@openvtc/trust-tasks 0.12.13 → 0.12.15

package/dist/vtc/relationships/graph/0.2/payload.js

@@ -0,0 +1,328 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/relationships/graph/0.2/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/relationships/graph/0.2";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/relationships/graph/0.2#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vtc/relationships/graph/0.2",
+    "title": "VTC Relationships Graph — payload",
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Relationships Graph — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "nodes",
+                "edges"
+            ],
+            "properties": {
+                "nodes": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GraphNode"
+                    },
+                    "description": "One per distinct DID appearing in a live edge. No isolated nodes."
+                },
+                "edges": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GraphEdge"
+                    },
+                    "description": "One per **pair** of identifiers with at least one live credential between them, not one per credential."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "GraphNode": {
+            "$anchor": "graphNode",
+            "title": "GraphNode",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "did"
+            ],
+            "properties": {
+                "did": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "A DID participating in at least one live relationship."
+                }
+            }
+        },
+        "GraphEdge": {
+            "$anchor": "graphEdge",
+            "title": "GraphEdge",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "endpoints",
+                "halves",
+                "complete"
+            ],
+            "properties": {
+                "endpoints": {
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "pattern": "^did:"
+                    },
+                    "minItems": 2,
+                    "maxItems": 2,
+                    "description": "The two endpoints, DID-sorted. Sorting gives the pair one identity whichever half was published first. Both entries are equal only for a self-issued credential."
+                },
+                "halves": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GraphHalf"
+                    },
+                    "minItems": 1,
+                    "description": "Every credential published between the endpoints, oldest first. One for a half-edge, two for the ordinary reciprocated edge, more where a party has re-issued."
+                },
+                "complete": {
+                    "type": "boolean",
+                    "description": "True when both endpoints have asserted about each other. The distinction a flat list cannot make: an edge asserted by one party is a claim, and an edge asserted by both is a relationship."
+                }
+            },
+            "description": "One edge between a **pair** of identifiers, carrying every half published between them.\n\n`0.1` called each credential an edge, which made a DTG edge inexpressible: the two directed halves between the same pair are one relationship, and a consumer given a flat list had to re-derive that pairing — sorting DIDs, grouping, and deciding for itself what `complete` means. Two implementations doing that independently will disagree at the margins, which is exactly the reasoning a schema exists to settle once."
+        },
+        "GraphHalf": {
+            "$anchor": "graphHalf",
+            "title": "GraphHalf",
+            "type": "object",
+            "additionalProperties": false,
+            "description": "One published relationship credential: a **directed half** of an edge, asserted by `issuerDid` about `subjectDid`.\n\nBody-free on purpose — the graph shows the shape of the trust network, not credential contents. `id` is the row identifier a revoke takes.",
+            "required": [
+                "id",
+                "issuerDid",
+                "subjectDid",
+                "createdAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "issuerDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The asserting party."
+                },
+                "subjectDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The party asserted about."
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "personaDid": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "pattern": "^did:|^$",
+                    "description": "The persona this issuer has asserted on this half, when they have.\n\nThe one place deliberate correlation becomes visible: two pairwise halves carrying the same `personaDid` are the same party, said so by that party. A consumer that cannot read it cannot honour a correlation its subject chose to publish."
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Relationships Graph — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "nodes",
+                "edges"
+            ],
+            "properties": {
+                "nodes": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GraphNode"
+                    },
+                    "description": "One per distinct DID appearing in a live edge. No isolated nodes."
+                },
+                "edges": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GraphEdge"
+                    },
+                    "description": "One per **pair** of identifiers with at least one live credential between them, not one per credential."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "GraphNode": {
+            "$anchor": "graphNode",
+            "title": "GraphNode",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "did"
+            ],
+            "properties": {
+                "did": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "A DID participating in at least one live relationship."
+                }
+            }
+        },
+        "GraphEdge": {
+            "$anchor": "graphEdge",
+            "title": "GraphEdge",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "endpoints",
+                "halves",
+                "complete"
+            ],
+            "properties": {
+                "endpoints": {
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "pattern": "^did:"
+                    },
+                    "minItems": 2,
+                    "maxItems": 2,
+                    "description": "The two endpoints, DID-sorted. Sorting gives the pair one identity whichever half was published first. Both entries are equal only for a self-issued credential."
+                },
+                "halves": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GraphHalf"
+                    },
+                    "minItems": 1,
+                    "description": "Every credential published between the endpoints, oldest first. One for a half-edge, two for the ordinary reciprocated edge, more where a party has re-issued."
+                },
+                "complete": {
+                    "type": "boolean",
+                    "description": "True when both endpoints have asserted about each other. The distinction a flat list cannot make: an edge asserted by one party is a claim, and an edge asserted by both is a relationship."
+                }
+            },
+            "description": "One edge between a **pair** of identifiers, carrying every half published between them.\n\n`0.1` called each credential an edge, which made a DTG edge inexpressible: the two directed halves between the same pair are one relationship, and a consumer given a flat list had to re-derive that pairing — sorting DIDs, grouping, and deciding for itself what `complete` means. Two implementations doing that independently will disagree at the margins, which is exactly the reasoning a schema exists to settle once."
+        },
+        "GraphHalf": {
+            "$anchor": "graphHalf",
+            "title": "GraphHalf",
+            "type": "object",
+            "additionalProperties": false,
+            "description": "One published relationship credential: a **directed half** of an edge, asserted by `issuerDid` about `subjectDid`.\n\nBody-free on purpose — the graph shows the shape of the trust network, not credential contents. `id` is the row identifier a revoke takes.",
+            "required": [
+                "id",
+                "issuerDid",
+                "subjectDid",
+                "createdAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "issuerDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The asserting party."
+                },
+                "subjectDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The party asserted about."
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "personaDid": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "pattern": "^did:|^$",
+                    "description": "The persona this issuer has asserted on this half, when they have.\n\nThe one place deliberate correlation becomes visible: two pairwise halves carrying the same `personaDid` are the same party, said so by that party. A consumer that cannot read it cannot honour a correlation its subject chose to publish."
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vtc/relationships/graph/0.2/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vtc/relationships/graph/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4EH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,yDAAkE,CAAC;AAK3F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,kEAA2E,CAAC;AAK7G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,yDAAyD;IAChE,OAAO,EAAE,mCAAmC;IAC5C,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,YAAY,EAAE;QACZ,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,OAAO;aACR;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,mEAAmE;iBACnF;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,yGAAyG;iBACzH;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,wDAAwD;iBACxE;aACF;SACF;QACD,WAAW,EAAE;YACX,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,QAAQ;gBACR,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,OAAO;qBACnB;oBACD,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,kKAAkK;iBAClL;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,gKAAgK;iBAChL;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,6LAA6L;iBAC7M;aACF;YACD,aAAa,EAAE,6fAA6f;SAC7gB;QACD,WAAW,EAAE;YACX,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,aAAa,EAAE,kQAAkQ;YACjR,UAAU,EAAE;gBACV,IAAI;gBACJ,WAAW;gBACX,YAAY;gBACZ,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,sBAAsB;iBACtC;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,2BAA2B;iBAC3C;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE;wBACN,QAAQ;wBACR,MAAM;qBACP;oBACD,SAAS,EAAE,UAAU;oBACrB,aAAa,EAAE,oTAAoT;iBACpU;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,OAAO;aACR;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,mEAAmE;iBACnF;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,yGAAyG;iBACzH;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,wDAAwD;iBACxE;aACF;SACF;QACD,WAAW,EAAE;YACX,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,QAAQ;gBACR,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,OAAO;qBACnB;oBACD,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,kKAAkK;iBAClL;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,gKAAgK;iBAChL;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,6LAA6L;iBAC7M;aACF;YACD,aAAa,EAAE,6fAA6f;SAC7gB;QACD,WAAW,EAAE;YACX,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,aAAa,EAAE,kQAAkQ;YACjR,UAAU,EAAE;gBACV,IAAI;gBACJ,WAAW;gBACX,YAAY;gBACZ,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,sBAAsB;iBACtC;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,2BAA2B;iBAC3C;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE;wBACN,QAAQ;wBACR,MAAM;qBACP;oBACD,SAAS,EAAE,UAAU;oBACrB,aAAa,EAAE,oTAAoT;iBACpU;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.12.13",
+  "version": "0.12.15",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/auth/passkey/enroll/start/0.1/payload.ts

