalProofStatement"];
+            attestation: components["schemas"]["ApprovalAttestationV1"];
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the Longfellow approval proof bytes.
+             */
+            proof: string;
+        };
+        /**
+         * AttestationSecurityType
+         * @description Combined platform and security level for attestation.
+         * @enum {string}
+         */
+        AttestationSecurityType: "ios_secure_enclave" | "android_tee" | "android_strongbox" | "software" | "play_integrity";
+        /**
+         * KeyMetadataAttestation
+         * @description Attestation proof that a key was created on attested device hardware.
+         */
+        KeyMetadataAttestation: {
+            /** @description Lowercase hex-encoded public key being attested (66 hex chars for P-256 33-byte compressed key, or 64 hex chars for Ed25519 32-byte key). */
+            public_key_hex: string;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the App Attest assertion or software signature.
+             */
+            assertion: string;
+            attestation_type: components["schemas"]["AttestationSecurityType"];
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the Apple CBOR attestation object used by hardware attestation.
+             */
+            attestation_object?: string;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for `SHA256(id || public_key || created_at || device_auth_public_key)`.
+             */
+            challenge: string;
+            /**
+             * Format: int64
+             * @description Unix timestamp in milliseconds.
+             */
+            attestation_timestamp: number;
+            /** @description Lowercase hex-encoded attestation key public key (66 hex chars for P-256 33-byte compressed key). */
+            attestation_public_key_hex?: string;
+        };
+        /**
+         * SigningErrorCode
+         * @description Numeric error code returned in `*ResponsePayloadV1.error_code` when an approval flow fails. `1=rejected`, `2=timeout`, `3=key_not_found`, `4=invalid_payload`, `5=attestation_failed`, `6=internal_error`.
+         * @example 1
+         * @enum {integer}
+         */
+        SigningErrorCode: 1 | 2 | 3 | 4 | 5 | 6;
+        /**
+         * KeyPurpose
+         * @description Purpose of an enrolled key.
+         * @example ssh
+         * @enum {string}
+         */
+        KeyPurpose: "ssh" | "gpg" | "age";
+        /**
+         * DisplayField
+         * @description A single label/value row rendered on the approval surface.
+         */
+        DisplayField: {
+            /**
+             * @description Short label for the field.
+             * @example Repository
+             */
+            label: string;
+            /**
+             * @description Value to display.
+             * @example github.com/user/repo
+             */
+            value: string;
+            /**
+             * @description Render the value in a monospace font.
+             * @default false
+             */
+            monospace?: boolean;
+            /**
+             * @description Field can be expanded to show additional content.
+             * @default false
+             */
+            expandable?: boolean;
+            /**
+             * @description Render the value across multiple lines.
+             * @default false
+             */
+            multiline?: boolean;
+            /**
+             * @description Value contains sensitive information; UI may mask it.
+             * @default false
+             */
+            sensitive?: boolean;
+            /** @description Optional SF Symbol or Material icon name. */
+            icon?: string;
+        };
+        /**
+         * DisplaySchema
+         * @description Optional approval-UI metadata. Producers populate this on a best-effort basis; approvers MUST render the wire payload regardless of presence.
+         */
+        DisplaySchema: {
+            /**
+             * @description Main title for the approval screen.
+             * @example Sign Git Commit
+             */
+            title: string;
+            /** @description Shorter title for the history list view. */
+            history_title?: string;
+            /** @description Subtitle with additional context. */
+            subtitle?: string;
+            /** @description Optional icon name. */
+            icon?: string;
+            fields: components["schemas"]["DisplayField"][];
+        };
+        /**
+         * ProcessEntry
+         * @description Entry in a process ancestry chain.
+         */
+        ProcessEntry: {
+            /**
+             * Format: int32
+             * @description Process id.
+             */
+            pid: number;
+            /** @description Username running the process. */
+            username: string;
+            /** @description Command line of the process. */
+            command: string;
+        };
+        /**
+         * SourceInfo
+         * @description Optional context about the requesting system. Producers populate this on a best-effort basis; approvers MUST NOT make security decisions on unauthenticated source metadata.
