@openvtc/trust-tasks 0.17.0 → 0.17.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +131 -0
- package/dist/_shared/components.d.ts +26 -0
- package/dist/_shared/components.d.ts.map +1 -1
- package/dist/auth/whoami/0.1/payload.d.ts +42 -0
- package/dist/auth/whoami/0.1/payload.d.ts.map +1 -1
- package/dist/auth/whoami/0.1/payload.js +16 -0
- package/dist/auth/whoami/0.1/payload.js.map +1 -1
- package/dist/persona/_shared/0.1/persona-record.d.ts +1 -1
- package/dist/persona/_shared/0.1/persona-record.d.ts.map +1 -1
- package/dist/persona/attribute/list/1.0/payload.d.ts +102 -2
- package/dist/persona/attribute/list/1.0/payload.d.ts.map +1 -1
- package/dist/persona/attribute/list/1.0/payload.js +57 -0
- package/dist/persona/attribute/list/1.0/payload.js.map +1 -1
- package/dist/persona/attribute/put/1.0/payload.d.ts +74 -2
- package/dist/persona/attribute/put/1.0/payload.d.ts.map +1 -1
- package/dist/persona/attribute/put/1.0/payload.js +44 -0
- package/dist/persona/attribute/put/1.0/payload.js.map +1 -1
- package/dist/persona/local/profile/put/1.0/payload.d.ts +11 -0
- package/dist/persona/local/profile/put/1.0/payload.d.ts.map +1 -1
- package/dist/persona/local/profile/put/1.0/payload.js +1 -0
- package/dist/persona/local/profile/put/1.0/payload.js.map +1 -1
- package/package.json +1 -1
- package/src/_shared/components.ts +26 -0
- package/src/auth/whoami/0.1/payload.ts +26 -0
- package/src/persona/_shared/0.1/persona-record.ts +1 -1
- package/src/persona/attribute/list/1.0/payload.ts +69 -2
- package/src/persona/attribute/put/1.0/payload.ts +54 -2
- package/src/persona/local/profile/put/1.0/payload.ts +10 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/persona/attribute/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;
|
|
1
|
+
{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/persona/attribute/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,uDAAuD;IAC9D,OAAO,EAAE,iCAAiC;IAC1C,aAAa,EAAE,0JAA0J;IACzK,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,MAAM;QACN,WAAW;QACX,OAAO;QACP,YAAY;KACb;IACD,YAAY,EAAE;QACZ,aAAa,EAAE;YACb,MAAM,EAAE,cAAc;YACtB,aAAa,EAAE,kRAAkR;SAClS;QACD,MAAM,EAAE;YACN,MAAM,EAAE,mBAAmB;SAC5B;QACD,WAAW,EAAE;YACX,MAAM,EAAE,mBAAmB;SAC5B;QACD,OAAO,EAAE;YACP,aAAa,EAAE,oQAAoQ;SACpR;QACD,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,8EAA8E;SAC9F;QACD,YAAY,EAAE;YACZ,MAAM,EAAE,oBAAoB;SAC7B;QACD,aAAa,EAAE;YACb,MAAM,EAAE,qBAAqB;YAC7B,aAAa,EAAE,4VAA4V;SAC5W;QACD,SAAS,EAAE;YACT,MAAM,EAAE,4BAA4B;YACpC,aAAa,EAAE,qGAAqG;SACrH;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,oJAAoJ;SACpK;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,kSAAkS;YACjT,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,+MAA+M;iBAC/N;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,UAAU;qBACX;oBACD,aAAa,EAAE,uXAAuX;oBACtY,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,MAAM,EAAE,QAAQ;4BAChB,MAAM,EAAE;gCACN,MAAM;gCACN,KAAK;gCACL,MAAM;6BACP;yBACF;wBACD,wBAAwB,EAAE;4BACxB,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,CAAC;4BACZ,aAAa,EAAE,mMAAmM;yBACnN;qBACF;iBACF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,uMAAuM;YACtN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,oBAAoB,EAAE;YACpB,OAAO,EAAE,oBAAoB;YAC7B,aAAa,EAAE,q0BAAq0B;YACp1B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;aACT;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,qxBAAqxB;YACpyB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,MAAM;aACP;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,kSAAkS;YACjT,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,+MAA+M;iBAC/N;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,UAAU;qBACX;oBACD,aAAa,EAAE,uXAAuX;oBACtY,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,MAAM,EAAE,QAAQ;4BAChB,MAAM,EAAE;gCACN,MAAM;gCACN,KAAK;gCACL,MAAM;6BACP;yBACF;wBACD,wBAAwB,EAAE;4BACxB,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,CAAC;4BACZ,aAAa,EAAE,mMAAmM;yBACnN;qBACF;iBACF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,uMAAuM;YACtN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,oBAAoB,EAAE;YACpB,OAAO,EAAE,oBAAoB;YAC7B,aAAa,EAAE,q0BAAq0B;YACp1B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;aACT;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,qxBAAqxB;YACpyB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,MAAM;aACP;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}
|
|
@@ -14,6 +14,15 @@ export interface PersonaLocalProfilePutPayload {
|
|
|
14
14
|
* @maxItems 64
|
|
15
15
|
*/
|
|
16
16
|
entries: {
|
|
17
|
+
/**
|
|
18
|
+
* A value the holder keeps in this context and nowhere else.
