@openvtc/trust-tasks 0.16.9 → 0.16.10

package/dist/persona/disclosure/preview/1.0/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/disclosure/preview/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AAGzF;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD;;OAEG;IACH,SAAS,EAAE,IAAI,CAAC;IAChB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,MAAM,EAAE;QACN,IAAI,EAAE,SAAS,CAAC;QAChB;;WAEG;QACH,KAAK,CAAC,EAAE;YACN,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;SAClC,CAAC;QACF;;WAEG;QACH,SAAS,CAAC,EAAE;YACV,EAAE,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,UAAU,CAAC;YAC3D,GAAG,EAAE,OAAO,CAAC;YACb,IAAI,CAAC,EAAE,SAAS,CAAC;SAClB,CAAC;QACF,UAAU,EAAE,cAAc,GAAG,kBAAkB,GAAG,WAAW,CAAC;QAC9D,IAAI,EAAE,SAAS,CAAC;QAChB;;WAEG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B;;WAEG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,EAAE,CAAC;IACJ;;OAEG;IACH,QAAQ,CAAC,EAAE;QACT,EAAE,EAAE,MAAM,CAAC;QACX;;;;WAIG;QACH,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAEhD,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAEtD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC;AAEhH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgPjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgM1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/persona/disclosure/preview/1.0/payload.js

@@ -0,0 +1,480 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/persona/disclosure/preview/1.0/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/persona/disclosure/preview/1.0";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/persona/disclosure/preview/1.0#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/persona/disclosure/preview/1.0",
+    "title": "Persona Disclosure Preview — payload",
+    "description": "Determine exactly what a disclosure would reveal, and to whom, without signing or sending anything. The first of two calls that cannot be collapsed: there is no path to a disclosure that did not first produce the summary a human can be shown.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "contextId",
+        "personaDid",
+        "verifierDid"
+    ],
+    "properties": {
+        "contextId": {
+            "type": "string",
+            "minLength": 1
+        },
+        "personaDid": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048,
+            "description": "The persona that would present. Its binding supplies the profile."
+        },
+        "verifierDid": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048,
+            "description": "Who would receive it. Required, and not optional, because half of what a preview says is who is asking — a preview that could not name the recipient would be a list of fields rather than a decision."
+        },
+        "purpose": {
+            "type": "string",
+            "maxLength": 512,
+            "description": "The verifier's stated reason, carried through to the preview and the disclosure record so a holder deciding later has the same context as one deciding now."
+        },
+        "requestedClaims": {
+            "type": "array",
+            "maxItems": 128,
+            "items": {
+                "$ref": "#/$defs/ClaimType"
+            },
+            "description": "Claim types the verifier asked for. Omit to preview everything the bound profile would present. A maintainer MUST NOT return a claim that was not requested when this member is present — narrowing is the caller's to ask for and the maintainer's to honour."
+        },
+        "renderer": {
+            "type": "string",
+            "maxLength": 64,
+            "description": "Which output format to prepare for. Omit for the maintainer's canonical form. The choice matters to the preview because renderers differ in what they can carry, and a holder is owed that before deciding."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Persona Disclosure Preview — response payload",
+            "description": "Success response to persona/disclosure/preview. Type https://trusttasks.org/spec/persona/disclosure/preview/1.0#response. Signs nothing and sends nothing. The `previewId` returned here is consumed by persona/disclosure/present, which is the mechanism by which the two calls cannot be collapsed.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "previewId",
+                "subject",
+                "claims",
+                "expiresAt"
+            ],
+            "properties": {
+                "previewId": {
+                    "$ref": "#/$defs/Ulid",
+                    "description": "Consumed by present. Single-use and short-lived: a preview a holder approved an hour ago is not evidence they approve it now, and one that could be replayed would let a second disclosure ride an earlier decision."
+                },
+                "subject": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The identifier that would appear as the subject of the disclosure. Pairwise by default — a fresh per-relationship DID rather than the persona DID — so that two verifiers cannot recognise the holder as the same party. The persona DID is the account; this is the face."