+         */
+        SourceInfo: {
+            /** @description Source machine hostname. */
+            hostname?: string;
+            /** @description Local/private IP address. */
+            local_ip?: string;
+            /** @description User running the requesting process. */
+            username?: string;
+            /** @description Command line of the current process. */
+            command?: string;
+            /** @description Full process tree from the current process up to init. */
+            process_chain?: components["schemas"]["ProcessEntry"][];
+        };
+        /**
+         * MailboxSshAuthRequestPayloadV1
+         * @description Request payload for the `ssh_auth` envelope type. The approver signs an SSH user-authentication challenge constructed from `raw_data`, using the on-device key selected by `device_key_id`.
+         */
+        MailboxSshAuthRequestPayloadV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw SSH challenge preimage. The approver builds the canonical SSH signature input from this preimage.
+             * @example c3NoIGNoYWxsZW5nZQ==
+             */
+            raw_data: string;
+            /**
+             * @description Identifier of the key to sign with.
+             * @example key_abc123
+             */
+            key_id?: string;
+            /**
+             * @description SSH application identifier (e.g. `ssh:`).
+             * @example ssh:
+             */
+            application?: string;
+            /**
+             * Format: int32
+             * @description SSH SK flags bitmask. Default `0x01` requires user presence.
+             * @default 1
+             * @example 1
+             */
+            flags?: number;
+            /** @description Device-side key identifier (e.g. iOS Secure Enclave handle) used to select among enrolled signing keys on the approver. */
+            device_key_id: string;
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            display?: components["schemas"]["DisplaySchema"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxSshAuthResponsePayloadV1
+         * @description Response payload for the `ssh_auth` envelope type. Discriminated as a success / failure pair. Decoders pick `MailboxSshAuthResponseSuccessV1` if `signature` is present and `MailboxSshAuthResponseFailureV1` if `error_code` is present.
+         */
+        MailboxSshAuthResponsePayloadV1: components["schemas"]["MailboxSshAuthResponseSuccessV1"] | components["schemas"]["MailboxSshAuthResponseFailureV1"];
+        /**
+         * MailboxSshAuthResponseSuccessV1
+         * @description Success branch of `MailboxSshAuthResponsePayloadV1`.
+         */
+        MailboxSshAuthResponseSuccessV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw SSH signature blob (no SSH-wire framing).
+             */
+            signature: string;
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxSshAuthResponseFailureV1
+         * @description Failure branch of `MailboxSshAuthResponsePayloadV1`.
+         */
+        MailboxSshAuthResponseFailureV1: {
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the request
+             */
+            error_message?: string;
+        };
+        /**
+         * MailboxSshSignRequestPayloadV1
+         * @description Request payload for the `ssh_sign` envelope type. The approver signs an SSH signature input derived from `raw_data` (e.g. `git commit -S` SSH signing), using the on-device key selected by `device_key_id`.
+         */
+        MailboxSshSignRequestPayloadV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw data to sign (preimage). The approver builds the canonical SSH signature input from this preimage.
+             * @example ZGF0YSB0byBzaWdu
+             */
+            raw_data: string;
+            /**
+             * @description Identifier of the key to sign with.
+             * @example key_abc123
+             */
+            key_id?: string;
+            /**
+             * @description SSH application identifier (e.g. `ssh:`).
+             * @example ssh:
+             */
+            application?: string;
+            /**
+             * Format: int32
+             * @description SSH SK flags bitmask. Default `0x01` requires user presence.
+             * @default 1
+             * @example 1
+             */
+            flags?: number;
+            /** @description Device-side key identifier (e.g. iOS Secure Enclave handle) used to select among enrolled signing keys on the approver. */
+            device_key_id: string;
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            display?: components["schemas"]["DisplaySchema"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxSshSignResponsePayloadV1
+         * @description Response payload for the `ssh_sign` envelope type. Discriminated as a success / failure pair.
