@openvtc/trust-tasks 0.20.7 → 0.21.0

package/src/auth/passkey/enroll/redeem/start/0.1/payload.ts

@@ -0,0 +1,700 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/passkey/enroll/redeem/start/0.1/payload.schema.json
+ */
+
+import type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../../_shared/components.js";
+
+
+/**
+ * The invitee presents an auth/passkey/enroll/invite token and its claim code, and the auth service begins the WebAuthn registration ceremony the invite authorises.
+ */
+export interface AuthPasskeyEnrollRedeemStart {
+  /**
+   * The invite token, as carried in the invite URL.
+   */
+  token: string;
+  /**
+   * The claim code the administrator delivered separately.
+   */
+  claimCode: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The registration ceremony the invite authorises.
+ */
+export interface AuthPasskeyEnrollRedeemStartResponsePayload {
+  /**
+   * Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim.
+   */
+  enrollmentId: string;
+  /**
+   * The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it.
+   */
+  subject: string;
+  /**
+   * What the credential will authenticate, from the invite.
+   */
+  purpose: "session" | "stepUp";
+  /**
+   * The inviter's suggested label, if any. The invitee MAY override it at finish.
+   */
+  deviceLabel?: string;
+  /**
+   * PublicKeyCredentialCreationOptions for navigator.credentials.create.
+   */
+  options: PublicKeyCredentialCreationOptions;
+  /**
+   * PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish.
+   */
+  uvOptions?: PublicKeyCredentialRequestOptions;
+  /**
+   * When this ceremony lapses (not the invite).
+   */
+  expiresAt: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollRedeemStart;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollRedeemStartResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1",
+  "title": "Auth — Passkey Enroll (redeem, start)",
+  "description": "The invitee presents an auth/passkey/enroll/invite token and its claim code, and the auth service begins the WebAuthn registration ceremony the invite authorises.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "token",
+    "claimCode"
+  ],
+  "properties": {
+    "token": {
+      "type": "string",
+      "minLength": 16,
+      "maxLength": 512,
+      "description": "The invite token, as carried in the invite URL."
+    },
+    "claimCode": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "The claim code the administrator delivered separately."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth Passkey Enroll Redeem Start — response payload",
+      "description": "The registration ceremony the invite authorises.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "enrollmentId",
+        "subject",
+        "purpose",
+        "options",
+        "expiresAt"
+      ],
+      "properties": {
+        "enrollmentId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim."
+        },
+        "subject": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it."
+        },
+        "purpose": {
+          "type": "string",
+          "enum": [
+            "session",
+            "stepUp"
+          ],
+          "description": "What the credential will authenticate, from the invite."
+        },
+        "deviceLabel": {
+          "type": "string",
+          "maxLength": 256,
+          "description": "The inviter's suggested label, if any. The invitee MAY override it at finish."
+        },
+        "options": {
+          "$ref": "#/$defs/CredentialCreationOptions",
+          "description": "PublicKeyCredentialCreationOptions for navigator.credentials.create."
+        },
+        "uvOptions": {
+          "$ref": "#/$defs/CredentialRequestOptions",
+          "description": "PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When this ceremony lapses (not the invite)."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "CredentialRequestOptions": {
+      "$anchor": "credentialRequestOptions",
+      "title": "PublicKeyCredentialRequestOptions",
+      "description": "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "challenge"
+      ],
+      "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
+        "challenge": {
+          "type": "string",
+          "description": "base64url-encoded one-time nonce."
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "rpId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "allowCredentials": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/CredentialDescriptor"
+          }
+        },
+        "userVerification": {
+          "enum": [
+            "discouraged",
+            "preferred",
+            "required"
+          ]
+        }
+      }
+    },
+    "CredentialDescriptor": {
+      "$anchor": "credentialDescriptor",
+      "title": "PublicKeyCredentialDescriptor",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "id"
+      ],
+      "properties": {
+        "type": {
+          "const": "public-key"
+        },
+        "id": {
+          "type": "string",
+          "description": "base64url-encoded credential id."
+        },
+        "transports": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "usb",
+              "nfc",
+              "ble",
+              "internal",
+              "hybrid"
+            ]
+          }
+        }
+      }
+    },
+    "CredentialCreationOptions": {
+      "$anchor": "credentialCreationOptions",
+      "title": "PublicKeyCredentialCreationOptions",
+      "description": "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "challenge",
+        "rp",
+        "user",
+        "pubKeyCredParams"
+      ],
+      "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
+        "challenge": {
+          "type": "string",
+          "description": "base64url-encoded one-time nonce."
+        },
+        "rp": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "id",
+            "name"
+          ],
+          "properties": {
+            "id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "name": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64
+            }
+          }
+        },
+        "user": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "id",
+            "name",
+            "displayName"
+          ],
+          "properties": {
+            "id": {
+              "type": "string",
+              "description": "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here."