|
|
19
|
+
*
|
|
20
|
+
* Deliberately NARROWER than a pool profile's inline entry, which also carries `provenance` and requires it. There is no `provenance` member here, and its absence is a rule rather than an omission: a `credentialBacked` provenance names a `credentialId` and a `claimPath`, and a value authored inside a context has nowhere to put either. So a context-local value is SELF-ASSERTED by construction, and a maintainer MUST present it as such.
|
|
21
|
+
*
|
|
22
|
+
* That is the same boundary the missing `ref`, pinned and override forms enforce, one member along. Those stop a context-authored object acquiring pool REACH; this stops it acquiring an issuer's AUTHORITY — asserting that a value is attested when no credential was ever checked, over a value the issuer never saw. A holder who needs a context to present an attested claim binds a pool profile, which is holder-authorized, rather than authoring one here.
|
|
23
|
+
*
|
|
24
|
+
* Adding a `provenance` member to this object would therefore be a privilege escalation dressed as a convenience, not a gap to fill.
|
|
25
|
+
*/
|
|
17
26
|
inline: {
|
|
18
27
|
type: ClaimType;
|
|
19
28
|
valueType: ValueType;
|
|
@@ -93,6 +102,7 @@ export declare const PAYLOAD_SCHEMA: {
|
|
|
93
102
|
readonly description: "Inline entries only. The `ref`, pinned and override forms of a pool profile are absent from this schema deliberately — a context-local profile that could reference the pool would be a context-authored object acquiring pool reach, which is exactly what the boundary exists to prevent.";
|
|
94
103
|
readonly properties: {
|
|
95
104
|
readonly inline: {
|
|
105
|
+
readonly description: "A value the holder keeps in this context and nowhere else.\n\nDeliberately NARROWER than a pool profile's inline entry, which also carries `provenance` and requires it. There is no `provenance` member here, and its absence is a rule rather than an omission: a `credentialBacked` provenance names a `credentialId` and a `claimPath`, and a value authored inside a context has nowhere to put either. So a context-local value is SELF-ASSERTED by construction, and a maintainer MUST present it as such.\n\nThat is the same boundary the missing `ref`, pinned and override forms enforce, one member along. Those stop a context-authored object acquiring pool REACH; this stops it acquiring an issuer's AUTHORITY — asserting that a value is attested when no credential was ever checked, over a value the issuer never saw. A holder who needs a context to present an attested claim binds a pool profile, which is holder-authorized, rather than authoring one here.\n\nAdding a `provenance` member to this object would therefore be a privilege escalation dressed as a convenience, not a gap to fill.";
|
|
96
106
|
readonly type: "object";
|
|
97
107
|
readonly additionalProperties: false;
|
|
98
108
|
readonly required: readonly ["type", "valueType", "value"];
|
|
@@ -333,6 +343,7 @@ export declare const SPEC: {
|
|
|
333
343
|
readonly description: "Inline entries only. The `ref`, pinned and override forms of a pool profile are absent from this schema deliberately — a context-local profile that could reference the pool would be a context-authored object acquiring pool reach, which is exactly what the boundary exists to prevent.";
|
|
334
344
|
readonly properties: {
|
|
335
345
|
readonly inline: {
|
|
346
|
+
readonly description: "A value the holder keeps in this context and nowhere else.\n\nDeliberately NARROWER than a pool profile's inline entry, which also carries `provenance` and requires it. There is no `provenance` member here, and its absence is a rule rather than an omission: a `credentialBacked` provenance names a `credentialId` and a `claimPath`, and a value authored inside a context has nowhere to put either. So a context-local value is SELF-ASSERTED by construction, and a maintainer MUST present it as such.\n\nThat is the same boundary the missing `ref`, pinned and override forms enforce, one member along. Those stop a context-authored object acquiring pool REACH; this stops it acquiring an issuer's AUTHORITY — asserting that a value is attested when no credential was ever checked, over a value the issuer never saw. A holder who needs a context to present an attested claim binds a pool profile, which is holder-authorized, rather than authoring one here.\n\nAdding a `provenance` member to this object would therefore be a privilege escalation dressed as a convenience, not a gap to fill.";
|
|
336
347
|
readonly type: "object";
|
|
337
348
|
readonly additionalProperties: false;
|
|
338
349
|
readonly required: readonly ["type", "valueType", "value"];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/persona/local/profile/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,2BAA2B,IAAI,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAG5K;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE;QACP,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC;YAChB,SAAS,EAAE,SAAS,CAAC;YACrB,KAAK,EAAE,OAAO,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;KACH,EAAE,CAAC;IACJ,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;QAClC;;WAEG;QACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAE1E,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,6BAA6B,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,qCAAqC,CAAC;AAE7D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc
|
|
1
|
+