+         */
+        MailboxSshSignResponsePayloadV1: components["schemas"]["MailboxSshSignResponseSuccessV1"] | components["schemas"]["MailboxSshSignResponseFailureV1"];
+        /**
+         * MailboxSshSignResponseSuccessV1
+         * @description Success branch of `MailboxSshSignResponsePayloadV1`.
+         */
+        MailboxSshSignResponseSuccessV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw SSH signature blob (no SSH-wire framing).
+             */
+            signature: string;
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxSshSignResponseFailureV1
+         * @description Failure branch of `MailboxSshSignResponsePayloadV1`.
+         */
+        MailboxSshSignResponseFailureV1: {
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the request
+             */
+            error_message?: string;
+        };
+        /**
+         * MailboxGpgSignRequestPayloadV1
+         * @description Request payload for the `gpg_sign` envelope type. The approver builds the OpenPGP hash input from `raw_data` and signs the resulting digest with the primary GPG signing key selected by `device_key_id`.
+         */
+        MailboxGpgSignRequestPayloadV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw data to sign (preimage). The approver builds the OpenPGP hash input from this preimage and signs the resulting digest.
+             * @example cmF3IGRhdGE=
+             */
+            raw_data: string;
+            /**
+             * @description Hex-encoded public key selecting which on-device GPG primary key the approver should use for signing. The mailbox/poll path requires this because the envelope does not otherwise carry a key identifier.
+             * @example 034dc708f0fda9462584485537d588657e68c808dae0edb8cc556459a7975229e8
+             */
+            device_key_id: string;
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            display?: components["schemas"]["DisplaySchema"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxGpgSignResponsePayloadV1
+         * @description Response payload for the `gpg_sign` envelope type. Discriminated as a success / failure pair.
+         */
+        MailboxGpgSignResponsePayloadV1: components["schemas"]["MailboxGpgSignResponseSuccessV1"] | components["schemas"]["MailboxGpgSignResponseFailureV1"];
+        /**
+         * MailboxGpgSignResponseSuccessV1
+         * @description Success branch of `MailboxGpgSignResponsePayloadV1`.
+         */
+        MailboxGpgSignResponseSuccessV1: {
+            /**
+             * @description ASCII-armored OpenPGP signature.
+             * @example -----BEGIN PGP SIGNATURE-----...
+             */
+            armored_signature: string;
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxGpgSignResponseFailureV1
+         * @description Failure branch of `MailboxGpgSignResponsePayloadV1`.
+         */
+        MailboxGpgSignResponseFailureV1: {
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the request
+             */
+            error_message?: string;
+        };
+        /**
+         * MailboxGpgDecryptRequestPayloadV1
+         * @description Request payload for the `gpg_decrypt` envelope type. The approver unwraps the OpenPGP Public Key Encrypted Session Key packet using the encryption subkey selected by `device_key_id`.
+         */
+        MailboxGpgDecryptRequestPayloadV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the encrypted data to decrypt.
+             * @example ZW5jcnlwdGVkIGRhdGE=
+             */
+            encrypted_data: string;
+            pkesk: components["schemas"]["PkeskData"];
+            /**
+             * @description Hex-encoded public key selecting which on-device GPG encryption subkey the approver should use for ECDH. The mailbox/poll path requires this because the envelope does not otherwise carry a key identifier.
+             * @example 034dc708f0fda9462584485537d588657e68c808dae0edb8cc556459a7975229e8
+             */
+            device_key_id: string;
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            display?: components["schemas"]["DisplaySchema"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxGpgDecryptResponsePayloadV1
+         * @description Response payload for the `gpg_decrypt` envelope type. Discriminated as a success / failure pair. The success branch carries both `session_key` and `algorithm`; the failure branch carries `error_code`.
