@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/auth/passkey/enroll/invite/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/invite/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * An administrator issues a single-use invite link an unenrolled subject can redeem to bind their first passkey, without first holding an authenticated session.
  */
@@ -29,12 +32,6 @@ export interface AuthPasskeyEnrollInvite {
   ttl?: number;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The issued invite. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1#response.
  */
@@ -57,6 +54,9 @@ export interface AuthPasskeyEnrollInviteResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1" as const;
 
@@ -108,6 +108,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "deviceLabel": {
       "type": "string",
+      "maxLength": 256,
       "description": "Suggested label for the credential. Used as a default; the invitee MAY override during redemption."
     },
     "ttl": {
@@ -252,6 +253,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -265,5 +267,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/enroll/start/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/start/0.1/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor } from "../../../../../_shared/components.js";
+
+
 /**
  * Ask the auth service to begin a WebAuthn registration ceremony. The response carries PublicKeyCredentialCreationOptions; the producer hands them to `navigator.credentials.create({ publicKey: ... })`.
  */
@@ -11,14 +14,11 @@ export interface AuthPasskeyEnrollStart {
    * Operator-facing label for the credential (e.g. "Alice's MacBook"). Surfaced in the credential list for later management.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.1#response.
  */
@@ -27,81 +27,19 @@ export interface AuthPasskeyEnrollStartResponsePayload {
    * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
    */
   enrollmentId: string;
-  options: PublicKeyCredentialCreationOptions;
-  ext?: Ext1;
-}
-/**
- * PublicKeyCredentialCreationOptions for navigator.credentials.create.
- */
-export interface PublicKeyCredentialCreationOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
-  /**
-   * base64url-encoded one-time nonce.
-   */
-  challenge: string;
-  rp: {
-    id: string;
-    name: string;
-  };
-  user: {
-    /**
-     * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
-     */
-    id: string;
-    name: string;
-    displayName: string;
-  };
   /**
-   * @minItems 1
+   * PublicKeyCredentialCreationOptions for navigator.credentials.create.
    */
-  pubKeyCredParams: [
-    {
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    },
-    ...{
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    }[]
-  ];
-  timeout?: number;
-  excludeCredentials?: PublicKeyCredentialDescriptor[];
-  authenticatorSelection?: {
-    authenticatorAttachment?: "platform" | "cross-platform";
-    requireResidentKey?: boolean;
-    residentKey?: "discouraged" | "preferred" | "required";
-    userVerification?: "discouraged" | "preferred" | "required";
-  };
-  attestation?: "none" | "indirect" | "direct" | "enterprise";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
+  options: PublicKeyCredentialCreationOptions;
   /**
-   * base64url-encoded credential id.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.1" as const;
 
@@ -133,6 +71,7 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "deviceLabel": {
       "type": "string",
+      "maxLength": 256,
       "description": "Operator-facing label for the credential (e.g. \"Alice's MacBook\"). Surfaced in the credential list for later management."
     },
     "ext": {
@@ -212,7 +151,8 @@ export const PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             }
           }
         },
@@ -231,10 +171,12 @@ export const PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             },
             "displayName": {
-              "type": "string"
+              "type": "string",
+              "maxLength": 64
             }
           }
         },
@@ -418,7 +360,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             }
           }
         },
@@ -437,10 +380,12 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             },
             "displayName": {
-              "type": "string"
+              "type": "string",
+              "maxLength": 64
             }
           }
         },
@@ -559,6 +504,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -572,5 +518,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/enroll/start/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/start/0.2/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../_shared/components.js";
+
+
 /**
  * Ask the auth service to begin a WebAuthn registration ceremony. The response carries PublicKeyCredentialCreationOptions; the producer hands them to `navigator.credentials.create({ publicKey: ... })`.
  */
@@ -11,14 +14,11 @@ export interface AuthPasskeyEnrollStart {
    * Operator-facing label for the credential (e.g. "Alice's MacBook"). Surfaced in the credential list for later management.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.
  */
@@ -27,103 +27,23 @@ export interface AuthPasskeyEnrollStartResponsePayload {
    * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
    */
   enrollmentId: string;
-  options: PublicKeyCredentialCreationOptions;
-  uvOptions?: PublicKeyCredentialRequestOptions;
-  ext?: Ext1;
-}
-/**
- * PublicKeyCredentialCreationOptions for navigator.credentials.create.
- */
-export interface PublicKeyCredentialCreationOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
-  /**
-   * base64url-encoded one-time nonce.
-   */
-  challenge: string;
-  rp: {
-    id: string;
-    name: string;
-  };
-  user: {
-    /**
-     * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
-     */
-    id: string;
-    name: string;
-    displayName: string;
-  };
-  /**
-   * @minItems 1
-   */
-  pubKeyCredParams: [
-    {
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    },
-    ...{
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    }[]
-  ];
-  timeout?: number;
-  excludeCredentials?: PublicKeyCredentialDescriptor[];
-  authenticatorSelection?: {
-    authenticatorAttachment?: "platform" | "cross-platform";
-    requireResidentKey?: boolean;
-    residentKey?: "discouraged" | "preferred" | "required";
-    userVerification?: "discouraged" | "preferred" | "required";
-  };
-  attestation?: "none" | "indirect" | "direct" | "enterprise";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
   /**
-   * base64url-encoded credential id.
+   * PublicKeyCredentialCreationOptions for navigator.credentials.create.
    */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.
- */
-export interface PublicKeyCredentialRequestOptions {
+  options: PublicKeyCredentialCreationOptions;
   /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   * New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.
    */
-  extensions?: {};
+  uvOptions?: PublicKeyCredentialRequestOptions;
   /**
-   * base64url-encoded one-time nonce.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  challenge: string;
-  timeout?: number;
-  rpId?: string;
-  allowCredentials?: PublicKeyCredentialDescriptor[];
-  userVerification?: "discouraged" | "preferred" | "required";
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2" as const;
 