{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/persona/local/profile/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,2BAA2B,IAAI,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAG5K;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC;YAChB,SAAS,EAAE,SAAS,CAAC;YACrB,KAAK,EAAE,OAAO,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;KACH,EAAE,CAAC;IACJ,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;QAClC;;WAEG;QACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAE1E,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,6BAA6B,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,qCAAqC,CAAC;AAE7D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuKjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqG1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}
|
|
@@ -52,6 +52,7 @@ export const PAYLOAD_SCHEMA = {
|
|
|
52
52
|
"description": "Inline entries only. The `ref`, pinned and override forms of a pool profile are absent from this schema deliberately — a context-local profile that could reference the pool would be a context-authored object acquiring pool reach, which is exactly what the boundary exists to prevent.",
|
|
53
53
|
"properties": {
|
|
54
54
|
"inline": {
|
|
55
|
+
"description": "A value the holder keeps in this context and nowhere else.\n\nDeliberately NARROWER than a pool profile's inline entry, which also carries `provenance` and requires it. There is no `provenance` member here, and its absence is a rule rather than an omission: a `credentialBacked` provenance names a `credentialId` and a `claimPath`, and a value authored inside a context has nowhere to put either. So a context-local value is SELF-ASSERTED by construction, and a maintainer MUST present it as such.\n\nThat is the same boundary the missing `ref`, pinned and override forms enforce, one member along. Those stop a context-authored object acquiring pool REACH; this stops it acquiring an issuer's AUTHORITY — asserting that a value is attested when no credential was ever checked, over a value the issuer never saw. A holder who needs a context to present an attested claim binds a pool profile, which is holder-authorized, rather than authoring one here.\n\nAdding a `provenance` member to this object would therefore be a privilege escalation dressed as a convenience, not a gap to fill.",
|
|
55
56
|
"type": "object",
|
|
56
57
|
"additionalProperties": false,
|
|
57
58
|
"required": [
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/persona/local/profile/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;
|
|
1
|
+
{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/persona/local/profile/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0DH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAK7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC;AAK/G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,2DAA2D;IAClE,OAAO,EAAE,qCAAqC;IAC9C,aAAa,EAAE,4NAA4N;IAC3O,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,WAAW;QACX,MAAM;QACN,SAAS;KACV;IACD,YAAY,EAAE;QACZ,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;SACf;QACD,WAAW,EAAE;YACX,MAAM,EAAE,cAAc;SACvB;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;SACjB;QACD,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,EAAE;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,sBAAsB,EAAE,KAAK;gBAC7B,UAAU,EAAE;oBACV,QAAQ;iBACT;gBACD,aAAa,EAAE,6RAA6R;gBAC5S,YAAY,EAAE;oBACZ,QAAQ,EAAE;wBACR,aAAa,EAAE,gkCAAgkC;wBAC/kC,MAAM,EAAE,QAAQ;wBAChB,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE;4BACV,MAAM;4BACN,WAAW;4BACX,OAAO;yBACR;wBACD,YAAY,EAAE;4BACZ,MAAM,EAAE;gCACN,MAAM,EAAE,mBAAmB;6BAC5B;4BACD,WAAW,EAAE;gCACX,MAAM,EAAE,mBAAmB;6BAC5B;4BACD,OAAO,EAAE,EAAE;4BACX,OAAO,EAAE;gCACP,MAAM,EAAE,QAAQ;gCAChB,WAAW,EAAE,GAAG;6BACjB;yBACF;qBACF;iBACF;aACF;SACF;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,yBAAyB;SAClC;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,8CAA8C;YACvD,aAAa,EAAE,yHAAyH;YACxI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,SAAS;gBACT,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,cAAc;iBACvB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;iBAClB;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,UAAU;qBACX;oBACD,aAAa,EAAE,sUAAsU;oBACrV,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,MAAM,EAAE,QAAQ;4BAChB,MAAM,EAAE;gCACN,MAAM;gCACN,KAAK;gCACL,MAAM;6BACP;yBACF;wBACD,kBAAkB,EAAE;4BAClB,MAAM,EAAE,SAAS;4BACjB,aAAa,EAAE,yGAAyG;yBACzH;qBACF;iBACF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,uMAAuM;YACtN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,8CAA8C;YACvD,aAAa,EAAE,yHAAyH;YACxI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,SAAS;gBACT,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,cAAc;iBACvB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;iBAClB;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,UAAU;qBACX;oBACD,aAAa,EAAE,sUAAsU;oBACrV,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,MAAM,EAAE,QAAQ;4BAChB,MAAM,EAAE;gCACN,MAAM;gCACN,KAAK;gCACL,MAAM;6BACP;yBACF;wBACD,kBAAkB,EAAE;4BAClB,MAAM,EAAE,SAAS;4BACjB,aAAa,EAAE,yGAAyG;yBACzH;qBACF;iBACF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,uMAAuM;YACtN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}
|
package/package.json
CHANGED
|
@@ -257,6 +257,16 @@ export type PushRegistration = Apns | Fcm | WebPush;
|
|
|
257
257
|
* Whether the record asserts an authorization or a recognition relationship.
