@openvtc/trust-tasks 0.22.6 → 0.22.7

package/dist/auth/step-up/approver/revoke/0.1/payload.d.ts

@@ -0,0 +1,534 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approver/revoke/0.1/payload.schema.json
+ */
+import type { Approver, ApproverDid, ApproverLabel, EnrolledVia, Ext } from "../../../../../_shared/components.js";
+/**
+ * Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthStepUpApproverRevokePayload {
+    /**
+     * The approver to revoke.
+     */
+    approverDid: ApproverDid;
+    /**
+     * The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.
+     */
+    subject?: string;
+    /**
+     * Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/**
+ * The revoked binding, when it was revoked, and how many approvers the subject still holds.
+ */
+export interface AuthStepUpApproverRevokeResponsePayload {
+    revoked: Approver;
+    /**
+     * When the binding was revoked — the original time when the approver was already revoked.
+     */
+    revokedAt: string;
+    /**
+     * The subject's live approvers after the revocation. Zero is legitimate and recoverable.
+     */
+    remainingApprovers: number;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Approver, ApproverDid, ApproverLabel, EnrolledVia, Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproverRevokePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproverRevokeResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1";
+    readonly title: "Auth — Step-up Approver Revoke — payload";
+    readonly description: "Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["approverDid"];
+    readonly properties: {
+        readonly approverDid: {
+            readonly $ref: "#/$defs/ApproverDid";
+            readonly description: "The approver to revoke.";
+        };
+        readonly subject: {
+            readonly type: "string";
+            readonly pattern: "^did:";
+            readonly minLength: 5;
+            readonly maxLength: 2048;
+            readonly description: "The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 500;
+            readonly description: "Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth — Step-up Approver Revoke — response payload";
+            readonly description: "The revoked binding, when it was revoked, and how many approvers the subject still holds.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["revoked", "revokedAt", "remainingApprovers"];
+            readonly properties: {
+                readonly revoked: {
+                    readonly $ref: "#/$defs/Approver";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the binding was revoked — the original time when the approver was already revoked.";
+                };
+                readonly remainingApprovers: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly maximum: 5;
+                    readonly description: "The subject's live approvers after the revocation. Zero is legitimate and recoverable.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Approver: {
+            readonly title: "Approver";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["approverDid", "subject", "enrolledAt", "enrolledVia"];
+            readonly description: "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.";
+            readonly properties: {
+                readonly approverDid: {
+                    readonly $ref: "#/$defs/ApproverDid";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly description: "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.";
+                };
+                readonly label: {
+                    readonly $ref: "#/$defs/ApproverLabel";
+                };
+                readonly enrolledAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the binding was written.";
+                };
+                readonly enrolledVia: {
+                    readonly $ref: "#/$defs/EnrolledVia";
+                };
+                readonly lastUsedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When a statement by this approver last satisfied a step-up. Absent when it never has.";
+                };
+            };
+        };
+        readonly EnrolledVia: {
+            readonly title: "EnrolledVia";
+            readonly type: "string";
+            readonly enum: readonly ["install", "invite", "selfService", "offline"];
+            readonly description: "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.";
+        };
+        readonly ApproverLabel: {
+            readonly title: "ApproverLabel";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly description: "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.";
+        };
+        readonly ApproverDid: {
+            readonly title: "ApproverDid";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly maxLength: 128;
+            readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+            readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth — Step-up Approver Revoke — response payload";
+            readonly description: "The revoked binding, when it was revoked, and how many approvers the subject still holds.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["revoked", "revokedAt", "remainingApprovers"];
+            readonly properties: {
+                readonly revoked: {
+                    readonly $ref: "#/$defs/Approver";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the binding was revoked — the original time when the approver was already revoked.";
+                };
+                readonly remainingApprovers: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly maximum: 5;
+                    readonly description: "The subject's live approvers after the revocation. Zero is legitimate and recoverable.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Approver: {
+            readonly title: "Approver";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["approverDid", "subject", "enrolledAt", "enrolledVia"];
+            readonly description: "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.";
+            readonly properties: {
+                readonly approverDid: {
+                    readonly $ref: "#/$defs/ApproverDid";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly description: "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.";
+                };
+                readonly label: {
+                    readonly $ref: "#/$defs/ApproverLabel";
+                };
+                readonly enrolledAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the binding was written.";
+                };
+                readonly enrolledVia: {
+                    readonly $ref: "#/$defs/EnrolledVia";
+                };
+                readonly lastUsedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When a statement by this approver last satisfied a step-up. Absent when it never has.";
+                };
+            };
+        };
+        readonly EnrolledVia: {
+            readonly title: "EnrolledVia";
+            readonly type: "string";
+            readonly enum: readonly ["install", "invite", "selfService", "offline"];
+            readonly description: "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.";
+        };
+        readonly ApproverLabel: {
+            readonly title: "ApproverLabel";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly description: "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.";
+        };
+        readonly ApproverDid: {
