@openvtc/trust-tasks 0.23.5 → 0.23.7

package/dist/keys/sign-sshsig/0.1/payload.js

@@ -0,0 +1,196 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-sshsig/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/sign-sshsig/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/sign-sshsig/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/keys/sign-sshsig/0.1",
+    "title": "Keys — Sign SSHSIG — payload",
+    "description": "A request for an SSHSIG signature (the OpenSSH `PROTOCOL.sshsig` format git uses for SSH commit signing) over a message digest, made with a key the custodian holds. The producer supplies the digest and the namespace; the custodian builds the signed-data structure itself. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "keyId",
+        "algorithm",
+        "namespace",
+        "hashAlgorithm",
+        "messageHash"
+    ],
+    "properties": {
+        "keyId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Identifier of the key to sign with. The key MUST be `active`."
+        },
+        "algorithm": {
+            "type": "string",
+            "enum": [
+                "EdDSA",
+                "ES256"
+            ],
+            "description": "Signature algorithm, as a JOSE identifier: `EdDSA` with an `ed25519` key (SSH key type `ssh-ed25519`), `ES256` with a `p256` key (`ecdsa-sha2-nistp256`). These are the custodian-held key types SSHSIG defines a signature for. MUST be compatible with the named key's `keyType`. Closed: an unrecognised algorithm is refused, never substituted."
+        },
+        "namespace": {
+            "type": "string",
+            "pattern": "^[!-~]{1,128}$",
+            "description": "The SSHSIG namespace the signature is bound to — `git` for a git commit or tag, `file` for `ssh-keygen -Y sign` over a file. Printable ASCII without spaces. A signature made under one namespace does not verify under another, so the custodian MAY restrict which namespaces a producer may name."
+        },
+        "hashAlgorithm": {
+            "type": "string",
+            "enum": [
+                "sha256",
+                "sha512"
+            ],
+            "description": "The digest algorithm the producer applied to the message, in the SSHSIG spelling (externally owned, carried verbatim). It is written into the signed data, so the verifier recomputes the digest with the same algorithm."
+        },
+        "messageHash": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]+$",
+            "minLength": 43,
+            "maxLength": 86,
+            "description": "The digest of the message, `H(message)` in `PROTOCOL.sshsig`, base64url-encoded without padding: 32 bytes (43 characters) for `sha256`, 64 bytes (86 characters) for `sha512`. The custodian never sees the message itself."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext",
+            "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Keys — Sign SSHSIG — response payload",
+            "description": "The success response to a keys/sign-sshsig request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-sshsig/0.1#response. Failures use trust-task-error, not this shape.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "algorithm",
+                "signature"
+            ],
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+                },
+                "algorithm": {
+                    "type": "string",
+                    "enum": [
+                        "EdDSA",
+                        "ES256"
+                    ],
+                    "description": "The algorithm the signature was made with — the one the request named."
+                },
+                "signature": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_-]+$",
+                    "description": "The raw signature over the SSHSIG signed data, base64url-encoded without padding: 64 bytes for `EdDSA`; for `ES256`, the 64-byte JOSE `r || s` form, which the producer re-encodes as the two SSH `mpint`s when it assembles the SSHSIG blob."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Keys — Sign SSHSIG — response payload",
+            "description": "The success response to a keys/sign-sshsig request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-sshsig/0.1#response. Failures use trust-task-error, not this shape.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "algorithm",
+                "signature"
+            ],
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+                },
+                "algorithm": {
+                    "type": "string",
+                    "enum": [
+                        "EdDSA",
+                        "ES256"
+                    ],
+                    "description": "The algorithm the signature was made with — the one the request named."
+                },
+                "signature": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_-]+$",
+                    "description": "The raw signature over the SSHSIG signed data, base64url-encoded without padding: 64 bytes for `EdDSA`; for `ES256`, the 64-byte JOSE `r || s` form, which the producer re-encodes as the two SSH `mpint`s when it assembles the SSHSIG blob."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/keys/sign-sshsig/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/sign-sshsig/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,kDAA2D,CAAC;AAKpF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,2DAAoE,CAAC;AAKtG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,kDAAkD;IACzD,OAAO,EAAE,8BAA8B;IACvC,aAAa,EAAE,8YAA8Y;IAC7Z,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,OAAO;QACP,WAAW;QACX,WAAW;QACX,eAAe;QACf,aAAa;KACd;IACD,YAAY,EAAE;QACZ,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,+DAA+D;SAC/E;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,OAAO;gBACP,OAAO;aACR;YACD,aAAa,EAAE,sVAAsV;SACtW;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,sSAAsS;SACtT;QACD,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;aACT;YACD,aAAa,EAAE,2NAA2N;SAC3O;QACD,aAAa,EAAE;YACb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,kBAAkB;YAC7B,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,6NAA6N;SAC7O;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,8MAA8M;YAC7N,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,6GAA6G;iBAC7H;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,OAAO;wBACP,OAAO;qBACR;oBACD,aAAa,EAAE,wEAAwE;iBACxF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,kBAAkB;oBAC7B,aAAa,EAAE,+OAA+O;iBAC/P;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,8MAA8M;YAC7N,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,6GAA6G;iBAC7H;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,OAAO;wBACP,OAAO;qBACR;oBACD,aAAa,EAAE,wEAAwE;iBACxF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,kBAAkB;oBAC7B,aAAa,EAAE,+OAA+O;iBAC/P;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}