|
|
258
258
|
*/
|
|
259
259
|
export type RecordType = "authorization" | "recognition";
|
|
260
|
+
/**
|
|
261
|
+
* What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.
|
|
262
|
+
*
|
|
263
|
+
* `consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.
|
|
264
|
+
*
|
|
265
|
+
* `stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, "each time" degrades into "once per login", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.
|
|
266
|
+
*
|
|
267
|
+
* Absent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.
|
|
268
|
+
*/
|
|
269
|
+
export type ReleaseRequirement = "consent" | "stepUp";
|
|
260
270
|
/**
|
|
261
271
|
* How a consent prompt reaches the approver: `wake` pushes to the approver's device for a DID-signed decision; `bridge-relay` renders it through an enrolled bridge (e.g. a numbered card in the operator's messaging app) for a bridge-attested decision.
|
|
262
272
|
*/
|
|
@@ -323,6 +333,14 @@ export type SecretKind_VaultV0_2 =
|
|
|
323
333
|
| "bearerToken"
|
|
324
334
|
| "sshKey"
|
|
325
335
|
| "custom";
|
|
336
|
+
/**
|
|
337
|
+
* How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.
|
|
338
|
+
*
|
|
339
|
+
* Absent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.
|
|
340
|
+
*
|
|
341
|
+
* Distinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.
|
|
342
|
+
*/
|
|
343
|
+
export type Sensitivity = "normal" | "high";
|
|
326
344
|
/**
|
|
327
345
|
* Which transport a task is acting on. This is the discriminator: it selects which member of `config` is meaningful, and a payload naming one kind with another's config is malformed rather than merely ignored.
|
|
328
346
|
*/
|
|
@@ -673,6 +691,14 @@ export interface Attribute {
|
|
|
673
691
|
* Why re-derivation failed. Present only alongside `stale`.
|
|
674
692
|
*/
|
|
675
693
|
staleReason?: "revoked" | "expired" | "archived" | "deleted" | "notFound";
|
|
694
|
+
/**
|
|
695
|
+
* Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.
|
|
696
|
+
*/
|
|
697
|
+
sensitivity?: Sensitivity;
|
|
698
|
+
/**
|
|
699
|
+
* Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.
|
|
700
|
+
*/
|
|
701
|
+
release?: ReleaseRequirement;
|
|
676
702
|
version: Version_PersonaV0_1;
|
|
677
703
|
createdAt?: string;
|
|
678
704
|
updatedAt: string;
|
|
@@ -31,6 +31,16 @@ export interface AuthWhoamiResponsePayload {
|
|
|
31
31
|
* Capability tags effective on the producer's current session. Mirrors the issued TokenBundle.scope; included here so a producer can reconcile after policy edits without re-issuing tokens.
|
|
32
32
|
*/
|
|
33
33
|
scopes?: string[];
|
|
34
|
+
/**
|
|
35
|
+
* The capabilities the auth service holds for the producer, resolved as they would be enforced — a role's own set, narrowed by anything the entry narrows, plus any capability granted to the entry by name.
|
|
36
|
+
*
|
|
37
|
+
* Effective rather than stored, because the question a consumer is asking is "what may I do", and an entry that narrows nothing means everything its role implies. Returning the stored list would answer a different question and read as empty for the commonest case.
|
|
38
|
+
*
|
|
39
|
+
* Why it belongs beside `roles` and `scopes`: a consumer that can only see those cannot tell whether a caller holds a capability its role does not imply, so it must either refuse the caller — locking out a grant the service would honour — or offer the action and let the service refuse. Neither is a good answer to a question the service can simply answer.
|
|
40
|
+
*
|
|
41
|
+
* This member says what the producer MAY DO. It carries nothing about who they are: no attribute, no value, no identity content. See the persona conventions on naming identity versus carrying it.
|
|
42
|
+
*/
|
|
43
|
+
capabilities?: string[];
|
|
34
44
|
/**
|
|
35
45
|
* Ecosystem-defined extension members per SPEC.md §4.5.1.
