@openvtc/trust-tasks 0.21.11 → 0.21.13

package/dist/auth/signing-key/enroll/0.1/payload.d.ts

@@ -0,0 +1,545 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/signing-key/enroll/0.1/payload.schema.json
+ */
+import type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope } from "../../../../_shared/components.js";
+/**
+ * A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires, never by the key's own signature. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthSigningKeyEnrollPayload {
+    signingKeyDid: SigningKeyDid;
+    /**
+     * The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization).
+     */
+    identityDid: string;
+    scope: SigningKeyScope;
+    deviceLabel?: DeviceLabel;
+    /**
+     * A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task.
+     */
+    expiresAt?: string;
+    ext?: Ext;
+}
+/**
+ * The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.
+ */
+export interface AuthSigningKeyEnrollResponsePayload {
+    signingKey: SigningKey;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/signing-key/enroll/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSigningKeyEnrollPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/signing-key/enroll/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthSigningKeyEnrollResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/signing-key/enroll/0.1";
+    readonly title: "Auth — Signing Key Enroll — payload";
+    readonly description: "A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires, never by the key's own signature. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["signingKeyDid", "identityDid", "scope"];
+    readonly properties: {
+        readonly signingKeyDid: {
+            readonly $ref: "#/$defs/SigningKeyDid";
+        };
+        readonly identityDid: {
+            readonly type: "string";
+            readonly pattern: "^did:";
+            readonly minLength: 5;
+            readonly maxLength: 2048;
+            readonly description: "The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization).";
+        };
+        readonly scope: {
+            readonly $ref: "#/$defs/SigningKeyScope";
+        };
+        readonly deviceLabel: {
+            readonly $ref: "#/$defs/DeviceLabel";
+        };
+        readonly expiresAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly description: "A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth — Signing Key Enroll — response payload";
+            readonly description: "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["signingKey"];
+            readonly properties: {
+                readonly signingKey: {
+                    readonly $ref: "#/$defs/SigningKey";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly SigningKey: {
+            readonly title: "SigningKey";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["signingKeyDid", "identityDid", "scope", "createdAt", "expiresAt", "active"];
+            readonly description: "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.";
+            readonly properties: {
+                readonly signingKeyDid: {
+                    readonly $ref: "#/$defs/SigningKeyDid";
+                };
+                readonly identityDid: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly description: "The identity the key acts for. Included so a holder need not infer it.";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/SigningKeyScope";
+                };
+                readonly deviceLabel: {
+                    readonly $ref: "#/$defs/DeviceLabel";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation was enrolled.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy.";
+                };
+                readonly lastUsedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again.";
+                };
+                readonly active: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree.";
+                };
+            };
+        };
+        readonly DeviceLabel: {
+            readonly title: "DeviceLabel";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke.";
+        };
+        readonly SigningKeyScope: {
+            readonly title: "SigningKeyScope";
+            readonly type: "string";
+            readonly enum: readonly ["console"];
+            readonly description: "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values.";
+        };
+        readonly SigningKeyDid: {
+            readonly title: "SigningKeyDid";
+            readonly type: "string";
+            readonly minLength: 9;
+            readonly maxLength: 256;
+            readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+            readonly description: "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth — Signing Key Enroll — response payload";
+            readonly description: "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["signingKey"];
+            readonly properties: {
+                readonly signingKey: {
+                    readonly $ref: "#/$defs/SigningKey";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly SigningKey: {
+            readonly title: "SigningKey";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["signingKeyDid", "identityDid", "scope", "createdAt", "expiresAt", "active"];
+            readonly description: "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.";
+            readonly properties: {
+                readonly signingKeyDid: {
+                    readonly $ref: "#/$defs/SigningKeyDid";
+                };
+                readonly identityDid: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly description: "The identity the key acts for. Included so a holder need not infer it.";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/SigningKeyScope";
+                };
+                readonly deviceLabel: {
+                    readonly $ref: "#/$defs/DeviceLabel";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation was enrolled.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy.";
+                };
+                readonly lastUsedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again.";
+                };
+                readonly active: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree.";
+                };
+            };
+        };
+        readonly DeviceLabel: {
+            readonly title: "DeviceLabel";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke.";
+        };
+        readonly SigningKeyScope: {
+            readonly title: "SigningKeyScope";
+            readonly type: "string";
+            readonly enum: readonly ["console"];
+            readonly description: "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values.";
+        };
+        readonly SigningKeyDid: {
+            readonly title: "SigningKeyDid";
+            readonly type: "string";
+            readonly minLength: 9;
+            readonly maxLength: 256;
