@structured-id/ui-core 1.2.0 → 2.0.0

package/src/generated/sid/v1/identity/identity.ts

@@ -14,9 +14,8 @@ import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
 import { Timestamp } from "../../../google/protobuf/timestamp";
 /**
- * Profile represents a user identity in StructuredID.
- * In CE: Profile IS the user (no separate User entity).
- * In SaaS: Profile is owned by Person (sovereign entity).
+ * Profile represents a user identity in StructuredID: the Profile is the
+ * user (there is no separate User entity).
  *
  * @generated from protobuf message sid.v1.identity.Profile
  */
@@ -34,7 +33,7 @@ export interface Profile {
      */
     profileType: ProfileType;
     /**
-     * Username (CE: local login handle).
+     * Username (local login handle).
      *
      * @generated from protobuf field: optional string username = 3
      */
@@ -128,8 +127,9 @@ export interface Profile {
     principals: Principal[];
 }
 /**
- * Principal represents a verifiable login handle (always authentication-capable).
- * If a value cannot be used for login, it's a Profile Field, not a Principal.
+ * Principal represents a verifiable login handle (always authentication-capable)
+ * claimed by the Profile that lists it. If a value cannot be used for login,
+ * it's a Profile Field, not a Principal.
  *
  * @generated from protobuf message sid.v1.identity.Principal
  */
@@ -147,8 +147,10 @@ export interface Principal {
      */
     type: PrincipalType;
     /**
-     * Principal value: email address, E.164 phone, username string.
-     * Server normalizes on write (lowercase email, E.164 format phone).
+     * The handle as sign-in resolves it, derived by the server: for an email
+     * the resolution key (case, local-part dots and +tag folded), never a
+     * delivery address; mail goes to the linked contact (source_email_id).
+     * E.164 for a phone, the lowercase name for a username.
      *
      * @generated from protobuf field: string value = 3
      */
@@ -175,24 +177,27 @@ export interface Principal {
     updatedAt?: Timestamp;
     /**
      * Links Principal to the ProfilePhone/ProfileEmail it was created from.
-     * Set only for profile-bound principals. Empty for Person-level (SaaS).
      *
      * @generated from protobuf field: optional string source_field = 8
      */
     sourceField?: string;
     /**
-     * Subject type: profile (direct login) or person (picker).
-     * CE/EE: always PROFILE. SaaS: PERSON when personal principal has 2+ profiles.
+     * The ProfileEmail (UUID) whose address this email handle delivers to,
+     * in the spelling given; absent for other types and for a handle whose
+     * address is not known.
      *
-     * @generated from protobuf field: sid.v1.identity.PrincipalSubjectType subject_type = 9
+     * @generated from protobuf field: optional string source_email_id = 11
      */
-    subjectType: PrincipalSubjectType;
+    sourceEmailId?: string;
     /**
-     * Subject ID: ProfileId (when subject_type=PROFILE) or PersonId (when subject_type=PERSON).
+     * An email handle written before the installation's email policy
+     * revisions, its address unknown: still reserved for the account, but no
+     * sign-in, code, link or reset uses it until the owner confirms the
+     * address or an administrator asserts it. Always false for other types.
      *
-     * @generated from protobuf field: string subject_id = 10
+     * @generated from protobuf field: bool needs_address_confirmation = 12
      */
-    subjectId: string;
+    needsAddressConfirmation: boolean;
 }
 // ══════════════════════════════════════════════════════════════════════════
 // Multi-valued contacts — ProfilePhone / ProfileEmail
@@ -374,7 +379,8 @@ export interface WebAuthnCredentialInfo {
     attachment: AuthenticatorAttachment;
     /**
      * Attestation format (e.g., "none", "packed", "fido-u2f", "tpm").
-     * CE stores but does not verify; EE verifies when attestation policy requires it.
+     * Stored; verified only by a server that verifies attestation, when its
+     * attestation policy requires it.
      *
      * @generated from protobuf field: string attestation_format = 5
      */
@@ -407,6 +413,11 @@ export interface Session {
      */
     clientId: string;
     /**
+     * Device the session was issued on (`Device.id`, UUIDv7); unset when the
+     * session is not associated with a registered device. A revocation
+     * association (removing the device ends the session), not proof of key
+     * possession.
+     *
      * @generated from protobuf field: optional string device_id = 4
      */
     deviceId?: string;
@@ -1106,52 +1117,86 @@ export interface DownloadExportChunk {
 export interface AcknowledgeExportRequest {
 }
 /**
- * Known device associated with a profile.
+ * Known device associated with a profile. A descriptive record (DTO), not an
+ * identifier type and not evidence of device authority.