|
|
36
46
|
*/
|
|
@@ -105,6 +115,14 @@ export const PAYLOAD_SCHEMA = {
|
|
|
105
115
|
},
|
|
106
116
|
"description": "Capability tags effective on the producer's current session. Mirrors the issued TokenBundle.scope; included here so a producer can reconcile after policy edits without re-issuing tokens."
|
|
107
117
|
},
|
|
118
|
+
"capabilities": {
|
|
119
|
+
"type": "array",
|
|
120
|
+
"items": {
|
|
121
|
+
"type": "string",
|
|
122
|
+
"minLength": 1
|
|
123
|
+
},
|
|
124
|
+
"description": "The capabilities the auth service holds for the producer, resolved as they would be enforced — a role's own set, narrowed by anything the entry narrows, plus any capability granted to the entry by name.\n\nEffective rather than stored, because the question a consumer is asking is \"what may I do\", and an entry that narrows nothing means everything its role implies. Returning the stored list would answer a different question and read as empty for the commonest case.\n\nWhy it belongs beside `roles` and `scopes`: a consumer that can only see those cannot tell whether a caller holds a capability its role does not imply, so it must either refuse the caller — locking out a grant the service would honour — or offer the action and let the service refuse. Neither is a good answer to a question the service can simply answer.\n\nThis member says what the producer MAY DO. It carries nothing about who they are: no attribute, no value, no identity content. See the persona conventions on naming identity versus carrying it."
|
|
125
|
+
},
|
|
108
126
|
"ext": {
|
|
109
127
|
"$ref": "#/$defs/Ext",
|
|
110
128
|
"description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
|
|
@@ -211,6 +229,14 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
|
|
|
211
229
|
},
|
|
212
230
|
"description": "Capability tags effective on the producer's current session. Mirrors the issued TokenBundle.scope; included here so a producer can reconcile after policy edits without re-issuing tokens."
|
|
213
231
|
},
|
|
232
|
+
"capabilities": {
|
|
233
|
+
"type": "array",
|
|
234
|
+
"items": {
|
|
235
|
+
"type": "string",
|
|
236
|
+
"minLength": 1
|
|
237
|
+
},
|
|
238
|
+
"description": "The capabilities the auth service holds for the producer, resolved as they would be enforced — a role's own set, narrowed by anything the entry narrows, plus any capability granted to the entry by name.\n\nEffective rather than stored, because the question a consumer is asking is \"what may I do\", and an entry that narrows nothing means everything its role implies. Returning the stored list would answer a different question and read as empty for the commonest case.\n\nWhy it belongs beside `roles` and `scopes`: a consumer that can only see those cannot tell whether a caller holds a capability its role does not imply, so it must either refuse the caller — locking out a grant the service would honour — or offer the action and let the service refuse. Neither is a good answer to a question the service can simply answer.\n\nThis member says what the producer MAY DO. It carries nothing about who they are: no attribute, no value, no identity content. See the persona conventions on naming identity versus carrying it."
|
|
239
|
+
},
|
|
214
240
|
"ext": {
|
|
215
241
|
"$ref": "#/$defs/Ext",
|
|
216
242
|
"description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
|
|
@@ -20,4 +20,4 @@ export interface PersonaRecordSharedDefinitionsForThePersonaSpecFamily {
|
|
|
20
20
|
* The definitions this shared schema publishes, hoisted to one declaration each.
|
|
21
21
|
* See "../../../_shared/components.js".
|
|
22
22
|
*/
|
|
23
|
-
export type { Attribute, ClaimType, ContactDocument, ContactRevision, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Profile, ProfileEntry, ProofRung, Provenance, ResolvedClaim, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../_shared/components.js";
|
|
23
|
+
export type { Attribute, ClaimType, ContactDocument, ContactRevision, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Profile, ProfileEntry, ProofRung, Provenance, ReleaseRequirement, ResolvedClaim, Sensitivity, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../_shared/components.js";
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* Source: specs/persona/attribute/list/1.0/payload.schema.json
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
|
-
import type { Attribute, ClaimType, Ext, ProofRung, Provenance, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
|
|
6
|
+
import type { Attribute, ClaimType, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
|
|
7
7
|
|
|
8
8
|
|
|
9
9
|
/**
|
|
@@ -18,6 +18,16 @@ export interface PersonaAttributeListPayload {
|
|
|
18
18
|
* When false (the default), each returned attribute carries its metadata and no `value`. A pool listing is the common case and it does not need plaintext: a picker renders `type` and `label`. Defaulting to false means the expensive, sensitive path is the one a producer has to ask for.
|
|
19
19
|
*/
|
|
20
20
|
includeValues?: boolean;
|
|
21
|
+
/**
|
|
22
|
+
* When false (the default), a listing that asked for values still omits the value of any attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for those too.