+         */
+        MailboxGpgDecryptResponsePayloadV1: components["schemas"]["MailboxGpgDecryptResponseSuccessV1"] | components["schemas"]["MailboxGpgDecryptResponseFailureV1"];
+        /**
+         * MailboxGpgDecryptResponseSuccessV1
+         * @description Success branch of `MailboxGpgDecryptResponsePayloadV1`.
+         */
+        MailboxGpgDecryptResponseSuccessV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the unwrapped session key.
+             * @example c2Vzc2lvbiBrZXk=
+             */
+            session_key: string;
+            /**
+             * Format: int32
+             * @description OpenPGP symmetric algorithm id (RFC 4880 §9.2).
+             * @example 9
+             */
+            algorithm: number;
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxGpgDecryptResponseFailureV1
+         * @description Failure branch of `MailboxGpgDecryptResponsePayloadV1`.
+         */
+        MailboxGpgDecryptResponseFailureV1: {
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the request
+             */
+            error_message?: string;
+        };
+        /**
+         * PkeskData
+         * @description OpenPGP Public Key Encrypted Session Key packet data.
+         */
+        PkeskData: {
+            /**
+             * Format: int32
+             * @description PKESK packet version (typically 3).
+             * @example 3
+             */
+            version: number;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the 8-byte recipient key id.
+             * @example a2V5X2lkMTIz
+             */
+            key_id: string;
+            /**
+             * Format: int32
+             * @description OpenPGP public key algorithm (RFC 4880 §9.1). `18` is ECDH.
+             * @example 18
+             */
+            algorithm: number;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the ephemeral ECDH public point (33 bytes compressed).
+             * @example ZXBoZW1lcmFsX3BvaW50
+             */
+            ephemeral_point: string;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the AES-wrapped session key.
+             * @example d3JhcHBlZF9rZXk=
+             */
+            wrapped_key: string;
+        };
+        /**
+         * MailboxAgeUnwrapRequestPayloadV1
+         * @description Request payload for the `age_unwrap` envelope type. The approver unwraps an age `X25519` recipient stanza using the on-device X25519 key matching `recipient_public_hex`.
+         */
+        MailboxAgeUnwrapRequestPayloadV1: {
+            /**
+             * @description Lowercase hex-encoded sender's ephemeral X25519 public key (64 hex chars for the 32-byte key).
+             * @example a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
+             */
+            ephemeral_public_hex: string;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the wrapped file key for decryption.
+             * @example d3JhcHBlZCBmaWxlIGtleQ==
+             */
+            wrapped_file_key: string;
+            /**
+             * @description Lowercase hex-encoded recipient's X25519 public key (64 hex chars for the 32-byte key).
+             * @example b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3
+             */
+            recipient_public_hex: string;
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            display?: components["schemas"]["DisplaySchema"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxAgeUnwrapResponsePayloadV1
+         * @description Response payload for the `age_unwrap` envelope type. Discriminated as a success / failure pair.
+         */
+        MailboxAgeUnwrapResponsePayloadV1: components["schemas"]["MailboxAgeUnwrapResponseSuccessV1"] | components["schemas"]["MailboxAgeUnwrapResponseFailureV1"];
+        /**
+         * MailboxAgeUnwrapResponseSuccessV1
+         * @description Success branch of `MailboxAgeUnwrapResponsePayloadV1`.
+         */
+        MailboxAgeUnwrapResponseSuccessV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the unwrapped age file key.
+             * @example ZmlsZSBrZXk=
+             */
+            file_key: string;
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxAgeUnwrapResponseFailureV1
+         * @description Failure branch of `MailboxAgeUnwrapResponsePayloadV1`.
+         */
+        MailboxAgeUnwrapResponseFailureV1: {
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the request
+             */
+            error_message?: string;
+        };
+        /**
+         * MailboxPkcs11SignRequestPayloadV1
+         * @description Request payload for the `pkcs11_sign` envelope type. The approver computes the SHA-256 digest of `raw_data` and signs it with the on-device key selected by `device_key_id`.
+         */
+        MailboxPkcs11SignRequestPayloadV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw data to sign (preimage). The approver computes the SHA-256 digest and signs it.
