@openvtc/trust-tasks 0.22.5 → 0.22.7

package/src/auth/signing-key/authorize/0.1/payload.ts

@@ -0,0 +1,141 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/signing-key/authorize/0.1/payload.schema.json
+ */
+
+import type { DeviceLabel, Ext, SigningKeyDid, SigningKeyScope } from "../../../../_shared/components.js";
+
+
+/**
+ * The terms of one signing-key enrolment, signed by the identity the key will act for. Exactly the payload of the auth/signing-key/enroll/0.2 document that carries this one as its `authorization`, with that member removed; the consumer compares the two and refuses any difference. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthSigningKeyAuthorizePayload {
+  signingKeyDid: SigningKeyDid;
+  /**
+   * The identity authorizing the delegation. Equal to the document's `issuer`: the identity signs for itself.
+   */
+  identityDid: string;
+  scope: SigningKeyScope;
+  deviceLabel?: DeviceLabel;
+  /**
+   * The lifetime the enrolment requests, as in auth/signing-key/enroll/0.2.
+   */
+  expiresAt?: string;
+  /**
+   * The identity's active key the enrolment replaces, as in auth/signing-key/enroll/0.2. Signed here so an authorization to add a key cannot be reused to remove one.
+   */
+  replaces?: SigningKeyDid;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeviceLabel, Ext, SigningKeyDid, SigningKeyScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/authorize/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSigningKeyAuthorizePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/signing-key/authorize/0.1",
+  "title": "Auth — Signing Key Authorize — payload",
+  "description": "The terms of one signing-key enrolment, signed by the identity the key will act for. Exactly the payload of the auth/signing-key/enroll/0.2 document that carries this one as its `authorization`, with that member removed; the consumer compares the two and refuses any difference. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "signingKeyDid",
+    "identityDid",
+    "scope"
+  ],
+  "properties": {
+    "signingKeyDid": {
+      "$ref": "#/$defs/SigningKeyDid"
+    },
+    "identityDid": {
+      "type": "string",
+      "pattern": "^did:",
+      "minLength": 5,
+      "maxLength": 2048,
+      "description": "The identity authorizing the delegation. Equal to the document's `issuer`: the identity signs for itself."
+    },
+    "scope": {
+      "$ref": "#/$defs/SigningKeyScope"
+    },
+    "deviceLabel": {
+      "$ref": "#/$defs/DeviceLabel"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "The lifetime the enrolment requests, as in auth/signing-key/enroll/0.2."
+    },
+    "replaces": {
+      "$ref": "#/$defs/SigningKeyDid",
+      "description": "The identity's active key the enrolment replaces, as in auth/signing-key/enroll/0.2. Signed here so an authorization to add a key cannot be reused to remove one."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;

package/src/auth/signing-key/enroll/0.2/payload.ts

@@ -0,0 +1,365 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/signing-key/enroll/0.2/payload.schema.json
+ */
+
+import type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope } from "../../../../_shared/components.js";
+
+
+/**
+ * A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires — an operation-bound step-up, or the identity's own signed `authorization` — never by the key's own signature. Optionally replaces one of the identity's active keys in the same step. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthSigningKeyEnrollPayload {
+  signingKeyDid: SigningKeyDid;
+  /**
+   * The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization).
+   */
+  identityDid: string;
+  scope: SigningKeyScope;
+  deviceLabel?: DeviceLabel;
+  /**
+   * A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task.
+   */
+  expiresAt?: string;
+  /**
+   * An active delegation of the same identity to revoke in the same step as this enrolment. For a holder at the consumer's cap on active keys, whose other keys live on devices it no longer has: one authorized enrolment swaps a key out rather than needing a working key to revoke one first. Covered by the authority evidence like every other member, so evidence for adding a key cannot be reused to remove one.
+   */
+  replaces?: SigningKeyDid;
+  /**
+   * A complete, signed auth/signing-key/authorize/0.1 Trust Task document by which `identityDid` itself authorizes this enrolment: its payload is this payload with `authorization` removed. When present and valid it is the authority evidence of control over `identityDid`, in place of an operation-bound step-up. The consumer verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over the members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow.
+   */
+  authorization?: {};
+  ext?: Ext;
+}
+/**
+ * The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.
+ */
+export interface AuthSigningKeyEnrollResponsePayload {
+  signingKey: SigningKey;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/enroll/0.2" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSigningKeyEnrollPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/enroll/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthSigningKeyEnrollResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/signing-key/enroll/0.2",
+  "title": "Auth — Signing Key Enroll — payload",
+  "description": "A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires — an operation-bound step-up, or the identity's own signed `authorization` — never by the key's own signature. Optionally replaces one of the identity's active keys in the same step. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "signingKeyDid",
+    "identityDid",
+    "scope"
+  ],
+  "properties": {
+    "signingKeyDid": {
+      "$ref": "#/$defs/SigningKeyDid"
+    },
+    "identityDid": {
+      "type": "string",
+      "pattern": "^did:",
+      "minLength": 5,
+      "maxLength": 2048,
+      "description": "The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization)."
+    },
+    "scope": {
+      "$ref": "#/$defs/SigningKeyScope"
+    },
+    "deviceLabel": {
+      "$ref": "#/$defs/DeviceLabel"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task."
+    },
+    "replaces": {
+      "$ref": "#/$defs/SigningKeyDid",
+      "description": "An active delegation of the same identity to revoke in the same step as this enrolment. For a holder at the consumer's cap on active keys, whose other keys live on devices it no longer has: one authorized enrolment swaps a key out rather than needing a working key to revoke one first. Covered by the authority evidence like every other member, so evidence for adding a key cannot be reused to remove one."
+    },
+    "authorization": {
+      "type": "object",
+      "description": "A complete, signed auth/signing-key/authorize/0.1 Trust Task document by which `identityDid` itself authorizes this enrolment: its payload is this payload with `authorization` removed. When present and valid it is the authority evidence of control over `identityDid`, in place of an operation-bound step-up. The consumer verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over the members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key Enroll — response payload",
+      "description": "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKey"
+      ],
+      "properties": {
+        "signingKey": {
+          "$ref": "#/$defs/SigningKey"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key Enroll — response payload",
+      "description": "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKey"
+      ],
+      "properties": {
+        "signingKey": {
+          "$ref": "#/$defs/SigningKey"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;