@openvtc/trust-tasks 0.16.9 → 0.16.11

package/dist/persona/attribute/list/1.0/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/attribute/list/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG3J;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;OAEG;IACH,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAE3F,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,wDAAiE,CAAC;AAE1F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,iEAA0E,CAAC;AAE5G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,mCAAmC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmQjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+N1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/persona/attribute/list/1.0/payload.js

@@ -0,0 +1,530 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/persona/attribute/list/1.0/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/persona/attribute/list/1.0";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/persona/attribute/list/1.0#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/persona/attribute/list/1.0",
+    "title": "Persona Attribute List — payload",
+    "description": "Enumerate the holder's attribute pool, optionally narrowed to a vocabulary prefix. Cursor-paginated. Values are omitted unless asked for, so a picker can render the pool without decrypting every fact in it.",
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+        "typePrefix": {
+            "type": "string",
+            "maxLength": 128,
+            "description": "Narrows the result to attributes whose `type` begins with this string, compared over the UTF-8 encoding. Because the vocabulary is dotted most-general-segment-first, `phone` selects every phone number and `name` every name — which is the access pattern a builder actually has. The maintainer MUST NOT interpret the value further; a prefix that ends mid-segment is a byte comparison like any other."
+        },
+        "includeValues": {
+            "type": "boolean",
+            "default": false,
+            "description": "When false (the default), each returned attribute carries its metadata and no `value`. A pool listing is the common case and it does not need plaintext: a picker renders `type` and `label`. Defaulting to false means the expensive, sensitive path is the one a producer has to ask for."
+        },
+        "includeStale": {
+            "type": "boolean",
+            "default": true,
+            "description": "When true (the default), credential-backed attributes whose backing could not be re-derived are returned carrying `stale` and `staleReason`. Set false to omit them. The default is true because a holder needs to SEE that a credential-backed fact has gone stale — silently dropping it would present a pool that looks smaller than it is, and the holder would not know a claim had stopped being presentable."
+        },
+        "cursor": {
+            "type": "string",
+            "maxLength": 4096,
+            "description": "Opaque continuation token from a prior response's `nextCursor`. A producer MUST NOT construct or parse one."
+        },
+        "limit": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 500,
+            "default": 100,
+            "description": "Maximum attributes to return. The maintainer MAY return fewer for reasons of its own and a producer MUST NOT infer exhaustion from a short page — only an absent `nextCursor` means the end."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Persona Attribute List — response payload",
+            "description": "Success response to persona/attribute/list. Type https://trusttasks.org/spec/persona/attribute/list/1.0#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "attributes"
+            ],
+            "properties": {
+                "attributes": {
+                    "type": "array",
+                    "maxItems": 500,
+                    "items": {
+                        "$ref": "#/$defs/Attribute"
+                    }
+                },
+                "nextCursor": {
+                    "type": "string",
+                    "maxLength": 4096,
+                    "description": "Present when more attributes remain. Absent means the enumeration is complete — that absence is the only exhaustion signal."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "Attribute": {
+            "title": "Attribute",
+            "description": "One atomic fact a holder keeps about themselves. Several attributes MAY share a `type` — three phone numbers, a legal name and a preferred name — which is why `attributeId` is the identity of a fact and `type` is not. The pool is flat and unordered; ordering is a profile's concern.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "attributeId",
+                "type",
+                "valueType",
+                "provenance",
+                "version",
+                "updatedAt"
+            ],
+            "properties": {
+                "attributeId": {
+                    "$ref": "#/$defs/Ulid"
+                },
+                "type": {
+                    "$ref": "#/$defs/ClaimType"
+                },
+                "valueType": {
+                    "$ref": "#/$defs/ValueType"
+                },
+                "value": {
+                    "description": "The fact itself, agreeing with `valueType`. Encrypted at rest by the maintainer.\n\nOPTIONAL, and its absence is meaningful in two distinct situations a consumer MUST NOT conflate: the caller asked for a metadata-only view (`list` without `includeValues`, which is the DEFAULT and the common case), or a credential-backed value could not be re-derived. `stale` tells them apart. Requiring this member would make the default listing unrepresentable — a maintainer would have to choose between disclosing every value in bulk and emitting a non-conformant response."
+                },
+                "label": {
+                    "type": "string",
+                    "maxLength": 128,
+                    "description": "The holder's own words for this attribute, shown in a picker. Never disclosed to a verifier; it is a note to self."
