@openvtc/trust-tasks 0.22.6 → 0.22.7

package/src/auth/step-up/approver/revoke/0.1/payload.ts

@@ -0,0 +1,352 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approver/revoke/0.1/payload.schema.json
+ */
+
+import type { Approver, ApproverDid, ApproverLabel, EnrolledVia, Ext } from "../../../../../_shared/components.js";
+
+
+/**
+ * Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthStepUpApproverRevokePayload {
+  /**
+   * The approver to revoke.
+   */
+  approverDid: ApproverDid;
+  /**
+   * The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.
+   */
+  subject?: string;
+  /**
+   * Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.
+   */
+  reason?: string;
+  ext?: Ext;
+}
+/**
+ * The revoked binding, when it was revoked, and how many approvers the subject still holds.
+ */
+export interface AuthStepUpApproverRevokeResponsePayload {
+  revoked: Approver;
+  /**
+   * When the binding was revoked — the original time when the approver was already revoked.
+   */
+  revokedAt: string;
+  /**
+   * The subject's live approvers after the revocation. Zero is legitimate and recoverable.
+   */
+  remainingApprovers: number;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Approver, ApproverDid, ApproverLabel, EnrolledVia, Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproverRevokePayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproverRevokeResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1",
+  "title": "Auth — Step-up Approver Revoke — payload",
+  "description": "Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "approverDid"
+  ],
+  "properties": {
+    "approverDid": {
+      "$ref": "#/$defs/ApproverDid",
+      "description": "The approver to revoke."
+    },
+    "subject": {
+      "type": "string",
+      "pattern": "^did:",
+      "minLength": 5,
+      "maxLength": 2048,
+      "description": "The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 500,
+      "description": "Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Step-up Approver Revoke — response payload",
+      "description": "The revoked binding, when it was revoked, and how many approvers the subject still holds.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "revoked",
+        "revokedAt",
+        "remainingApprovers"
+      ],
+      "properties": {
+        "revoked": {
+          "$ref": "#/$defs/Approver"
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the binding was revoked — the original time when the approver was already revoked."
+        },
+        "remainingApprovers": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 5,
+          "description": "The subject's live approvers after the revocation. Zero is legitimate and recoverable."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Approver": {
+      "title": "Approver",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "approverDid",
+        "subject",
+        "enrolledAt",
+        "enrolledVia"
+      ],
+      "description": "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.",
+      "properties": {
+        "approverDid": {
+          "$ref": "#/$defs/ApproverDid"
+        },
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party."
+        },
+        "label": {
+          "$ref": "#/$defs/ApproverLabel"
+        },
+        "enrolledAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the binding was written."
+        },
+        "enrolledVia": {
+          "$ref": "#/$defs/EnrolledVia"
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When a statement by this approver last satisfied a step-up. Absent when it never has."
+        }
+      }
+    },
+    "EnrolledVia": {
+      "title": "EnrolledVia",
+      "type": "string",
+      "enum": [
+        "install",
+        "invite",
+        "selfService",
+        "offline"
+      ],
+      "description": "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator."
+    },
+    "ApproverLabel": {
+      "title": "ApproverLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen."
+    },
+    "ApproverDid": {
+      "title": "ApproverDid",
+      "type": "string",
+      "minLength": 16,
+      "maxLength": 128,
+      "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Step-up Approver Revoke — response payload",
+      "description": "The revoked binding, when it was revoked, and how many approvers the subject still holds.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "revoked",
+        "revokedAt",
+        "remainingApprovers"
+      ],
+      "properties": {
+        "revoked": {
+          "$ref": "#/$defs/Approver"
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the binding was revoked — the original time when the approver was already revoked."
+        },
+        "remainingApprovers": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 5,
+          "description": "The subject's live approvers after the revocation. Zero is legitimate and recoverable."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Approver": {
+      "title": "Approver",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "approverDid",
+        "subject",
+        "enrolledAt",
+        "enrolledVia"
+      ],
+      "description": "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.",
+      "properties": {
+        "approverDid": {
+          "$ref": "#/$defs/ApproverDid"
+        },
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party."
+        },
+        "label": {
+          "$ref": "#/$defs/ApproverLabel"
+        },
+        "enrolledAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the binding was written."
+        },
+        "enrolledVia": {
+          "$ref": "#/$defs/EnrolledVia"
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When a statement by this approver last satisfied a step-up. Absent when it never has."
+        }
+      }
+    },
+    "EnrolledVia": {
+      "title": "EnrolledVia",
+      "type": "string",
+      "enum": [
+        "install",
+        "invite",
+        "selfService",
+        "offline"
+      ],
+      "description": "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator."
+    },
+    "ApproverLabel": {
+      "title": "ApproverLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen."
