@openvtc/trust-tasks 0.23.8 → 0.23.9

package/dist/auth/oob/identify/0.1/payload.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/identify/0.1/payload.schema.json
+ */
+import type { MatchNumber, OobKey, RequestId } from "../../../../_shared/components.js";
+/**
+ * A member's DID states that it holds the lock on one out-of-band request and can see the starter's screen. Issued by the approving DID and signed by its VTA for `authentication`; never sent on its own, only carried inside auth/oob/prove. Closed: additionalProperties false and no `ext`, so a VTA that signs it without user verification signs exactly these three members and nothing else. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBIdentifyPayload {
+    /**
+     * The request being proved for. MUST equal the requestId of the prove that carries this document.
+     */
+    requestId: RequestId;
+    /**
+     * The lock key `K_a`. MUST equal the issuer of the prove that carries this document, so the document cannot be re-wrapped by another device.
+     */
+    approverKey: OobKey;
+    /**
+     * The two digits the member typed from the starter's screen.
+     */
+    enteredNumber: MatchNumber;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { MatchNumber, OobKey, RequestId };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/oob/identify/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBIdentifyPayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/oob/identify/0.1";
+    readonly title: "Auth — OOB Identify — payload";
+    readonly description: "A member's DID states that it holds the lock on one out-of-band request and can see the starter's screen. Issued by the approving DID and signed by its VTA for `authentication`; never sent on its own, only carried inside auth/oob/prove. Closed: additionalProperties false and no `ext`, so a VTA that signs it without user verification signs exactly these three members and nothing else. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["requestId", "approverKey", "enteredNumber"];
+    readonly properties: {
+        readonly requestId: {
+            readonly $ref: "#/$defs/RequestId";
+            readonly description: "The request being proved for. MUST equal the requestId of the prove that carries this document.";
+        };
+        readonly approverKey: {
+            readonly $ref: "#/$defs/OobKey";
+            readonly description: "The lock key `K_a`. MUST equal the issuer of the prove that carries this document, so the document cannot be re-wrapped by another device.";
+        };
+        readonly enteredNumber: {
+            readonly $ref: "#/$defs/MatchNumber";
+            readonly description: "The two digits the member typed from the starter's screen.";
+        };
+    };
+    readonly $defs: {
+        readonly MatchNumber: {
+            readonly title: "MatchNumber";
+            readonly type: "string";
+            readonly pattern: "^[0-9]{2}$";
+            readonly description: "The two-digit number the service chooses at claim, shows only to the starter (through redeem), and the approver types from the starter's screen. A string so that a leading zero survives.";
+        };
+        readonly OobKey: {
+            readonly title: "OobKey";
+            readonly type: "string";
+            readonly minLength: 48;
+            readonly maxLength: 64;
+            readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+            readonly description: "A starter key (`K_b`) or an approver lock key (`K_a`), as an Ed25519 `did:key` (`z6Mk…`) generated for this one request and used nowhere else. Ed25519 only: a service refuses any other key type with `auth/oob:keyUnsupported` before parsing beyond the multicodec prefix.";
+        };
+        readonly RequestId: {
+            readonly title: "RequestId";
+            readonly type: "string";
+            readonly minLength: 22;
+            readonly maxLength: 43;
+            readonly pattern: "^[A-Za-z0-9_-]{22,43}$";
+            readonly description: "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/oob/identify/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/oob/identify/0.1";
+        readonly title: "Auth — OOB Identify — payload";
+        readonly description: "A member's DID states that it holds the lock on one out-of-band request and can see the starter's screen. Issued by the approving DID and signed by its VTA for `authentication`; never sent on its own, only carried inside auth/oob/prove. Closed: additionalProperties false and no `ext`, so a VTA that signs it without user verification signs exactly these three members and nothing else. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["requestId", "approverKey", "enteredNumber"];
+        readonly properties: {
+            readonly requestId: {
+                readonly $ref: "#/$defs/RequestId";
+                readonly description: "The request being proved for. MUST equal the requestId of the prove that carries this document.";
+            };
+            readonly approverKey: {
+                readonly $ref: "#/$defs/OobKey";
+                readonly description: "The lock key `K_a`. MUST equal the issuer of the prove that carries this document, so the document cannot be re-wrapped by another device.";
+            };
+            readonly enteredNumber: {
+                readonly $ref: "#/$defs/MatchNumber";
+                readonly description: "The two digits the member typed from the starter's screen.";
+            };
+        };
+        readonly $defs: {
+            readonly MatchNumber: {
+                readonly title: "MatchNumber";
+                readonly type: "string";
+                readonly pattern: "^[0-9]{2}$";
+                readonly description: "The two-digit number the service chooses at claim, shows only to the starter (through redeem), and the approver types from the starter's screen. A string so that a leading zero survives.";
+            };
+            readonly OobKey: {
+                readonly title: "OobKey";
+                readonly type: "string";
+                readonly minLength: 48;
+                readonly maxLength: 64;
+                readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+                readonly description: "A starter key (`K_b`) or an approver lock key (`K_a`), as an Ed25519 `did:key` (`z6Mk…`) generated for this one request and used nowhere else. Ed25519 only: a service refuses any other key type with `auth/oob:keyUnsupported` before parsing beyond the multicodec prefix.";
+            };
+            readonly RequestId: {
+                readonly title: "RequestId";
+                readonly type: "string";
+                readonly minLength: 22;
+                readonly maxLength: 43;
+                readonly pattern: "^[A-Za-z0-9_-]{22,43}$";
+                readonly description: "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/auth/oob/identify/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/oob/identify/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGxF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,aAAa,EAAE,WAAW,CAAC;CAC5B;AAED,kHAAkH;AAClH,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAE/C,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDjB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC"}

