@openvtc/trust-tasks 0.22.5 → 0.22.7

package/dist/auth/step-up/approver/enroll/0.1/payload.js

@@ -0,0 +1,285 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approver/enroll/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approver/enroll/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approver/enroll/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/auth/step-up/approver/enroll/0.1",
+    "title": "Auth — Step-up Approver Enroll — payload",
+    "description": "A subject who already holds a step-up factor adds a step-up approver, optionally replacing one of theirs in the same step. The enrolment terms are this payload with `statement` removed; the new approver's statement binds a digest of them. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "approverDid"
+    ],
+    "properties": {
+        "approverDid": {
+            "$ref": "#/$defs/ApproverDid",
+            "description": "The step-up approver to bind. MUST equal the statement's issuer."
+        },
+        "label": {
+            "$ref": "#/$defs/ApproverLabel"
+        },
+        "replaces": {
+            "$ref": "#/$defs/ApproverDid",
+            "description": "A live approver of the same subject to revoke in the same step. Part of the enrolment terms, so the authority evidence for adding an approver cannot be reused to remove one."
+        },
+        "statement": {
+            "$ref": "#/$defs/AttestStatement",
+            "description": "The new approver's complete, signed auth/step-up/approver/attest/0.1 document with `purpose: enrol`, over the challenge of the step-up authorizing this enrolment, with `boundTo` the terms digest defined by this specification. Not part of the enrolment terms. Absent only on a send made to obtain that challenge; an enrolment executes only with it."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth — Step-up Approver Enroll — response payload",
+            "description": "The new binding as stored.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "approver"
+            ],
+            "properties": {
+                "approver": {
+                    "$ref": "#/$defs/Approver"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "Approver": {
+            "title": "Approver",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "approverDid",
+                "subject",
+                "enrolledAt",
+                "enrolledVia"
+            ],
+            "description": "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.",
+            "properties": {
+                "approverDid": {
+                    "$ref": "#/$defs/ApproverDid"
+                },
+                "subject": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "minLength": 5,
+                    "maxLength": 2048,
+                    "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party."
+                },
+                "label": {
+                    "$ref": "#/$defs/ApproverLabel"
+                },
+                "enrolledAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the binding was written."
+                },
+                "enrolledVia": {
+                    "$ref": "#/$defs/EnrolledVia"
+                },
+                "lastUsedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When a statement by this approver last satisfied a step-up. Absent when it never has."
+                }
+            }
+        },
+        "EnrolledVia": {
+            "title": "EnrolledVia",
+            "type": "string",
+            "enum": [
+                "install",
+                "invite",
+                "selfService",
+                "offline"
+            ],
+            "description": "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator."
+        },
+        "ApproverLabel": {
+            "title": "ApproverLabel",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "description": "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen."
+        },
+        "ApproverDid": {
+            "title": "ApproverDid",
+            "type": "string",
+            "minLength": 16,
+            "maxLength": 128,
+            "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$",
+            "description": "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party."
+        },
+        "AttestStatement": {
+            "title": "AttestStatement",
+            "type": "object",
+            "minProperties": 1,
+            "description": "A complete, signed auth/step-up/approver/attest/0.1 Trust Task document — envelope, payload and proof — issued by the approver. Deliberately an open object here rather than a typed one: the consumer verifies it as a document in its own right (envelope, proof and payload against that specification's schemas), and verifies its proof over the members exactly as received, which a binding that narrowed it to a typed struct and re-serialised it could silently break."
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth — Step-up Approver Enroll — response payload",
+            "description": "The new binding as stored.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "approver"
+            ],
+            "properties": {
+                "approver": {
+                    "$ref": "#/$defs/Approver"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "Approver": {
+            "title": "Approver",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "approverDid",
+                "subject",
+                "enrolledAt",
+                "enrolledVia"
+            ],
+            "description": "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.",
+            "properties": {
+                "approverDid": {
+                    "$ref": "#/$defs/ApproverDid"
+                },
+                "subject": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "minLength": 5,
+                    "maxLength": 2048,
+                    "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party."