+            readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+            readonly description: "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/signing-key/enroll/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/signing-key/enroll/0.1";
+        readonly title: "Auth — Signing Key Enroll — payload";
+        readonly description: "A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires, never by the key's own signature. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["signingKeyDid", "identityDid", "scope"];
+        readonly properties: {
+            readonly signingKeyDid: {
+                readonly $ref: "#/$defs/SigningKeyDid";
+            };
+            readonly identityDid: {
+                readonly type: "string";
+                readonly pattern: "^did:";
+                readonly minLength: 5;
+                readonly maxLength: 2048;
+                readonly description: "The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization).";
+            };
+            readonly scope: {
+                readonly $ref: "#/$defs/SigningKeyScope";
+            };
+            readonly deviceLabel: {
+                readonly $ref: "#/$defs/DeviceLabel";
+            };
+            readonly expiresAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly description: "A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth — Signing Key Enroll — response payload";
+                readonly description: "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["signingKey"];
+                readonly properties: {
+                    readonly signingKey: {
+                        readonly $ref: "#/$defs/SigningKey";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly SigningKey: {
+                readonly title: "SigningKey";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["signingKeyDid", "identityDid", "scope", "createdAt", "expiresAt", "active"];
+                readonly description: "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.";
+                readonly properties: {
+                    readonly signingKeyDid: {
+                        readonly $ref: "#/$defs/SigningKeyDid";
+                    };
+                    readonly identityDid: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly description: "The identity the key acts for. Included so a holder need not infer it.";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/SigningKeyScope";
+                    };
+                    readonly deviceLabel: {
+                        readonly $ref: "#/$defs/DeviceLabel";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation was enrolled.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy.";
+                    };
+                    readonly lastUsedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again.";
+                    };
+                    readonly active: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree.";
+                    };
+                };
+            };
+            readonly DeviceLabel: {
+                readonly title: "DeviceLabel";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke.";
+            };
+            readonly SigningKeyScope: {
+                readonly title: "SigningKeyScope";
+                readonly type: "string";
+                readonly enum: readonly ["console"];
+                readonly description: "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values.";
+            };
+            readonly SigningKeyDid: {
+                readonly title: "SigningKeyDid";
+                readonly type: "string";
+                readonly minLength: 9;
+                readonly maxLength: 256;
+                readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+                readonly description: "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/signing-key/enroll/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth — Signing Key Enroll — response payload";
+                readonly description: "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["signingKey"];
+                readonly properties: {
+                    readonly signingKey: {
+                        readonly $ref: "#/$defs/SigningKey";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly SigningKey: {
+                readonly title: "SigningKey";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["signingKeyDid", "identityDid", "scope", "createdAt", "expiresAt", "active"];
+                readonly description: "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.";
+                readonly properties: {
+                    readonly signingKeyDid: {
+                        readonly $ref: "#/$defs/SigningKeyDid";
+                    };
+                    readonly identityDid: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly description: "The identity the key acts for. Included so a holder need not infer it.";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/SigningKeyScope";
+                    };
+                    readonly deviceLabel: {
+                        readonly $ref: "#/$defs/DeviceLabel";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation was enrolled.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy.";
+                    };
+                    readonly lastUsedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again.";
+                    };
+                    readonly active: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree.";
+                    };
+                };
+            };
+            readonly DeviceLabel: {
+                readonly title: "DeviceLabel";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke.";
+            };
+            readonly SigningKeyScope: {
+                readonly title: "SigningKeyScope";
+                readonly type: "string";
+                readonly enum: readonly ["console"];
+                readonly description: "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values.";
+            };
+            readonly SigningKeyDid: {
+                readonly title: "SigningKeyDid";
+                readonly type: "string";
+                readonly minLength: 9;
+                readonly maxLength: 256;
+                readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+                readonly description: "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/auth/signing-key/enroll/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/signing-key/enroll/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGtH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,aAAa,CAAC;IAC7B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAE7E,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,yDAAkE,CAAC;AAE3F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,kEAA2E,CAAC;AAE7G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,mCAAmC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmJjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgH1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}