+                },
+                "provenance": {
+                    "$ref": "#/$defs/Provenance"
+                },
+                "stale": {
+                    "type": "boolean",
+                    "description": "Present and true when a `credentialBacked` value could not be re-derived. `staleReason` says why. A maintainer MUST refuse to disclose a stale attribute."
+                },
+                "staleReason": {
+                    "type": "string",
+                    "enum": [
+                        "revoked",
+                        "expired",
+                        "archived",
+                        "deleted",
+                        "notFound"
+                    ],
+                    "description": "Why re-derivation failed. Present only alongside `stale`."
+                },
+                "version": {
+                    "$ref": "#/$defs/Version"
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updatedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                }
+            }
+        },
+        "Version": {
+            "title": "Version",
+            "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
+            "type": "integer",
+            "minimum": 1
+        },
+        "Provenance": {
+            "title": "Provenance",
+            "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+            "type": "object",
+            "required": [
+                "kind"
+            ],
+            "oneOf": [
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "selfAsserted"
+                        }
+                    }
+                },
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "credentialId",
+                        "claimPath"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "credentialBacked"
+                        },
+                        "credentialId": {
+                            "type": "string",
+                            "minLength": 1,
+                            "description": "Vault identifier of the backing credential."
+                        },
+                        "claimPath": {
+                            "type": "string",
+                            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+                            "description": "RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`."
+                        },
+                        "issuerDid": {
+                            "type": "string",
+                            "minLength": 1,
+                            "description": "Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member."
+                        },
+                        "proof": {
+                            "$ref": "#/$defs/ProofRung",
+                            "description": "The disclosure rung this claim was, or will be, presented at."
+                        }
+                    }
+                },
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "generator"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "generated"
+                        },
+                        "generator": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 64,
+                            "description": "Names the minting scheme, e.g. `relayEmail`. Maintainer-defined."
+                        },
+                        "perVerifier": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
+                        }
+                    }
+                }
+            ]
+        },
+        "ProofRung": {
+            "title": "ProofRung",
+            "description": "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.",
+            "type": "string",
+            "enum": [
+                "predicate",
+                "derived",
+                "selectiveDisclosure",
+                "whole"
+            ]
+        },
+        "ValueType": {
+            "title": "ValueType",
+            "description": "The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.",
+            "type": "string",
+            "enum": [
+                "string",
+                "number",
+                "boolean",
+                "date",
+                "object"
+            ]
+        },
+        "ClaimType": {
+            "title": "ClaimType",
+            "description": "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
+        },
+        "Ulid": {
+            "title": "Ulid",
+            "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+            "type": "string",
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Persona Attribute List — response payload",
+            "description": "Success response to persona/attribute/list. Type https://trusttasks.org/spec/persona/attribute/list/1.0#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "attributes"
+            ],
+            "properties": {
+                "attributes": {
+                    "type": "array",
+                    "maxItems": 500,
+                    "items": {
+                        "$ref": "#/$defs/Attribute"
+                    }
+                },
+                "nextCursor": {
+                    "type": "string",
+                    "maxLength": 4096,
+                    "description": "Present when more attributes remain. Absent means the enumeration is complete — that absence is the only exhaustion signal."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "Attribute": {
+            "title": "Attribute",
+            "description": "One atomic fact a holder keeps about themselves. Several attributes MAY share a `type` — three phone numbers, a legal name and a preferred name — which is why `attributeId` is the identity of a fact and `type` is not. The pool is flat and unordered; ordering is a profile's concern.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "attributeId",
+                "type",
+                "valueType",
+                "provenance",
+                "version",
+                "updatedAt"
+            ],
+            "properties": {
+                "attributeId": {
+                    "$ref": "#/$defs/Ulid"
+                },
+                "type": {
+                    "$ref": "#/$defs/ClaimType"
+                },
+                "valueType": {
+                    "$ref": "#/$defs/ValueType"
+                },
+                "value": {
+                    "description": "The fact itself, agreeing with `valueType`. Encrypted at rest by the maintainer.\n\nOPTIONAL, and its absence is meaningful in two distinct situations a consumer MUST NOT conflate: the caller asked for a metadata-only view (`list` without `includeValues`, which is the DEFAULT and the common case), or a credential-backed value could not be re-derived. `stale` tells them apart. Requiring this member would make the default listing unrepresentable — a maintainer would have to choose between disclosing every value in bulk and emitting a non-conformant response."