+                },
+                "claims": {
+                    "type": "array",
+                    "maxItems": 128,
+                    "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": [
+                            "type",
+                            "provenance",
+                            "rung"
+                        ],
+                        "properties": {
+                            "type": {
+                                "$ref": "#/$defs/ClaimType"
+                            },
+                            "value": {
+                                "description": "What would be disclosed. Absent for a predicate claim, which discloses no value at all — that absence is the point and a consumer MUST NOT render it as missing data."
+                            },
+                            "predicate": {
+                                "type": "object",
+                                "additionalProperties": false,
+                                "required": [
+                                    "op",
+                                    "arg"
+                                ],
+                                "description": "Present instead of `value` when the claim would be proven rather than shown, e.g. that a date of birth implies an age threshold. The underlying attribute stays in the pool; the predicate is a disclosure-time projection over it, which is what keeps the pool from filling with derived facts that are all the same fact asked differently.",
+                                "properties": {
+                                    "op": {
+                                        "type": "string",
+                                        "enum": [
+                                            "gte",
+                                            "gt",
+                                            "lte",
+                                            "lt",
+                                            "eq",
+                                            "ne",
+                                            "memberOf"
+                                        ]
+                                    },
+                                    "arg": {},
+                                    "over": {
+                                        "$ref": "#/$defs/ClaimType"
+                                    }
+                                }
+                            },
+                            "provenance": {
+                                "type": "string",
+                                "enum": [
+                                    "selfAsserted",
+                                    "credentialBacked",
+                                    "generated"
+                                ]
+                            },
+                            "rung": {
+                                "$ref": "#/$defs/ProofRung"
+                            },
+                            "newToThisVerifier": {
+                                "type": "boolean",
+                                "description": "True when this verifier has not previously received this claim type from this persona. What makes a preview rankable rather than a flat list — a holder needs the unusual ask to stand out from the routine one."
+                            },
+                            "stale": {
+                                "type": "boolean",
+                                "description": "True when a credential-backed claim could not be re-derived. Such a claim MUST NOT be disclosed; it is shown in the preview so the holder learns why the disclosure will be short."
+                            }
+                        }
+                    }
+                },
+                "renderer": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "id",
+                        "drops"
+                    ],
+                    "description": "The output format and, crucially, what it cannot carry. Lossiness is DECLARED rather than discovered: a holder is owed 'this verifier will see your work number but not that your employer attested it' before deciding, not after.",
+                    "properties": {
+                        "id": {
+                            "type": "string",
+                            "maxLength": 64
+                        },
+                        "drops": {
+                            "type": "array",
+                            "maxItems": 32,
+                            "items": {
+                                "type": "string",
+                                "maxLength": 64
+                            },
+                            "description": "What this renderer discards — commonly provenance. Empty for a lossless renderer."
+                        }
+                    }
+                },
+                "correlation": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "severity"
+                    ],
+                    "description": "How much this disclosure would link the holder. Note the inversion that is easy to get backwards: a credential presented WHOLE correlates more than a self-asserted value, because the issuer signature is identical at every verifier — while a derived proof correlates LESS, because it differs on every presentation. Severity is therefore a function of value and rung together, not of provenance alone.",
+                    "properties": {
+                        "severity": {
+                            "type": "string",
+                            "enum": [
+                                "none",
+                                "low",
+                                "high"
+                            ]
+                        },
+                        "reason": {
+                            "type": "string",
+                            "maxLength": 512
+                        }
+                    }
+                },
+                "anomalous": {
+                    "type": "array",
+                    "maxItems": 128,
+                    "items": {
+                        "$ref": "#/$defs/ClaimType"
+                    },
+                    "description": "Claim types unusual for this verifier's stated purpose. A preview that lists fourteen fields with fourteen equal weights is a notice-and-consent dialog, which is the pattern that trains people to click through; ranking by what is out of place is what makes the surfaced line the one worth reading."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "ClaimType": {
+            "title": "ClaimType",
+            "description": "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
+        },
+        "ProofRung": {
+            "title": "ProofRung",
+            "description": "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.",
+            "type": "string",
+            "enum": [
+                "predicate",
+                "derived",
+                "selectiveDisclosure",
+                "whole"
+            ]
+        },
+        "Ulid": {
+            "title": "Ulid",
+            "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+            "type": "string",
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Persona Disclosure Preview — response payload",
+            "description": "Success response to persona/disclosure/preview. Type https://trusttasks.org/spec/persona/disclosure/preview/1.0#response. Signs nothing and sends nothing. The `previewId` returned here is consumed by persona/disclosure/present, which is the mechanism by which the two calls cannot be collapsed.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "previewId",
+                "subject",
+                "claims",
+                "expiresAt"
+            ],
+            "properties": {
+                "previewId": {
+                    "$ref": "#/$defs/Ulid",
+                    "description": "Consumed by present. Single-use and short-lived: a preview a holder approved an hour ago is not evidence they approve it now, and one that could be replayed would let a second disclosure ride an earlier decision."