|
|
23
|
+
*
|
|
24
|
+
* This is the half of sensitivity that is not cosmetic. A consumer that masks a value it has already received defends a screen; it does not keep a card number out of a log, a crash dump or a process's memory. Ignoring this member and masking client-side is a conforming implementation of nothing.
|
|
25
|
+
*
|
|
26
|
+
* Separate from `includeValues` rather than a third state of it, because the two escalations are answerable by different callers: a picker wants every name and no card, and should not have to choose between plaintext for everything and plaintext for nothing.
|
|
27
|
+
*
|
|
28
|
+
* Has no effect unless `includeValues` is also set: it widens that request, and can never be the thing that introduces plaintext on its own.
|
|
29
|
+
*/
|
|
30
|
+
includeSensitive?: boolean;
|
|
21
31
|
/**
|
|
22
32
|
* When true (the default), credential-backed attributes whose backing could not be re-derived are returned carrying `stale` and `staleReason`. Set false to omit them. The default is true because a holder needs to SEE that a credential-backed fact has gone stale — silently dropping it would present a pool that looks smaller than it is, and the holder would not know a claim had stopped being presentable.
|
|
23
33
|
*/
|
|
@@ -48,7 +58,7 @@ export interface PersonaAttributeListResponsePayload {
|
|
|
48
58
|
}
|
|
49
59
|
|
|
50
60
|
/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
|
|
51
|
-
export type { Attribute, ClaimType, Ext, ProofRung, Provenance, Ulid, ValueType, Version };
|
|
61
|
+
export type { Attribute, ClaimType, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version };
|
|
52
62
|
|
|
53
63
|
/** Trust Task type URI. */
|
|
54
64
|
export const TYPE_URI = "https://trusttasks.org/spec/persona/attribute/list/1.0" as const;
|
|
@@ -89,6 +99,11 @@ export const PAYLOAD_SCHEMA = {
|
|
|
89
99
|
"default": false,
|
|
90
100
|
"description": "When false (the default), each returned attribute carries its metadata and no `value`. A pool listing is the common case and it does not need plaintext: a picker renders `type` and `label`. Defaulting to false means the expensive, sensitive path is the one a producer has to ask for."
|
|
91
101
|
},
|
|
102
|
+
"includeSensitive": {
|
|
103
|
+
"type": "boolean",
|
|
104
|
+
"default": false,
|
|
105
|
+
"description": "When false (the default), a listing that asked for values still omits the value of any attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for those too.\n\nThis is the half of sensitivity that is not cosmetic. A consumer that masks a value it has already received defends a screen; it does not keep a card number out of a log, a crash dump or a process's memory. Ignoring this member and masking client-side is a conforming implementation of nothing.\n\nSeparate from `includeValues` rather than a third state of it, because the two escalations are answerable by different callers: a picker wants every name and no card, and should not have to choose between plaintext for everything and plaintext for nothing.\n\nHas no effect unless `includeValues` is also set: it widens that request, and can never be the thing that introduces plaintext on its own."
|
|
106
|
+
},
|
|
92
107
|
"includeStale": {
|
|
93
108
|
"type": "boolean",
|
|
94
109
|
"default": true,
|
|
@@ -197,6 +212,14 @@ export const PAYLOAD_SCHEMA = {
|
|
|
197
212
|
],
|
|
198
213
|
"description": "Why re-derivation failed. Present only alongside `stale`."
|
|
199
214
|
},
|
|
215
|
+
"sensitivity": {
|
|
216
|
+
"$ref": "#/$defs/Sensitivity",
|
|
217
|
+
"description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'."
|
|
218
|
+
},
|
|
219
|
+
"release": {
|
|
220
|
+
"$ref": "#/$defs/ReleaseRequirement",
|
|
221
|
+
"description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry."
|
|
222
|
+
},
|
|
200
223
|
"version": {
|
|
201
224
|
"$ref": "#/$defs/Version"
|
|
202
225
|
},
|
|
@@ -216,6 +239,24 @@ export const PAYLOAD_SCHEMA = {
|
|
|
216
239
|
"type": "integer",
|
|
217
240
|
"minimum": 1
|
|
218
241
|
},
|
|
242
|
+
"ReleaseRequirement": {
|
|
243
|
+
"title": "ReleaseRequirement",
|
|
244
|
+
"description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
|
|
245
|
+
"type": "string",
|
|
246
|
+
"enum": [
|
|
247
|
+
"consent",
|
|
248
|
+
"stepUp"
|
|
249
|
+
]
|
|
250
|
+
},
|
|
251
|
+
"Sensitivity": {
|
|
252
|
+
"title": "Sensitivity",
|
|
253
|
+
"description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
|
|
254
|
+
"type": "string",
|
|
255
|
+
"enum": [
|
|
256
|
+
"normal",
|
|
257
|
+
"high"
|
|
258
|
+
]
|
|
259
|
+
},
|
|
219
260
|
"Provenance": {
|
|
220
261
|
"title": "Provenance",
|
|
221
262
|
"description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
|
|
@@ -423,6 +464,14 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
|
|
|
423
464
|
],
|
|
424
465
|
"description": "Why re-derivation failed. Present only alongside `stale`."