@@ -34,6 +34,14 @@ export interface AuthPasskeyEnrollStartResponsePayload {
  * PublicKeyCredentialCreationOptions for navigator.credentials.create.
  */
 export interface PublicKeyCredentialCreationOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -182,6 +190,10 @@ export const PAYLOAD_SCHEMA = {
         "pubKeyCredParams"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -384,6 +396,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "pubKeyCredParams"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."

package/src/auth/passkey/enroll/start/0.2/payload.ts

@@ -35,6 +35,14 @@ export interface AuthPasskeyEnrollStartResponsePayload {
  * PublicKeyCredentialCreationOptions for navigator.credentials.create.
  */
 export interface PublicKeyCredentialCreationOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -92,6 +100,14 @@ export interface PublicKeyCredentialDescriptor {
  * New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -197,6 +213,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -268,6 +288,10 @@ export const PAYLOAD_SCHEMA = {
         "pubKeyCredParams"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -440,6 +464,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -511,6 +539,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "pubKeyCredParams"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."

package/src/auth/passkey/login/start/0.1/payload.ts

@@ -38,6 +38,14 @@ export interface AuthPasskeyLoginStartResponsePayload {
  * PublicKeyCredentialRequestOptions for navigator.credentials.get.
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -156,6 +164,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -268,6 +280,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."

package/src/auth/passkey/login/start/0.2/payload.ts

@@ -38,6 +38,14 @@ export interface AuthPasskeyLoginStartResponsePayload {
  * PublicKeyCredentialRequestOptions for navigator.credentials.get.
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -156,6 +164,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -268,6 +280,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."

package/src/auth/passkey/revoke/start/0.1/payload.ts

@@ -34,6 +34,14 @@ export interface AuthPasskeyRevokeStartResponsePayload {
  * PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be "required".
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -147,6 +155,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -259,6 +271,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."

package/src/auth/step-up/approve-request/0.1/payload.ts

@@ -44,6 +44,14 @@ export interface AuthStepUpApproveRequest {
  * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -215,6 +223,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -328,6 +340,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."