+    },
+    "ApproverDid": {
+      "title": "ApproverDid",
+      "type": "string",
+      "minLength": 16,
+      "maxLength": 128,
+      "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/index.ts

@@ -15,13 +15,20 @@ export * as FrameworkShared_v0_2 from "./_framework/0.2/framework.js";
 export * as FrameworkShared_v0_3 from "./_framework/0.3/framework.js";
 export * as FrameworkShared_v0_4 from "./_framework/0.4/framework.js";
 export * as AclEntryShared_v0_1 from "./acl/_shared/0.1/acl-entry.js";
+export * as AclEntryShared_v0_2 from "./acl/_shared/0.2/acl-entry.js";
 export * as AclChangeRole_v0_1 from "./acl/change-role/0.1/payload.js";
+export * as AclChangeRole_v0_2 from "./acl/change-role/0.2/payload.js";
 export * as AclGrant_v0_1 from "./acl/grant/0.1/payload.js";
+export * as AclGrant_v0_2 from "./acl/grant/0.2/payload.js";
 export * as AclList_v0_1 from "./acl/list/0.1/payload.js";
+export * as AclList_v0_2 from "./acl/list/0.2/payload.js";
 export * as AclRevoke_v0_1 from "./acl/revoke/0.1/payload.js";
+export * as AclRevoke_v0_2 from "./acl/revoke/0.2/payload.js";
 export * as AclShow_v0_1 from "./acl/show/0.1/payload.js";
+export * as AclShow_v0_2 from "./acl/show/0.2/payload.js";
 export * as AclSwapKey_v0_1 from "./acl/swap-key/0.1/payload.js";
 export * as AclUpdate_v0_1 from "./acl/update/0.1/payload.js";
+export * as AclUpdate_v0_2 from "./acl/update/0.2/payload.js";
 export * as AuditShared_v0_1 from "./audit/_shared/0.1/audit.js";
 export * as AuditList_v0_1 from "./audit/list/0.1/payload.js";
 export * as AuditVerify_v0_1 from "./audit/verify/0.1/payload.js";
@@ -70,11 +77,21 @@ export * as AuthSigningKeyRevoke_v0_1 from "./auth/signing-key/revoke/0.1/payloa
 export * as AuthStepUpApproveRequest_v0_1 from "./auth/step-up/approve-request/0.1/payload.js";
 export * as AuthStepUpApproveRequest_v0_2 from "./auth/step-up/approve-request/0.2/payload.js";
 export * as AuthStepUpApproveRequest_v0_3 from "./auth/step-up/approve-request/0.3/payload.js";
+export * as AuthStepUpApproveRequest_v0_4 from "./auth/step-up/approve-request/0.4/payload.js";
 export * as AuthStepUpApproveResponse_v0_1 from "./auth/step-up/approve-response/0.1/payload.js";
 export * as AuthStepUpApproveResponse_v0_2 from "./auth/step-up/approve-response/0.2/payload.js";
 export * as AuthStepUpApproveResponse_v0_3 from "./auth/step-up/approve-response/0.3/payload.js";
 export * as AuthStepUpApproveResponse_v0_4 from "./auth/step-up/approve-response/0.4/payload.js";
 export * as AuthStepUpApproveResponse_v0_5 from "./auth/step-up/approve-response/0.5/payload.js";
+export * as AuthStepUpApproveResponse_v0_6 from "./auth/step-up/approve-response/0.6/payload.js";
+export * as ApproverShared_v0_1 from "./auth/step-up/approver/_shared/0.1/approver.js";
+export * as AuthStepUpApproverAttest_v0_1 from "./auth/step-up/approver/attest/0.1/payload.js";
+export * as AuthStepUpApproverEnroll_v0_1 from "./auth/step-up/approver/enroll/0.1/payload.js";
+export * as AuthStepUpApproverInvite_v0_1 from "./auth/step-up/approver/invite/0.1/payload.js";
+export * as AuthStepUpApproverList_v0_1 from "./auth/step-up/approver/list/0.1/payload.js";
+export * as AuthStepUpApproverRedeemFinish_v0_1 from "./auth/step-up/approver/redeem/finish/0.1/payload.js";
+export * as AuthStepUpApproverRedeemStart_v0_1 from "./auth/step-up/approver/redeem/start/0.1/payload.js";
+export * as AuthStepUpApproverRevoke_v0_1 from "./auth/step-up/approver/revoke/0.1/payload.js";
 export * as AuthStepUpPolicy_v0_1 from "./auth/step-up/policy/0.1/payload.js";
 export * as AuthStepUpPolicy_v0_2 from "./auth/step-up/policy/0.2/payload.js";
 export * as AuthStepUpStart_v0_1 from "./auth/step-up/start/0.1/payload.js";
@@ -406,6 +423,7 @@ export * as SyncEvent_v0_1 from "./sync/event/0.1/payload.js";
 export * as SyncEvent_v0_2 from "./sync/event/0.2/payload.js";
 export * as TaskConsentShared_v0_1 from "./task-consent/_shared/0.1/task-consent.js";
 export * as TaskConsentDecision_v0_1 from "./task-consent/decision/0.1/payload.js";
+export * as TaskConsentDecision_v0_2 from "./task-consent/decision/0.2/payload.js";