|
|
425
466
|
},
|
|
467
|
+
"sensitivity": {
|
|
468
|
+
"$ref": "#/$defs/Sensitivity",
|
|
469
|
+
"description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'."
|
|
470
|
+
},
|
|
471
|
+
"release": {
|
|
472
|
+
"$ref": "#/$defs/ReleaseRequirement",
|
|
473
|
+
"description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry."
|
|
474
|
+
},
|
|
426
475
|
"version": {
|
|
427
476
|
"$ref": "#/$defs/Version"
|
|
428
477
|
},
|
|
@@ -442,6 +491,24 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
|
|
|
442
491
|
"type": "integer",
|
|
443
492
|
"minimum": 1
|
|
444
493
|
},
|
|
494
|
+
"ReleaseRequirement": {
|
|
495
|
+
"title": "ReleaseRequirement",
|
|
496
|
+
"description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
|
|
497
|
+
"type": "string",
|
|
498
|
+
"enum": [
|
|
499
|
+
"consent",
|
|
500
|
+
"stepUp"
|
|
501
|
+
]
|
|
502
|
+
},
|
|
503
|
+
"Sensitivity": {
|
|
504
|
+
"title": "Sensitivity",
|
|
505
|
+
"description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
|
|
506
|
+
"type": "string",
|
|
507
|
+
"enum": [
|
|
508
|
+
"normal",
|
|
509
|
+
"high"
|
|
510
|
+
]
|
|
511
|
+
},
|
|
445
512
|
"Provenance": {
|
|
446
513
|
"title": "Provenance",
|
|
447
514
|
"description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* Source: specs/persona/attribute/put/1.0/payload.schema.json
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
|
-
import type { ClaimType, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, ProofRung, Provenance, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
|
|
6
|
+
import type { ClaimType, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
|
|
7
7
|
|
|
8
8
|
|
|
9
9
|
/**
|
|
@@ -27,6 +27,14 @@ export interface PersonaAttributePutPayload {
|
|
|
27
27
|
*/
|
|
28
28
|
label?: string;
|
|
29
29
|
provenance: Provenance;
|
|
30
|
+
/**
|
|
31
|
+
* How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed.
|
|
32
|
+
*/
|
|
33
|
+
sensitivity?: Sensitivity;
|
|
34
|
+
/**
|
|
35
|
+
* What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`.
|
|
36
|
+
*/
|
|
37
|
+
release?: ReleaseRequirement;
|
|
30
38
|
/**
|
|
31
39
|
* Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.
|
|
32
40
|
*/
|
|
@@ -62,7 +70,7 @@ export interface PersonaAttributePutResponsePayload {
|
|
|
62
70
|
}
|
|
63
71
|
|
|
64
72
|
/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
|
|
65
|
-
export type { ClaimType, ExpectedVersion, Ext, ProofRung, Provenance, Ulid, ValueType, Version };
|
|
73
|
+
export type { ClaimType, ExpectedVersion, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version };
|
|
66
74
|
|
|
67
75
|
/** Trust Task type URI. */
|
|
68
76
|
export const TYPE_URI = "https://trusttasks.org/spec/persona/attribute/put/1.0" as const;
|
|
@@ -120,6 +128,14 @@ export const PAYLOAD_SCHEMA = {
|
|
|
120
128
|
"provenance": {
|
|
121
129
|
"$ref": "#/$defs/Provenance"
|
|
122
130
|
},
|
|
131
|
+
"sensitivity": {
|
|
132
|
+
"$ref": "#/$defs/Sensitivity",
|
|
133
|
+
"description": "How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed."
|
|
134
|
+
},
|
|
135
|
+
"release": {
|
|
136
|
+
"$ref": "#/$defs/ReleaseRequirement",
|
|
137
|
+
"description": "What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`."
|
|
138
|
+
},
|
|
123
139
|
"expectedVersion": {
|
|
124
140
|
"$ref": "#/$defs/ExpectedVersion",
|
|
125
141
|
"description": "Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only."