  *
  * @generated from protobuf message sid.v1.identity.Device
  */
 export interface Device {
     /**
+     * Device identifier: UUIDv7 in canonical lowercase hyphenated form. Issued by
+     * SID when the device is registered in the owning Profile's scope; the same
+     * value is carried as `device_id` in session and attestation messages.
+     * Knowing it grants no authority and does not prove key possession.
+     *
      * @generated from protobuf field: string id = 1
      */
     id: string;
     /**
+     * Owning Profile identifier (UUIDv7). Internal identity; never exposed to
+     * external or federated services.
+     *
      * @generated from protobuf field: string profile_id = 2
      */
     profileId: string;
     /**
+     * User-given label for the device (e.g. "Work laptop"). Set by the Profile
+     * owner via UpdateDevice; unset until the user names the device.
+     *
      * @generated from protobuf field: optional string display_name = 3
      */
     displayName?: string;
     /**
+     * Device form factor, derived by SID from registration context.
+     *
      * @generated from protobuf field: sid.v1.identity.DeviceType device_type = 4
      */
     deviceType: DeviceType;
     /**
+     * Operating system name and version as reported by the client at
+     * registration/login. Self-asserted, informational only.
+     *
      * @generated from protobuf field: optional string os_info = 5
      */
     osInfo?: string;
     /**
+     * Assurance level computed by SID from trust decision, attestation and
+     * policy; the input to device-based access policy.
+     *
      * @generated from protobuf field: sid.v1.identity.DeviceAssurance assurance = 6
      */
     assurance: DeviceAssurance;
     /**
+     * Explicit trust decision by the Profile owner (TrustDevice /
+     * RevokeDeviceTrust). A user label, not attestation of hardware or of any
+     * verification performed on the device.
+     *
      * @generated from protobuf field: bool trusted = 7
      */
     trusted: boolean;
     /**
+     * Whether a hardware-backed device key with verified platform attestation is
+     * registered in sid-attestation. A protected software key does not set this.
+     *
      * @generated from protobuf field: bool hardware_attested = 8
      */
     hardwareAttested: boolean;
     /**
+     * Country/region of the most recent access, derived by SID from the source
+     * IP. The exact IP address is never stored here.
+     *
      * @generated from protobuf field: optional string last_ip_geo = 9
      */
     lastIpGeo?: string;
     /**
+     * When SID first registered the device.
+     *
      * @generated from protobuf field: google.protobuf.Timestamp first_seen_at = 10
      */
     firstSeenAt?: Timestamp;
     /**
+     * Most recent authentication from the device; updated by SID on each auth.
+     *
      * @generated from protobuf field: google.protobuf.Timestamp last_seen_at = 11
      */
     lastSeenAt?: Timestamp;
@@ -1161,6 +1206,9 @@ export interface Device {
  */
 export interface ListDevicesRequest {
     /**
+     * Profile whose devices to list (UUIDv7). Must match the caller's
+     * authorized Profile scope.
+     *
      * @generated from protobuf field: string profile_id = 1
      */
     profileId: string;
@@ -1170,6 +1218,8 @@ export interface ListDevicesRequest {
  */
 export interface ListDevicesResponse {
     /**
+     * Devices registered to the requested Profile.
+     *
      * @generated from protobuf field: repeated sid.v1.identity.Device devices = 1
      */
     devices: Device[];
@@ -1179,6 +1229,9 @@ export interface ListDevicesResponse {
  */
 export interface GetDeviceRequest {
     /**
+     * Device to fetch (`Device.id`, UUIDv7). Must belong to the caller's
+     * authorized Profile scope.
+     *
      * @generated from protobuf field: string device_id = 1
      */
     deviceId: string;
@@ -1188,10 +1241,15 @@ export interface GetDeviceRequest {
  */
 export interface UpdateDeviceRequest {
     /**
+     * Device to update (`Device.id`, UUIDv7). Must belong to the caller's
+     * authorized Profile scope.
+     *
      * @generated from protobuf field: string device_id = 1
      */
     deviceId: string;
     /**
+     * New user-given label; unset leaves the current label unchanged.
+     *
      * @generated from protobuf field: optional string display_name = 2
      */
     displayName?: string;
@@ -1201,6 +1259,9 @@ export interface UpdateDeviceRequest {
  */
 export interface RemoveDeviceRequest {
     /**
+     * Device to remove (`Device.id`, UUIDv7). Removal kills the device's
+     * sessions and revokes its keys in sid-attestation.
+     *
      * @generated from protobuf field: string device_id = 1
      */
     deviceId: string;
@@ -1210,6 +1271,8 @@ export interface RemoveDeviceRequest {
  */
 export interface TrustDeviceRequest {
     /**
+     * Device the Profile owner marks as trusted (`Device.id`, UUIDv7).