@@ -155,6 +75,7 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "deviceLabel": {
       "type": "string",
+      "maxLength": 256,
       "description": "Operator-facing label for the credential (e.g. \"Alice's MacBook\"). Surfaced in the credential list for later management."
     },
     "ext": {
@@ -310,7 +231,8 @@ export const PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             }
           }
         },
@@ -329,10 +251,12 @@ export const PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             },
             "displayName": {
-              "type": "string"
+              "type": "string",
+              "maxLength": 64
             }
           }
         },
@@ -561,7 +485,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             }
           }
         },
@@ -580,10 +505,12 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             },
             "name": {
               "type": "string",
-              "minLength": 1
+              "minLength": 1,
+              "maxLength": 64
             },
             "displayName": {
-              "type": "string"
+              "type": "string",
+              "maxLength": 64
             }
           }
         },
@@ -671,6 +598,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -684,5 +612,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/list/0.1/payload.ts

@@ -3,18 +3,18 @@
  * Source: specs/auth/passkey/list/0.1/payload.schema.json
  */
 
+import type { Ext, RegisteredCredential } from "../../../../_shared/components.js";
+
+
 /**
  * Enumerate the passkeys the auth service holds for the producer's subject. The credential-management counterpart to auth/sessions/list: sessions answers "where am I signed in?", this answers "what can sign me in?". Its output is the input to auth/passkey/revoke/start.
  */
 export interface AuthPasskeyList {
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/list/0.1#response.
  */
@@ -23,40 +23,15 @@ export interface AuthPasskeyListResponsePayload {
    * Every passkey currently bound to the producer's subject. MAY be empty — a subject who authenticates by other means has no passkeys, which is not an error. Consumers SHOULD sort by registeredAt descending.
    */
   credentials: RegisteredCredential[];
-  ext?: Ext1;
-}
-/**
- * A passkey already bound to a subject, as listed by `auth/passkey/list` and targeted by `auth/passkey/revoke/*`. This is the auth service's own management view of a credential — not a WebAuthn dictionary — so its members are camelCase per SPEC.md §4.10. The exception is `transports`, whose values are the externally-owned WebAuthn transport tokens and are carried verbatim.
- */
-export interface RegisteredCredential {
-  /**
-   * Durable identifier for this credential, as issued by `auth/passkey/enroll/finish`: the base64url-encoded WebAuthn credential id. Opaque to the producer — it MUST be echoed verbatim when revoking and MUST NOT be parsed.
-   */
-  credentialId: string;
   /**
-   * Operator-facing label captured at enrollment (e.g. "Alice's MacBook Pro"). Absent when the subject enrolled without one. Consumers MUST NOT synthesize a label, because an invented one is indistinguishable from a chosen one to somebody deciding which credential to revoke.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  deviceLabel?: string;
-  /**
-   * WebAuthn transport hints reported by the authenticator at enrollment (`usb`, `nfc`, `ble`, `internal`, `hybrid`, …). Externally owned and carried verbatim. Deliberately not an enum — unlike `CredentialDescriptor.transports`, which the consumer itself emits, these values were reported by a third-party authenticator, the WebAuthn transport registry grows independently of this specification, and an unrecognized token here is a display concern rather than a validation failure.
-   */
-  transports?: string[];
-  /**
-   * When the credential was bound to the subject.
-   */
-  registeredAt: string;
-  /**
-   * When this credential last completed an assertion. Absent if it never has, or if the consumer does not track usage. Those two cases are deliberately NOT distinguished: a nullable variant cannot survive the round-trip through generated bindings, which map absent and null onto the same optional, so a distinction stated here would not be one any conforming implementation could rely on. Consumers that need to advertise "usage is not tracked" SHOULD say so under `ext`.
-   */
-  lastUsedAt?: string;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RegisteredCredential };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/list/0.1" as const;
 
@@ -143,6 +118,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "deviceLabel": {
           "type": "string",
+          "maxLength": 256,
           "description": "Operator-facing label captured at enrollment (e.g. \"Alice's MacBook Pro\"). Absent when the subject enrolled without one. Consumers MUST NOT synthesize a label, because an invented one is indistinguishable from a chosen one to somebody deciding which credential to revoke."
         },
         "transports": {
@@ -224,6 +200,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "deviceLabel": {
           "type": "string",
+          "maxLength": 256,
           "description": "Operator-facing label captured at enrollment (e.g. \"Alice's MacBook Pro\"). Absent when the subject enrolled without one. Consumers MUST NOT synthesize a label, because an invented one is indistinguishable from a chosen one to somebody deciding which credential to revoke."
         },
         "transports": {
@@ -260,6 +237,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -273,5 +251,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;