+             * @example cGtjczExIGRhdGE=
+             */
+            raw_data: string;
+            /** @description Hex-encoded public key selecting which on-device key the approver should use for signing. */
+            device_key_id: string;
+            display?: components["schemas"]["DisplaySchema"];
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxPkcs11SignResponsePayloadV1
+         * @description Response payload for the `pkcs11_sign` envelope type. Discriminated as a success / failure pair.
+         */
+        MailboxPkcs11SignResponsePayloadV1: components["schemas"]["MailboxPkcs11SignResponseSuccessV1"] | components["schemas"]["MailboxPkcs11SignResponseFailureV1"];
+        /**
+         * MailboxPkcs11SignResponseSuccessV1
+         * @description Success branch of `MailboxPkcs11SignResponsePayloadV1`.
+         */
+        MailboxPkcs11SignResponseSuccessV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the raw signature bytes (no PKCS#1 framing).
+             */
+            signature: string;
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxPkcs11SignResponseFailureV1
+         * @description Failure branch of `MailboxPkcs11SignResponsePayloadV1`.
+         */
+        MailboxPkcs11SignResponseFailureV1: {
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the request
+             */
+            error_message?: string;
+        };
+        /**
+         * MailboxPkcs11DeriveRequestPayloadV1
+         * @description Request payload for the `pkcs11_derive` envelope type. The approver runs ECDH between the on-device private key selected by `device_key_id` and the peer public key, optionally feeding the shared secret through a KDF.
+         */
+        MailboxPkcs11DeriveRequestPayloadV1: {
+            /**
+             * @description Lowercase hex-encoded peer public key for ECDH (66 hex chars for P-256 33-byte compressed key).
+             * @example 02a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
+             */
+            peer_public_hex: string;
+            /** @description Hex-encoded public key selecting which on-device key the approver should use for ECDH. */
+            device_key_id: string;
+            kdf?: components["schemas"]["Pkcs11DeriveKdfParams"];
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            display?: components["schemas"]["DisplaySchema"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxPkcs11DeriveResponsePayloadV1
+         * @description Response payload for the `pkcs11_derive` envelope type. Discriminated as a success / failure pair.
+         */
+        MailboxPkcs11DeriveResponsePayloadV1: components["schemas"]["MailboxPkcs11DeriveResponseSuccessV1"] | components["schemas"]["MailboxPkcs11DeriveResponseFailureV1"];
+        /**
+         * MailboxPkcs11DeriveResponseSuccessV1
+         * @description Success branch of `MailboxPkcs11DeriveResponsePayloadV1`.
+         */
+        MailboxPkcs11DeriveResponseSuccessV1: {
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the derived shared secret (post-KDF if `kdf` was supplied, otherwise raw ECDH X output).
+             * @example c2hhcmVkIHNlY3JldA==
+             */
+            shared_secret: string;
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxPkcs11DeriveResponseFailureV1
+         * @description Failure branch of `MailboxPkcs11DeriveResponsePayloadV1`.
+         */
+        MailboxPkcs11DeriveResponseFailureV1: {
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the request
+             */
+            error_message?: string;
+        };
+        /**
+         * Pkcs11DeriveKdfParams
+         * @description Optional key derivation parameters applied to the ECDH shared secret.
+         */
+        Pkcs11DeriveKdfParams: {
+            /**
+             * @description KDF algorithm name. Approvers MUST reject unknown algorithms.
+             * @example HKDF-SHA256
+             */
+            algorithm: string;
+            /**
+             * Format: int32
+             * @description Desired output key length in bytes.
+             * @example 32
+             */
+            key_length?: number;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the optional KDF `info` parameter.
+             */
+            info?: string;
+        };
+        /**
+         * MailboxEnrollRequestPayloadV1
+         * @description Request payload for the `enroll` envelope type. The approver creates a new key for the requested `purpose` and returns its public material.