+                },
+                "label": {
+                    "type": "string",
+                    "maxLength": 128,
+                    "description": "The holder's own words for this attribute, shown in a picker. Never disclosed to a verifier; it is a note to self."
+                },
+                "provenance": {
+                    "$ref": "#/$defs/Provenance"
+                },
+                "stale": {
+                    "type": "boolean",
+                    "description": "Present and true when a `credentialBacked` value could not be re-derived. `staleReason` says why. A maintainer MUST refuse to disclose a stale attribute."
+                },
+                "staleReason": {
+                    "type": "string",
+                    "enum": [
+                        "revoked",
+                        "expired",
+                        "archived",
+                        "deleted",
+                        "notFound"
+                    ],
+                    "description": "Why re-derivation failed. Present only alongside `stale`."
+                },
+                "version": {
+                    "$ref": "#/$defs/Version"
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updatedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                }
+            }
+        },
+        "Version": {
+            "title": "Version",
+            "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
+            "type": "integer",
+            "minimum": 1
+        },
+        "Provenance": {
+            "title": "Provenance",
+            "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+            "type": "object",
+            "required": [
+                "kind"
+            ],
+            "oneOf": [
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "selfAsserted"
+                        }
+                    }
+                },
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "credentialId",
+                        "claimPath"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "credentialBacked"
+                        },
+                        "credentialId": {
+                            "type": "string",
+                            "minLength": 1,
+                            "description": "Vault identifier of the backing credential."
+                        },
+                        "claimPath": {
+                            "type": "string",
+                            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+                            "description": "RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`."
+                        },
+                        "issuerDid": {
+                            "type": "string",
+                            "minLength": 1,
+                            "description": "Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member."
+                        },
+                        "proof": {
+                            "$ref": "#/$defs/ProofRung",
+                            "description": "The disclosure rung this claim was, or will be, presented at."
+                        }
+                    }
+                },
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "generator"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "generated"
+                        },
+                        "generator": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 64,
+                            "description": "Names the minting scheme, e.g. `relayEmail`. Maintainer-defined."
+                        },
+                        "perVerifier": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
+                        }
+                    }
+                }
+            ]
+        },
+        "ProofRung": {
+            "title": "ProofRung",
+            "description": "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.",
+            "type": "string",
+            "enum": [
+                "predicate",
+                "derived",
+                "selectiveDisclosure",
+                "whole"
+            ]
+        },
+        "ValueType": {
+            "title": "ValueType",
+            "description": "The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.",
+            "type": "string",
+            "enum": [
+                "string",
+                "number",
+                "boolean",
+                "date",
+                "object"
+            ]
+        },
+        "ClaimType": {
+            "title": "ClaimType",
+            "description": "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
+        },
+        "Ulid": {
+            "title": "Ulid",
+            "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+            "type": "string",
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/persona/attribute/list/1.0/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/persona/attribute/list/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,wDAAiE,CAAC;AAK1F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iEAA0E,CAAC;AAK5G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,wDAAwD;IAC/D,OAAO,EAAE,kCAAkC;IAC3C,aAAa,EAAE,gNAAgN;IAC/N,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,YAAY,EAAE;QACZ,YAAY,EAAE;YACZ,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,+YAA+Y;SAC/Z;QACD,eAAe,EAAE;YACf,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,6RAA6R;SAC7S;QACD,cAAc,EAAE;YACd,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,qZAAqZ;SACra;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,6GAA6G;SAC7H;QACD,OAAO,EAAE;YACP,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,8LAA8L;SAC9M;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,mHAAmH;YAClI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;aACb;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6HAA6H;iBAC7I;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,4RAA4R;YAC3S,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,MAAM;gBACN,WAAW;gBACX,YAAY;gBACZ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,aAAa,EAAE,ojBAAojB;iBACpkB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,oBAAoB;iBAC7B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,2JAA2J;iBAC3K;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,SAAS;wBACT,UAAU;wBACV,SAAS;wBACT,UAAU;qBACX;oBACD,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,mHAAmH;YAClI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;aACb;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6HAA6H;iBAC7I;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,4RAA4R;YAC3S,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,MAAM;gBACN,WAAW;gBACX,YAAY;gBACZ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,aAAa,EAAE,ojBAAojB;iBACpkB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,oBAAoB;iBAC7B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,2JAA2J;iBAC3K;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,SAAS;wBACT,UAAU;wBACV,SAAS;wBACT,UAAU;qBACX;oBACD,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}