+            readonly title: "ApproverDid";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly maxLength: 128;
+            readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+            readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1";
+        readonly title: "Auth — Step-up Approver Revoke — payload";
+        readonly description: "Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["approverDid"];
+        readonly properties: {
+            readonly approverDid: {
+                readonly $ref: "#/$defs/ApproverDid";
+                readonly description: "The approver to revoke.";
+            };
+            readonly subject: {
+                readonly type: "string";
+                readonly pattern: "^did:";
+                readonly minLength: 5;
+                readonly maxLength: 2048;
+                readonly description: "The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 500;
+                readonly description: "Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth — Step-up Approver Revoke — response payload";
+                readonly description: "The revoked binding, when it was revoked, and how many approvers the subject still holds.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["revoked", "revokedAt", "remainingApprovers"];
+                readonly properties: {
+                    readonly revoked: {
+                        readonly $ref: "#/$defs/Approver";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the binding was revoked — the original time when the approver was already revoked.";
+                    };
+                    readonly remainingApprovers: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly maximum: 5;
+                        readonly description: "The subject's live approvers after the revocation. Zero is legitimate and recoverable.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Approver: {
+                readonly title: "Approver";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["approverDid", "subject", "enrolledAt", "enrolledVia"];
+                readonly description: "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.";
+                readonly properties: {
+                    readonly approverDid: {
+                        readonly $ref: "#/$defs/ApproverDid";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly description: "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.";
+                    };
+                    readonly label: {
+                        readonly $ref: "#/$defs/ApproverLabel";
+                    };
+                    readonly enrolledAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the binding was written.";
+                    };
+                    readonly enrolledVia: {
+                        readonly $ref: "#/$defs/EnrolledVia";
+                    };
+                    readonly lastUsedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When a statement by this approver last satisfied a step-up. Absent when it never has.";
+                    };
+                };
+            };
+            readonly EnrolledVia: {
+                readonly title: "EnrolledVia";
+                readonly type: "string";
+                readonly enum: readonly ["install", "invite", "selfService", "offline"];
+                readonly description: "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.";
+            };
+            readonly ApproverLabel: {
+                readonly title: "ApproverLabel";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly description: "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.";
+            };
+            readonly ApproverDid: {
+                readonly title: "ApproverDid";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly maxLength: 128;
+                readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+                readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth — Step-up Approver Revoke — response payload";
+                readonly description: "The revoked binding, when it was revoked, and how many approvers the subject still holds.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["revoked", "revokedAt", "remainingApprovers"];
+                readonly properties: {
+                    readonly revoked: {
+                        readonly $ref: "#/$defs/Approver";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the binding was revoked — the original time when the approver was already revoked.";
+                    };
+                    readonly remainingApprovers: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly maximum: 5;
+                        readonly description: "The subject's live approvers after the revocation. Zero is legitimate and recoverable.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Approver: {
+                readonly title: "Approver";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["approverDid", "subject", "enrolledAt", "enrolledVia"];
+                readonly description: "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.";
+                readonly properties: {
+                    readonly approverDid: {
+                        readonly $ref: "#/$defs/ApproverDid";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly description: "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.";
+                    };
+                    readonly label: {
+                        readonly $ref: "#/$defs/ApproverLabel";
+                    };
+                    readonly enrolledAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the binding was written.";
+                    };
+                    readonly enrolledVia: {
+                        readonly $ref: "#/$defs/EnrolledVia";
+                    };
+                    readonly lastUsedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When a statement by this approver last satisfied a step-up. Absent when it never has.";
+                    };
+                };
+            };
+            readonly EnrolledVia: {
+                readonly title: "EnrolledVia";
+                readonly type: "string";
+                readonly enum: readonly ["install", "invite", "selfService", "offline"];
+                readonly description: "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.";
+            };
+            readonly ApproverLabel: {
+                readonly title: "ApproverLabel";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly description: "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.";
+            };
+            readonly ApproverDid: {
+                readonly title: "ApproverDid";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly maxLength: 128;
+                readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+                readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/auth/step-up/approver/revoke/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/step-up/approver/revoke/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,sCAAsC,CAAC;AAGnH;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,QAAQ,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AAEvE,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,8DAAuE,CAAC;AAEhG,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAEtD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,uEAAgF,CAAC;AAElH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6IjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgH1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}