+            },
+            "name": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64
+            },
+            "displayName": {
+              "type": "string",
+              "maxLength": 64
+            }
+          }
+        },
+        "pubKeyCredParams": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "type",
+              "alg"
+            ],
+            "properties": {
+              "type": {
+                "const": "public-key"
+              },
+              "alg": {
+                "type": "integer",
+                "description": "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256)."
+              }
+            }
+          }
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "excludeCredentials": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/CredentialDescriptor"
+          }
+        },
+        "authenticatorSelection": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "authenticatorAttachment": {
+              "enum": [
+                "platform",
+                "cross-platform"
+              ]
+            },
+            "requireResidentKey": {
+              "type": "boolean"
+            },
+            "residentKey": {
+              "enum": [
+                "discouraged",
+                "preferred",
+                "required"
+              ]
+            },
+            "userVerification": {
+              "enum": [
+                "discouraged",
+                "preferred",
+                "required"
+              ]
+            }
+          }
+        },
+        "attestation": {
+          "enum": [
+            "none",
+            "indirect",
+            "direct",
+            "enterprise"
+          ]
+        }
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth Passkey Enroll Redeem Start — response payload",
+      "description": "The registration ceremony the invite authorises.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "enrollmentId",
+        "subject",
+        "purpose",
+        "options",
+        "expiresAt"
+      ],
+      "properties": {
+        "enrollmentId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim."
+        },
+        "subject": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it."
+        },
+        "purpose": {
+          "type": "string",
+          "enum": [
+            "session",
+            "stepUp"
+          ],
+          "description": "What the credential will authenticate, from the invite."
+        },
+        "deviceLabel": {
+          "type": "string",
+          "maxLength": 256,
+          "description": "The inviter's suggested label, if any. The invitee MAY override it at finish."
+        },
+        "options": {
+          "$ref": "#/$defs/CredentialCreationOptions",
+          "description": "PublicKeyCredentialCreationOptions for navigator.credentials.create."
+        },
+        "uvOptions": {
+          "$ref": "#/$defs/CredentialRequestOptions",
+          "description": "PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When this ceremony lapses (not the invite)."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "CredentialRequestOptions": {
+      "$anchor": "credentialRequestOptions",
+      "title": "PublicKeyCredentialRequestOptions",
+      "description": "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "challenge"
+      ],
+      "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
+        "challenge": {
+          "type": "string",
+          "description": "base64url-encoded one-time nonce."
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "rpId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "allowCredentials": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/CredentialDescriptor"
+          }
+        },
+        "userVerification": {
+          "enum": [
+            "discouraged",
+            "preferred",
+            "required"
+          ]
+        }
+      }
+    },
+    "CredentialDescriptor": {
+      "$anchor": "credentialDescriptor",
+      "title": "PublicKeyCredentialDescriptor",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "id"
+      ],
+      "properties": {
+        "type": {
+          "const": "public-key"
+        },
+        "id": {
+          "type": "string",
+          "description": "base64url-encoded credential id."
+        },
+        "transports": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "usb",
+              "nfc",
+              "ble",
+              "internal",
+              "hybrid"
+            ]
+          }
+        }
+      }
+    },
+    "CredentialCreationOptions": {
+      "$anchor": "credentialCreationOptions",
+      "title": "PublicKeyCredentialCreationOptions",
+      "description": "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "challenge",
+        "rp",
+        "user",
+        "pubKeyCredParams"
+      ],
+      "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
+        "challenge": {
+          "type": "string",
+          "description": "base64url-encoded one-time nonce."
+        },
+        "rp": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "id",
+            "name"
+          ],
+          "properties": {
+            "id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "name": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64
+            }
+          }
+        },
+        "user": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "id",
+            "name",
+            "displayName"
+          ],
+          "properties": {
+            "id": {
+              "type": "string",
+              "description": "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here."
+            },
+            "name": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64
+            },
+            "displayName": {
+              "type": "string",
+              "maxLength": 64
+            }
+          }
+        },
+        "pubKeyCredParams": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "type",
+              "alg"
+            ],
+            "properties": {
+              "type": {
+                "const": "public-key"
+              },
+              "alg": {
+                "type": "integer",
+                "description": "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256)."
+              }
+            }
+          }
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "excludeCredentials": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/CredentialDescriptor"
+          }
+        },
+        "authenticatorSelection": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "authenticatorAttachment": {
+              "enum": [
+                "platform",
+                "cross-platform"
+              ]
+            },
+            "requireResidentKey": {
+              "type": "boolean"
+            },
+            "residentKey": {
+              "enum": [
+                "discouraged",
+                "preferred",
+                "required"
+              ]
+            },
+            "userVerification": {
+              "enum": [
+                "discouraged",
+                "preferred",
+                "required"
+              ]
+            }
+          }
+        },
+        "attestation": {
+          "enum": [
+            "none",
+            "indirect",
+            "direct",
+            "enterprise"
+          ]
+        }
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;