package/dist/auth/oob/identify/0.1/payload.js

@@ -0,0 +1,81 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/identify/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/identify/0.1";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/auth/oob/identify/0.1",
+    "title": "Auth — OOB Identify — payload",
+    "description": "A member's DID states that it holds the lock on one out-of-band request and can see the starter's screen. Issued by the approving DID and signed by its VTA for `authentication`; never sent on its own, only carried inside auth/oob/prove. Closed: additionalProperties false and no `ext`, so a VTA that signs it without user verification signs exactly these three members and nothing else. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "requestId",
+        "approverKey",
+        "enteredNumber"
+    ],
+    "properties": {
+        "requestId": {
+            "$ref": "#/$defs/RequestId",
+            "description": "The request being proved for. MUST equal the requestId of the prove that carries this document."
+        },
+        "approverKey": {
+            "$ref": "#/$defs/OobKey",
+            "description": "The lock key `K_a`. MUST equal the issuer of the prove that carries this document, so the document cannot be re-wrapped by another device."
+        },
+        "enteredNumber": {
+            "$ref": "#/$defs/MatchNumber",
+            "description": "The two digits the member typed from the starter's screen."
+        }
+    },
+    "$defs": {
+        "MatchNumber": {
+            "title": "MatchNumber",
+            "type": "string",
+            "pattern": "^[0-9]{2}$",
+            "description": "The two-digit number the service chooses at claim, shows only to the starter (through redeem), and the approver types from the starter's screen. A string so that a leading zero survives."
+        },
+        "OobKey": {
+            "title": "OobKey",
+            "type": "string",
+            "minLength": 48,
+            "maxLength": 64,
+            "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$",
+            "description": "A starter key (`K_b`) or an approver lock key (`K_a`), as an Ed25519 `did:key` (`z6Mk…`) generated for this one request and used nowhere else. Ed25519 only: a service refuses any other key type with `auth/oob:keyUnsupported` before parsing beyond the multicodec prefix."
+        },
+        "RequestId": {
+            "title": "RequestId",
+            "type": "string",
+            "minLength": 22,
+            "maxLength": 43,
+            "pattern": "^[A-Za-z0-9_-]{22,43}$",
+            "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/auth/oob/identify/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/auth/oob/identify/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,mDAA4D,CAAC;AAKrF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,mDAAmD;IAC1D,OAAO,EAAE,+BAA+B;IACxC,aAAa,EAAE,igBAAigB;IAChhB,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,WAAW;QACX,aAAa;QACb,eAAe;KAChB;IACD,YAAY,EAAE;QACZ,WAAW,EAAE;YACX,MAAM,EAAE,mBAAmB;YAC3B,aAAa,EAAE,iGAAiG;SACjH;QACD,aAAa,EAAE;YACb,MAAM,EAAE,gBAAgB;YACxB,aAAa,EAAE,4IAA4I;SAC5J;QACD,eAAe,EAAE;YACf,MAAM,EAAE,qBAAqB;YAC7B,aAAa,EAAE,4DAA4D;SAC5E;KACF;IACD,OAAO,EAAE;QACP,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,YAAY;YACvB,aAAa,EAAE,4LAA4L;SAC5M;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,qCAAqC;YAChD,aAAa,EAAE,+QAA+Q;SAC/R;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wBAAwB;YACnC,aAAa,EAAE,+YAA+Y;SAC/Z;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC"}