+                },
+                "subject": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The identifier that would appear as the subject of the disclosure. Pairwise by default — a fresh per-relationship DID rather than the persona DID — so that two verifiers cannot recognise the holder as the same party. The persona DID is the account; this is the face."
+                },
+                "claims": {
+                    "type": "array",
+                    "maxItems": 128,
+                    "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": [
+                            "type",
+                            "provenance",
+                            "rung"
+                        ],
+                        "properties": {
+                            "type": {
+                                "$ref": "#/$defs/ClaimType"
+                            },
+                            "value": {
+                                "description": "What would be disclosed. Absent for a predicate claim, which discloses no value at all — that absence is the point and a consumer MUST NOT render it as missing data."
+                            },
+                            "predicate": {
+                                "type": "object",
+                                "additionalProperties": false,
+                                "required": [
+                                    "op",
+                                    "arg"
+                                ],
+                                "description": "Present instead of `value` when the claim would be proven rather than shown, e.g. that a date of birth implies an age threshold. The underlying attribute stays in the pool; the predicate is a disclosure-time projection over it, which is what keeps the pool from filling with derived facts that are all the same fact asked differently.",
+                                "properties": {
+                                    "op": {
+                                        "type": "string",
+                                        "enum": [
+                                            "gte",
+                                            "gt",
+                                            "lte",
+                                            "lt",
+                                            "eq",
+                                            "ne",
+                                            "memberOf"
+                                        ]
+                                    },
+                                    "arg": {},
+                                    "over": {
+                                        "$ref": "#/$defs/ClaimType"
+                                    }
+                                }
+                            },
+                            "provenance": {
+                                "type": "string",
+                                "enum": [
+                                    "selfAsserted",
+                                    "credentialBacked",
+                                    "generated"
+                                ]
+                            },
+                            "rung": {
+                                "$ref": "#/$defs/ProofRung"
+                            },
+                            "newToThisVerifier": {
+                                "type": "boolean",
+                                "description": "True when this verifier has not previously received this claim type from this persona. What makes a preview rankable rather than a flat list — a holder needs the unusual ask to stand out from the routine one."
+                            },
+                            "stale": {
+                                "type": "boolean",
+                                "description": "True when a credential-backed claim could not be re-derived. Such a claim MUST NOT be disclosed; it is shown in the preview so the holder learns why the disclosure will be short."
+                            }
+                        }
+                    }
+                },
+                "renderer": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "id",
+                        "drops"
+                    ],
+                    "description": "The output format and, crucially, what it cannot carry. Lossiness is DECLARED rather than discovered: a holder is owed 'this verifier will see your work number but not that your employer attested it' before deciding, not after.",
+                    "properties": {
+                        "id": {
+                            "type": "string",
+                            "maxLength": 64
+                        },
+                        "drops": {
+                            "type": "array",
+                            "maxItems": 32,
+                            "items": {
+                                "type": "string",
+                                "maxLength": 64
+                            },
+                            "description": "What this renderer discards — commonly provenance. Empty for a lossless renderer."