+         */
+        MailboxEnrollRequestPayloadV1: {
+            purpose: components["schemas"]["KeyPurpose"];
+            /**
+             * @description Human-readable label for the new key.
+             * @example Work Laptop SSH Key
+             */
+            label?: string;
+            /**
+             * @description Key algorithm to use. Approver MUST reject unknown algorithms.
+             * @example ed25519
+             */
+            algorithm?: string;
+            /**
+             * @description Include a self-certification signature for GPG export. Ignored for non-GPG purposes.
+             * @default false
+             */
+            include_certification?: boolean;
+            approval_challenge?: components["schemas"]["ApprovalChallenge"];
+            display?: components["schemas"]["DisplaySchema"];
+            source_info?: components["schemas"]["SourceInfo"];
+        };
+        /**
+         * MailboxEnrollResponsePayloadV1
+         * @description Response payload for the `enroll` envelope type. Discriminated on `status`: `approved` requires the full key material set; `rejected` requires `error_code`.
+         */
+        MailboxEnrollResponsePayloadV1: components["schemas"]["MailboxEnrollResponseApprovedV1"] | components["schemas"]["MailboxEnrollResponseRejectedV1"];
+        /**
+         * MailboxEnrollResponseApprovedV1
+         * @description Approved branch of `MailboxEnrollResponsePayloadV1`. Carries the freshly minted public key material so the requester can refer to the new key in subsequent signing / decryption requests.
+         */
+        MailboxEnrollResponseApprovedV1: {
+            /**
+             * @description Enrollment outcome discriminator (`approved`). (enum property replaced by openapi-typescript)
+             * @enum {string}
+             */
+            status: "approved";
+            /**
+             * @description New key identifier. UUID for GPG keys; format defined by the algorithm for other purposes.
+             * @example 550e8400-e29b-41d4-a716-446655440000
+             */
+            id: string;
+            /** @description Lowercase hex-encoded public key. 66 hex chars for P-256 33-byte compressed key, or 64 hex chars for Ed25519 32-byte key. */
+            public_key_hex: string;
+            /** @description Device-side key identifier (e.g. iOS Secure Enclave handle) the requester can use to refer to the new key in subsequent requests. */
+            device_key_id: string;
+            /**
+             * @description Key algorithm used.
+             * @example ed25519
+             */
+            algorithm: string;
+            /** @description GPG fingerprint for GPG keys (40 hex chars). */
+            fingerprint?: string;
+            /**
+             * Format: int64
+             * @description Unix timestamp (seconds) when the key was created.
+             * @example 1705320000
+             */
+            key_creation_timestamp?: number;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the GPG self-certification signature.
+             */
+            user_id_signature?: string;
+            /**
+             * Format: byte
+             * @description RFC 4648 standard base64 with `=` padding for the GPG subkey binding signature.
+             */
+            subkey_signature?: string;
+            /** @description Lowercase hex-encoded ECDH encryption subkey public key (66 hex chars for P-256 33-byte compressed key). */
+            encryption_public_key_hex?: string;
+            /** @description 40-character hex fingerprint of the ECDH encryption subkey. */
+            encryption_fingerprint?: string;
+            attestation?: components["schemas"]["KeyMetadataAttestation"];
+            approval_proof?: components["schemas"]["ApprovalAttestedKeyProof"];
+        };
+        /**
+         * MailboxEnrollResponseRejectedV1
+         * @description Rejected branch of `MailboxEnrollResponsePayloadV1`. Carries the signing error code (and optional human-readable message).
+         */
+        MailboxEnrollResponseRejectedV1: {
+            /**
+             * @description Enrollment outcome discriminator (`rejected`). (enum property replaced by openapi-typescript)
+             * @enum {string}
+             */
+            status: "rejected";
+            error_code: components["schemas"]["SigningErrorCode"];
+            /**
+             * @description Human-readable error message.
+             * @example User rejected the enrollment
+             */
+            error_message?: string;
+        };
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export type operations = Record<string, never>;