@openvtc/trust-tasks 0.22.2 → 0.22.4

package/src/vtc/members/step-up-passkey-notice/0.1/payload.ts

@@ -0,0 +1,137 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/members/step-up-passkey-notice/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * The VTC tells a member that a step-up passkey was enrolled for them or revoked from them, naming who acted and when. Unsolicited: the member did not ask, and may be offline.
+ */
+export interface VTCMembersStepUpPasskeyNoticePayload {
+  /**
+   * `enrolled` — a step-up passkey (auth/passkey/enroll/invite or auth/passkey/enroll/finish, purpose stepUp) is now bound to the member. `revoked` — one was unbound (auth/passkey/revoke/finish).
+   */
+  event: "enrolled" | "revoked";
+  /**
+   * The member's own DID — the notice's recipient. Carried in the payload as well as the envelope so that a forwarded notice, detached from its transport, still names its subject.
+   */
+  did: string;
+  /**
+   * Durable identifier of the step-up credential, as auth/passkey/revoke/start and auth/passkey/admin-list carry it: opaque, non-secret metadata, never key material. Lets the member recognise or distinguish a credential without disclosing anything that would help an attacker.
+   */
+  credentialId: string;
+  /**
+   * Who acted: the member themselves (equal to `did`) when they enrolled or revoked it on their own session, or an administrator's DID when they invited the enrollment or revoked for the member. A `by` other than `did` is the signal this task exists to carry — act on someone else's behalf is exactly the account-takeover shape a silent change would hide.
+   */
+  by: string;
+  /**
+   * When the event took effect at the VTC — not when the notice was sent, which differs whenever the member was offline.
+   */
+  at: string;
+  /**
+   * The acting administrator's stated reason, verbatim, when one was given. Absent rather than empty when none was: a community that chose not to explain is itself information. Never populated for a member acting on their own credential — they already know why.
+   */
+  reason?: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/members/step-up-passkey-notice/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCMembersStepUpPasskeyNoticePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/members/step-up-passkey-notice/0.1",
+  "title": "VTC Members — Step-up Passkey Notice — payload",
+  "description": "The VTC tells a member that a step-up passkey was enrolled for them or revoked from them, naming who acted and when. Unsolicited: the member did not ask, and may be offline.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "event",
+    "did",
+    "credentialId",
+    "by",
+    "at"
+  ],
+  "properties": {
+    "event": {
+      "type": "string",
+      "enum": [
+        "enrolled",
+        "revoked"
+      ],
+      "description": "`enrolled` — a step-up passkey (auth/passkey/enroll/invite or auth/passkey/enroll/finish, purpose stepUp) is now bound to the member. `revoked` — one was unbound (auth/passkey/revoke/finish)."
+    },
+    "did": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The member's own DID — the notice's recipient. Carried in the payload as well as the envelope so that a forwarded notice, detached from its transport, still names its subject."
+    },
+    "credentialId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Durable identifier of the step-up credential, as auth/passkey/revoke/start and auth/passkey/admin-list carry it: opaque, non-secret metadata, never key material. Lets the member recognise or distinguish a credential without disclosing anything that would help an attacker."
+    },
+    "by": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Who acted: the member themselves (equal to `did`) when they enrolled or revoked it on their own session, or an administrator's DID when they invited the enrollment or revoked for the member. A `by` other than `did` is the signal this task exists to carry — act on someone else's behalf is exactly the account-takeover shape a silent change would hide."
+    },
+    "at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "When the event took effect at the VTC — not when the notice was sent, which differs whenever the member was offline."
+    },
+    "reason": {
+      "type": "string",
+      "maxLength": 1024,
+      "description": "The acting administrator's stated reason, verbatim, when one was given. Absent rather than empty when none was: a community that chose not to explain is itself information. Never populated for a member acting on their own credential — they already know why."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;