+                        }
+                    }
+                },
+                "correlation": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "severity"
+                    ],
+                    "description": "How much this disclosure would link the holder. Note the inversion that is easy to get backwards: a credential presented WHOLE correlates more than a self-asserted value, because the issuer signature is identical at every verifier — while a derived proof correlates LESS, because it differs on every presentation. Severity is therefore a function of value and rung together, not of provenance alone.",
+                    "properties": {
+                        "severity": {
+                            "type": "string",
+                            "enum": [
+                                "none",
+                                "low",
+                                "high"
+                            ]
+                        },
+                        "reason": {
+                            "type": "string",
+                            "maxLength": 512
+                        }
+                    }
+                },
+                "anomalous": {
+                    "type": "array",
+                    "maxItems": 128,
+                    "items": {
+                        "$ref": "#/$defs/ClaimType"
+                    },
+                    "description": "Claim types unusual for this verifier's stated purpose. A preview that lists fourteen fields with fourteen equal weights is a notice-and-consent dialog, which is the pattern that trains people to click through; ranking by what is out of place is what makes the surfaced line the one worth reading."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "ClaimType": {
+            "title": "ClaimType",
+            "description": "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
+        },
+        "ProofRung": {
+            "title": "ProofRung",
+            "description": "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.",
+            "type": "string",
+            "enum": [
+                "predicate",
+                "derived",
+                "selectiveDisclosure",
+                "whole"
+            ]
+        },
+        "Ulid": {
+            "title": "Ulid",
+            "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+            "type": "string",
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/persona/disclosure/preview/1.0/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/persona/disclosure/preview/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4GH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4DAAqE,CAAC;AAK9F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qEAA8E,CAAC;AAKhH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,4DAA4D;IACnE,OAAO,EAAE,sCAAsC;IAC/C,aAAa,EAAE,oPAAoP;IACnQ,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,WAAW;QACX,YAAY;QACZ,aAAa;KACd;IACD,YAAY,EAAE;QACZ,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;SACf;QACD,YAAY,EAAE;YACZ,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,mEAAmE;SACnF;QACD,aAAa,EAAE;YACb,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,wMAAwM;SACxN;QACD,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,6JAA6J;SAC7K;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,GAAG;YACf,OAAO,EAAE;gBACP,MAAM,EAAE,mBAAmB;aAC5B;YACD,aAAa,EAAE,gQAAgQ;SAChR;QACD,UAAU,EAAE;YACV,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,6MAA6M;SAC7N;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,+CAA+C;YACxD,aAAa,EAAE,wSAAwS;YACvT,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,SAAS;gBACT,QAAQ;gBACR,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,cAAc;oBACtB,aAAa,EAAE,sNAAsN;iBACtO;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4QAA4Q;iBAC5R;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE;4BACV,MAAM;4BACN,YAAY;4BACZ,MAAM;yBACP;wBACD,YAAY,EAAE;4BACZ,MAAM,EAAE;gCACN,MAAM,EAAE,mBAAmB;6BAC5B;4BACD,OAAO,EAAE;gCACP,aAAa,EAAE,uKAAuK;6BACvL;4BACD,WAAW,EAAE;gCACX,MAAM,EAAE,QAAQ;gCAChB,sBAAsB,EAAE,KAAK;gCAC7B,UAAU,EAAE;oCACV,IAAI;oCACJ,KAAK;iCACN;gCACD,aAAa,EAAE,gVAAgV;gCAC/V,YAAY,EAAE;oCACZ,IAAI,EAAE;wCACJ,MAAM,EAAE,QAAQ;wCAChB,MAAM,EAAE;4CACN,KAAK;4CACL,IAAI;4CACJ,KAAK;4CACL,IAAI;4CACJ,IAAI;4CACJ,IAAI;4CACJ,UAAU;yCACX;qCACF;oCACD,KAAK,EAAE,EAAE;oCACT,MAAM,EAAE;wCACN,MAAM,EAAE,mBAAmB;qCAC5B;iCACF;6BACF;4BACD,YAAY,EAAE;gCACZ,MAAM,EAAE,QAAQ;gCAChB,MAAM,EAAE;oCACN,cAAc;oCACd,kBAAkB;oCAClB,WAAW;iCACZ;6BACF;4BACD,MAAM,EAAE;gCACN,MAAM,EAAE,mBAAmB;6BAC5B;4BACD,mBAAmB,EAAE;gCACnB,MAAM,EAAE,SAAS;gCACjB,aAAa,EAAE,kNAAkN;6BAClO;4BACD,OAAO,EAAE;gCACP,MAAM,EAAE,SAAS;gCACjB,aAAa,EAAE,oLAAoL;6BACpM;yBACF;qBACF;iBACF;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,IAAI;wBACJ,OAAO;qBACR;oBACD,aAAa,EAAE,qOAAqO;oBACpP,YAAY,EAAE;wBACZ,IAAI,EAAE;4BACJ,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,EAAE;yBAChB;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,OAAO;4BACf,UAAU,EAAE,EAAE;4BACd,OAAO,EAAE;gCACP,MAAM,EAAE,QAAQ;gCAChB,WAAW,EAAE,EAAE;6BAChB;4BACD,aAAa,EAAE,mFAAmF;yBACnG;qBACF;iBACF;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,UAAU;qBACX;oBACD,aAAa,EAAE,iZAAiZ;oBACha,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,MAAM,EAAE,QAAQ;4BAChB,MAAM,EAAE;gCACN,MAAM;gCACN,KAAK;gCACL,MAAM;6BACP;yBACF;wBACD,QAAQ,EAAE;4BACR,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,GAAG;yBACjB;qBACF;iBACF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,2SAA2S;iBAC3T;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,+CAA+C;YACxD,aAAa,EAAE,wSAAwS;YACvT,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,SAAS;gBACT,QAAQ;gBACR,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,cAAc;oBACtB,aAAa,EAAE,sNAAsN;iBACtO;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4QAA4Q;iBAC5R;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE;4BACV,MAAM;4BACN,YAAY;4BACZ,MAAM;yBACP;wBACD,YAAY,EAAE;4BACZ,MAAM,EAAE;gCACN,MAAM,EAAE,mBAAmB;6BAC5B;4BACD,OAAO,EAAE;gCACP,aAAa,EAAE,uKAAuK;6BACvL;4BACD,WAAW,EAAE;gCACX,MAAM,EAAE,QAAQ;gCAChB,sBAAsB,EAAE,KAAK;gCAC7B,UAAU,EAAE;oCACV,IAAI;oCACJ,KAAK;iCACN;gCACD,aAAa,EAAE,gVAAgV;gCAC/V,YAAY,EAAE;oCACZ,IAAI,EAAE;wCACJ,MAAM,EAAE,QAAQ;wCAChB,MAAM,EAAE;4CACN,KAAK;4CACL,IAAI;4CACJ,KAAK;4CACL,IAAI;4CACJ,IAAI;4CACJ,IAAI;4CACJ,UAAU;yCACX;qCACF;oCACD,KAAK,EAAE,EAAE;oCACT,MAAM,EAAE;wCACN,MAAM,EAAE,mBAAmB;qCAC5B;iCACF;6BACF;4BACD,YAAY,EAAE;gCACZ,MAAM,EAAE,QAAQ;gCAChB,MAAM,EAAE;oCACN,cAAc;oCACd,kBAAkB;oCAClB,WAAW;iCACZ;6BACF;4BACD,MAAM,EAAE;gCACN,MAAM,EAAE,mBAAmB;6BAC5B;4BACD,mBAAmB,EAAE;gCACnB,MAAM,EAAE,SAAS;gCACjB,aAAa,EAAE,kNAAkN;6BAClO;4BACD,OAAO,EAAE;gCACP,MAAM,EAAE,SAAS;gCACjB,aAAa,EAAE,oLAAoL;6BACpM;yBACF;qBACF;iBACF;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,IAAI;wBACJ,OAAO;qBACR;oBACD,aAAa,EAAE,qOAAqO;oBACpP,YAAY,EAAE;wBACZ,IAAI,EAAE;4BACJ,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,EAAE;yBAChB;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,OAAO;4BACf,UAAU,EAAE,EAAE;4BACd,OAAO,EAAE;gCACP,MAAM,EAAE,QAAQ;gCAChB,WAAW,EAAE,EAAE;6BAChB;4BACD,aAAa,EAAE,mFAAmF;yBACnG;qBACF;iBACF;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,UAAU;qBACX;oBACD,aAAa,EAAE,iZAAiZ;oBACha,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,MAAM,EAAE,QAAQ;4BAChB,MAAM,EAAE;gCACN,MAAM;gCACN,KAAK;gCACL,MAAM;6BACP;yBACF;wBACD,QAAQ,EAAE;4BACR,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,GAAG;yBACjB;qBACF;iBACF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,2SAA2S;iBAC3T;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}