+                },
+                "label": {
+                    "$ref": "#/$defs/ApproverLabel"
+                },
+                "enrolledAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the binding was written."
+                },
+                "enrolledVia": {
+                    "$ref": "#/$defs/EnrolledVia"
+                },
+                "lastUsedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When a statement by this approver last satisfied a step-up. Absent when it never has."
+                }
+            }
+        },
+        "EnrolledVia": {
+            "title": "EnrolledVia",
+            "type": "string",
+            "enum": [
+                "install",
+                "invite",
+                "selfService",
+                "offline"
+            ],
+            "description": "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator."
+        },
+        "ApproverLabel": {
+            "title": "ApproverLabel",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "description": "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen."
+        },
+        "ApproverDid": {
+            "title": "ApproverDid",
+            "type": "string",
+            "minLength": 16,
+            "maxLength": 128,
+            "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$",
+            "description": "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party."
+        },
+        "AttestStatement": {
+            "title": "AttestStatement",
+            "type": "object",
+            "minProperties": 1,
+            "description": "A complete, signed auth/step-up/approver/attest/0.1 Trust Task document — envelope, payload and proof — issued by the approver. Deliberately an open object here rather than a typed one: the consumer verifies it as a document in its own right (envelope, proof and payload against that specification's schemas), and verifies its proof over the members exactly as received, which a binding that narrowed it to a typed struct and re-serialised it could silently break."
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/auth/step-up/approver/enroll/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/step-up/approver/enroll/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,8DAAuE,CAAC;AAKhG,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,uEAAgF,CAAC;AAKlH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,8DAA8D;IACrE,OAAO,EAAE,0CAA0C;IACnD,aAAa,EAAE,6WAA6W;IAC5X,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,aAAa;KACd;IACD,YAAY,EAAE;QACZ,aAAa,EAAE;YACb,MAAM,EAAE,qBAAqB;YAC7B,aAAa,EAAE,kEAAkE;SAClF;QACD,OAAO,EAAE;YACP,MAAM,EAAE,uBAAuB;SAChC;QACD,UAAU,EAAE;YACV,MAAM,EAAE,qBAAqB;YAC7B,aAAa,EAAE,+KAA+K;SAC/L;QACD,WAAW,EAAE;YACX,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,6VAA6V;SAC7W;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,mDAAmD;YAC5D,aAAa,EAAE,4BAA4B;YAC3C,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,SAAS;gBACT,YAAY;gBACZ,aAAa;aACd;YACD,aAAa,EAAE,+MAA+M;YAC9N,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;iBAC9B;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,uBAAuB;iBAChC;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,+BAA+B;iBAC/C;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;iBAC9B;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,uFAAuF;iBACvG;aACF;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,aAAa;gBACb,SAAS;aACV;YACD,aAAa,EAAE,ukBAAukB;SACvlB;QACD,eAAe,EAAE;YACf,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,kQAAkQ;SAClR;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,qCAAqC;YAChD,aAAa,EAAE,weAAwe;SACxf;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,aAAa,EAAE,kdAAkd;SACle;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,mDAAmD;YAC5D,aAAa,EAAE,4BAA4B;YAC3C,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,SAAS;gBACT,YAAY;gBACZ,aAAa;aACd;YACD,aAAa,EAAE,+MAA+M;YAC9N,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;iBAC9B;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,uBAAuB;iBAChC;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,+BAA+B;iBAC/C;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;iBAC9B;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,uFAAuF;iBACvG;aACF;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,aAAa;gBACb,SAAS;aACV;YACD,aAAa,EAAE,ukBAAukB;SACvlB;QACD,eAAe,EAAE;YACf,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,kQAAkQ;SAClR;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,qCAAqC;YAChD,aAAa,EAAE,weAAwe;SACxf;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,aAAa,EAAE,kdAAkd;SACle;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}