|
|
@@ -217,6 +233,24 @@ export const PAYLOAD_SCHEMA = {
|
|
|
217
233
|
"type": "integer",
|
|
218
234
|
"minimum": 0
|
|
219
235
|
},
|
|
236
|
+
"ReleaseRequirement": {
|
|
237
|
+
"title": "ReleaseRequirement",
|
|
238
|
+
"description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
|
|
239
|
+
"type": "string",
|
|
240
|
+
"enum": [
|
|
241
|
+
"consent",
|
|
242
|
+
"stepUp"
|
|
243
|
+
]
|
|
244
|
+
},
|
|
245
|
+
"Sensitivity": {
|
|
246
|
+
"title": "Sensitivity",
|
|
247
|
+
"description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
|
|
248
|
+
"type": "string",
|
|
249
|
+
"enum": [
|
|
250
|
+
"normal",
|
|
251
|
+
"high"
|
|
252
|
+
]
|
|
253
|
+
},
|
|
220
254
|
"Provenance": {
|
|
221
255
|
"title": "Provenance",
|
|
222
256
|
"description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
|
|
@@ -419,6 +453,24 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
|
|
|
419
453
|
"type": "integer",
|
|
420
454
|
"minimum": 0
|
|
421
455
|
},
|
|
456
|
+
"ReleaseRequirement": {
|
|
457
|
+
"title": "ReleaseRequirement",
|
|
458
|
+
"description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
|
|
459
|
+
"type": "string",
|
|
460
|
+
"enum": [
|
|
461
|
+
"consent",
|
|
462
|
+
"stepUp"
|
|
463
|
+
]
|
|
464
|
+
},
|
|
465
|
+
"Sensitivity": {
|
|
466
|
+
"title": "Sensitivity",
|
|
467
|
+
"description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
|
|
468
|
+
"type": "string",
|
|
469
|
+
"enum": [
|
|
470
|
+
"normal",
|
|
471
|
+
"high"
|
|
472
|
+
]
|
|
473
|
+
},
|
|
422
474
|
"Provenance": {
|
|
423
475
|
"title": "Provenance",
|
|
424
476
|
"description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
|
|
@@ -17,6 +17,15 @@ export interface PersonaLocalProfilePutPayload {
|
|
|
17
17
|
* @maxItems 64
|
|
18
18
|
*/
|
|
19
19
|
entries: {
|
|
20
|
+
/**
|
|
21
|
+
* A value the holder keeps in this context and nowhere else.
|
|
22
|
+
*
|
|
23
|
+
* Deliberately NARROWER than a pool profile's inline entry, which also carries `provenance` and requires it. There is no `provenance` member here, and its absence is a rule rather than an omission: a `credentialBacked` provenance names a `credentialId` and a `claimPath`, and a value authored inside a context has nowhere to put either. So a context-local value is SELF-ASSERTED by construction, and a maintainer MUST present it as such.
|
|
24
|
+
*
|
|
25
|
+
* That is the same boundary the missing `ref`, pinned and override forms enforce, one member along. Those stop a context-authored object acquiring pool REACH; this stops it acquiring an issuer's AUTHORITY — asserting that a value is attested when no credential was ever checked, over a value the issuer never saw. A holder who needs a context to present an attested claim binds a pool profile, which is holder-authorized, rather than authoring one here.
|
|
26
|
+
*
|
|
27
|
+
* Adding a `provenance` member to this object would therefore be a privilege escalation dressed as a convenience, not a gap to fill.
|
|
28
|
+
*/
|
|
20
29
|
inline: {
|
|
21
30
|
type: ClaimType;
|
|
22
31
|
valueType: ValueType;
|
|
@@ -108,6 +117,7 @@ export const PAYLOAD_SCHEMA = {
|
|
|
108
117
|
"description": "Inline entries only. The `ref`, pinned and override forms of a pool profile are absent from this schema deliberately — a context-local profile that could reference the pool would be a context-authored object acquiring pool reach, which is exactly what the boundary exists to prevent.",
|
|
109
118
|
"properties": {
|
|
110
119
|
"inline": {
|
|
120
|
+
"description": "A value the holder keeps in this context and nowhere else.\n\nDeliberately NARROWER than a pool profile's inline entry, which also carries `provenance` and requires it. There is no `provenance` member here, and its absence is a rule rather than an omission: a `credentialBacked` provenance names a `credentialId` and a `claimPath`, and a value authored inside a context has nowhere to put either. So a context-local value is SELF-ASSERTED by construction, and a maintainer MUST present it as such.\n\nThat is the same boundary the missing `ref`, pinned and override forms enforce, one member along. Those stop a context-authored object acquiring pool REACH; this stops it acquiring an issuer's AUTHORITY — asserting that a value is attested when no credential was ever checked, over a value the issuer never saw. A holder who needs a context to present an attested claim binds a pool profile, which is holder-authorized, rather than authoring one here.\n\nAdding a `provenance` member to this object would therefore be a privilege escalation dressed as a convenience, not a gap to fill.",
|
|
111
121
|
"type": "object",
|
|
112
122
|
"additionalProperties": false,
|
|
113
123
|
"required": [
|