+     *
      * @generated from protobuf field: string device_id = 1
      */
     deviceId: string;
@@ -1219,34 +1282,12 @@ export interface TrustDeviceRequest {
  */
 export interface RevokeDeviceTrustRequest {
     /**
+     * Device whose explicit trust is withdrawn (`Device.id`, UUIDv7).
+     *
      * @generated from protobuf field: string device_id = 1
      */
     deviceId: string;
 }
-/**
- * Who owns a Principal — determines login resolution behavior.
- *
- * @generated from protobuf enum sid.v1.identity.PrincipalSubjectType
- */
-export enum PrincipalSubjectType {
-    /**
-     * @generated from protobuf enum value: PRINCIPAL_SUBJECT_TYPE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * Bound to a specific profile. Login resolves directly.
-     * CE/EE: always this. SaaS: corporate principals, or personal with 1 profile.
-     *
-     * @generated from protobuf enum value: PRINCIPAL_SUBJECT_TYPE_PROFILE = 1;
-     */
-    PROFILE = 1,
-    /**
-     * Owned by Person (SaaS only). Login shows profile picker.
-     *
-     * @generated from protobuf enum value: PRINCIPAL_SUBJECT_TYPE_PERSON = 2;
-     */
-    PERSON = 2
-}
 /**
  * @generated from protobuf enum sid.v1.identity.PrincipalType
  */
@@ -1378,7 +1419,7 @@ export enum ProfileStatus {
      */
     ACTIVE = 1,
     /**
-     * SCIM-provisioned, not yet claimed by Person
+     * SCIM-provisioned, not yet claimed by its user
      *
      * @generated from protobuf enum value: PROFILE_STATUS_PROVISIONED = 9;
      */
@@ -1628,7 +1669,7 @@ export enum ExportFormat {
      */
     UNSPECIFIED = 0,
     /**
-     * CE: always available.
+     * JSON archive.
      *
      * @generated from protobuf enum value: EXPORT_FORMAT_JSON = 1;
      */
@@ -1892,8 +1933,8 @@ class Principal$Type extends MessageType<Principal> {
             { no: 6, name: "created_at", kind: "message", T: () => Timestamp },
             { no: 7, name: "updated_at", kind: "message", T: () => Timestamp },
             { no: 8, name: "source_field", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 9, name: "subject_type", kind: "enum", T: () => ["sid.v1.identity.PrincipalSubjectType", PrincipalSubjectType, "PRINCIPAL_SUBJECT_TYPE_"] },
-            { no: 10, name: "subject_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 11, name: "source_email_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 12, name: "needs_address_confirmation", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
         ]);
     }
     create(value?: PartialMessage<Principal>): Principal {
@@ -1903,8 +1944,7 @@ class Principal$Type extends MessageType<Principal> {
         message.value = "";
         message.verified = false;
         message.isPrimary = false;
-        message.subjectType = 0;
-        message.subjectId = "";
+        message.needsAddressConfirmation = false;
         if (value !== undefined)
             reflectionMergePartial<Principal>(this, message, value);
         return message;
@@ -1938,11 +1978,11 @@ class Principal$Type extends MessageType<Principal> {
                 case /* optional string source_field */ 8:
                     message.sourceField = reader.string();
                     break;
-                case /* sid.v1.identity.PrincipalSubjectType subject_type */ 9:
-                    message.subjectType = reader.int32();
+                case /* optional string source_email_id */ 11:
+                    message.sourceEmailId = reader.string();
                     break;
-                case /* string subject_id */ 10:
-                    message.subjectId = reader.string();
+                case /* bool needs_address_confirmation */ 12:
+                    message.needsAddressConfirmation = reader.bool();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1980,12 +2020,12 @@ class Principal$Type extends MessageType<Principal> {
         /* optional string source_field = 8; */
         if (message.sourceField !== undefined)
             writer.tag(8, WireType.LengthDelimited).string(message.sourceField);
-        /* sid.v1.identity.PrincipalSubjectType subject_type = 9; */
-        if (message.subjectType !== 0)
-            writer.tag(9, WireType.Varint).int32(message.subjectType);
-        /* string subject_id = 10; */
-        if (message.subjectId !== "")
-            writer.tag(10, WireType.LengthDelimited).string(message.subjectId);
+        /* optional string source_email_id = 11; */
+        if (message.sourceEmailId !== undefined)
+            writer.tag(11, WireType.LengthDelimited).string(message.sourceEmailId);
+        /* bool needs_address_confirmation = 12; */
+        if (message.needsAddressConfirmation !== false)
+            writer.tag(12, WireType.Varint).bool(message.needsAddressConfirmation);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);