 export * as TaskConsentGranted_v0_1 from "./task-consent/granted/0.1/payload.js";
 export * as TaskConsentRequest_v0_1 from "./task-consent/request/0.1/payload.js";
 export * as TrustCeremonyReceipt_v0_1 from "./trust-ceremony-receipt/0.1/payload.js";
@@ -603,6 +621,11 @@ export * as VetterProfileShared_v0_1 from "./vtc/_shared/0.1/vetter-profile.js";
 export * as VettingAutoGrantShared_v0_1 from "./vtc/_shared/0.1/vetting-auto-grant.js";
 export * as WebsiteTransferShared_v0_1 from "./vtc/_shared/0.1/website-transfer.js";
 export * as SchemaRegistryShared_v0_2 from "./vtc/_shared/0.2/schema-registry.js";
+export * as ActionShared_v0_1 from "./vtc/admin/actions/_shared/0.1/action.js";
+export * as VtcAdminActionsAcknowledge_v0_1 from "./vtc/admin/actions/acknowledge/0.1/payload.js";
+export * as VtcAdminActionsCancel_v0_1 from "./vtc/admin/actions/cancel/0.1/payload.js";
+export * as VtcAdminActionsList_v0_1 from "./vtc/admin/actions/list/0.1/payload.js";
+export * as VtcAdminActionsShow_v0_1 from "./vtc/admin/actions/show/0.1/payload.js";
 export * as VtcAdminBootstrap_v0_1 from "./vtc/admin/bootstrap/0.1/payload.js";
 export * as VtcAdminInvitesCreate_v0_1 from "./vtc/admin/invites/create/0.1/payload.js";
 export * as VtcAdminInvitesList_v0_1 from "./vtc/admin/invites/list/0.1/payload.js";
@@ -635,8 +658,10 @@ export * as VtcEndorsementsRevoke_v0_1 from "./vtc/endorsements/revoke/0.1/paylo
 export * as VtcEndorsementsShow_v0_1 from "./vtc/endorsements/show/0.1/payload.js";
 export * as VtcInstallClaimFinish_v0_1 from "./vtc/install/claim/finish/0.1/payload.js";
 export * as VtcInstallClaimFinish_v0_2 from "./vtc/install/claim/finish/0.2/payload.js";
+export * as VtcInstallClaimFinish_v0_3 from "./vtc/install/claim/finish/0.3/payload.js";
 export * as VtcInstallClaimStart_v0_1 from "./vtc/install/claim/start/0.1/payload.js";
 export * as VtcInstallClaimStart_v0_2 from "./vtc/install/claim/start/0.2/payload.js";
+export * as VtcInstallClaimStart_v0_3 from "./vtc/install/claim/start/0.3/payload.js";
 export * as VtcInvitationsDeliver_v0_1 from "./vtc/invitations/deliver/0.1/payload.js";
 export * as VtcInvitationsIssue_v0_1 from "./vtc/invitations/issue/0.1/payload.js";
 export * as VtcInvitationsList_v0_1 from "./vtc/invitations/list/0.1/payload.js";
@@ -660,6 +685,7 @@ export * as VtcJoinRequestsSupplement_v0_1 from "./vtc/join-requests/supplement/
 export * as VtcJoinRequestsVettingShow_v0_1 from "./vtc/join-requests/vetting/show/0.1/payload.js";
 export * as VtcJoinRequestsWithdraw_v0_1 from "./vtc/join-requests/withdraw/0.1/payload.js";
 export * as VtcMembersAdminRemove_v0_1 from "./vtc/members/admin-remove/0.1/payload.js";
+export * as VtcMembersAuthorityReducedNotice_v0_1 from "./vtc/members/authority-reduced-notice/0.1/payload.js";
 export * as VtcMembersCredentials_v0_1 from "./vtc/members/credentials/0.1/payload.js";
 export * as VtcMembersList_v0_1 from "./vtc/members/list/0.1/payload.js";
 export * as VtcMembersPersonhoodAssert_v0_1 from "./vtc/members/personhood/assert/0.1/payload.js";
@@ -698,6 +724,11 @@ export * as VtcRelationshipsRestore_v0_1 from "./vtc/relationships/restore/0.1/p
 export * as VtcRelationshipsRevoke_v0_1 from "./vtc/relationships/revoke/0.1/payload.js";
 export * as VtcRelationshipsRevoke_v0_2 from "./vtc/relationships/revoke/0.2/payload.js";
 export * as VtcRelationshipsSuspend_v0_1 from "./vtc/relationships/suspend/0.1/payload.js";
+export * as RoleShared_v0_1 from "./vtc/roles/_shared/0.1/role.js";
+export * as VtcRolesDefine_v0_1 from "./vtc/roles/define/0.1/payload.js";
+export * as VtcRolesDelete_v0_1 from "./vtc/roles/delete/0.1/payload.js";
+export * as VtcRolesList_v0_1 from "./vtc/roles/list/0.1/payload.js";
+export * as VtcRolesShow_v0_1 from "./vtc/roles/show/0.1/payload.js";
 export * as VtcRoomsList_v0_1 from "./vtc/rooms/list/0.1/payload.js";
 export * as VtcSchemasAcceptsDelete_v0_1 from "./vtc/schemas/accepts/delete/0.1/payload.js";
 export * as VtcSchemasAcceptsList_v0_1 from "./vtc/schemas/accepts/list/0.1/payload.js";