@openvtc/trust-tasks 0.17.1 → 0.17.3

package/dist/persona/attribute/list/1.0/payload.d.ts

@@ -2,7 +2,7 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/persona/attribute/list/1.0/payload.schema.json
  */
-import type { Attribute, ClaimType, Ext, ProofRung, Provenance, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
+import type { Attribute, ClaimType, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
 /**
  * Enumerate the holder's attribute pool, optionally narrowed to a vocabulary prefix. Cursor-paginated. Values are omitted unless asked for, so a picker can render the pool without decrypting every fact in it.
  */
@@ -15,6 +15,16 @@ export interface PersonaAttributeListPayload {
      * When false (the default), each returned attribute carries its metadata and no `value`. A pool listing is the common case and it does not need plaintext: a picker renders `type` and `label`. Defaulting to false means the expensive, sensitive path is the one a producer has to ask for.
      */
     includeValues?: boolean;
+    /**
+     * When false (the default), a listing that asked for values still omits the value of any attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for those too.
+     *
+     * This is the half of sensitivity that is not cosmetic. A consumer that masks a value it has already received defends a screen; it does not keep a card number out of a log, a crash dump or a process's memory. Ignoring this member and masking client-side is a conforming implementation of nothing.
+     *
+     * Separate from `includeValues` rather than a third state of it, because the two escalations are answerable by different callers: a picker wants every name and no card, and should not have to choose between plaintext for everything and plaintext for nothing.
+     *
+     * Has no effect unless `includeValues` is also set: it widens that request, and can never be the thing that introduces plaintext on its own.
+     */
+    includeSensitive?: boolean;
     /**
      * When true (the default), credential-backed attributes whose backing could not be re-derived are returned carrying `stale` and `staleReason`. Set false to omit them. The default is true because a holder needs to SEE that a credential-backed fact has gone stale — silently dropping it would present a pool that looks smaller than it is, and the holder would not know a claim had stopped being presentable.
      */
@@ -44,7 +54,7 @@ export interface PersonaAttributeListResponsePayload {
     ext?: Ext;
 }
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { Attribute, ClaimType, Ext, ProofRung, Provenance, Ulid, ValueType, Version };
+export type { Attribute, ClaimType, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version };
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/persona/attribute/list/1.0";
 /** Stable alias for this specification's request payload shape. */
@@ -80,6 +90,11 @@ export declare const PAYLOAD_SCHEMA: {
             readonly default: false;
             readonly description: "When false (the default), each returned attribute carries its metadata and no `value`. A pool listing is the common case and it does not need plaintext: a picker renders `type` and `label`. Defaulting to false means the expensive, sensitive path is the one a producer has to ask for.";
         };
+        readonly includeSensitive: {
+            readonly type: "boolean";
+            readonly default: false;
+            readonly description: "When false (the default), a listing that asked for values still omits the value of any attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for those too.\n\nThis is the half of sensitivity that is not cosmetic. A consumer that masks a value it has already received defends a screen; it does not keep a card number out of a log, a crash dump or a process's memory. Ignoring this member and masking client-side is a conforming implementation of nothing.\n\nSeparate from `includeValues` rather than a third state of it, because the two escalations are answerable by different callers: a picker wants every name and no card, and should not have to choose between plaintext for everything and plaintext for nothing.\n\nHas no effect unless `includeValues` is also set: it widens that request, and can never be the thing that introduces plaintext on its own.";
+        };
         readonly includeStale: {
             readonly type: "boolean";
             readonly default: true;
@@ -173,6 +188,14 @@ export declare const PAYLOAD_SCHEMA: {
                     readonly enum: readonly ["revoked", "expired", "archived", "deleted", "notFound"];
                     readonly description: "Why re-derivation failed. Present only alongside `stale`.";
                 };
+                readonly sensitivity: {
+                    readonly $ref: "#/$defs/Sensitivity";
+                    readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.";
+                };
+                readonly release: {
+                    readonly $ref: "#/$defs/ReleaseRequirement";
+                    readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.";
+                };
                 readonly version: {
                     readonly $ref: "#/$defs/Version";
                 };
@@ -192,6 +215,18 @@ export declare const PAYLOAD_SCHEMA: {
             readonly type: "integer";
             readonly minimum: 1;
         };
+        readonly ReleaseRequirement: {
+            readonly title: "ReleaseRequirement";
+            readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+            readonly type: "string";
+            readonly enum: readonly ["consent", "stepUp"];
+        };
+        readonly Sensitivity: {
+            readonly title: "Sensitivity";
+            readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+            readonly type: "string";
+            readonly enum: readonly ["normal", "high"];
+        };
         readonly Provenance: {
             readonly title: "Provenance";
             readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
@@ -357,6 +392,14 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
                     readonly enum: readonly ["revoked", "expired", "archived", "deleted", "notFound"];
                     readonly description: "Why re-derivation failed. Present only alongside `stale`.";
                 };
+                readonly sensitivity: {
+                    readonly $ref: "#/$defs/Sensitivity";
+                    readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.";
+                };
+                readonly release: {
+                    readonly $ref: "#/$defs/ReleaseRequirement";
+                    readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.";
+                };
                 readonly version: {
                     readonly $ref: "#/$defs/Version";
                 };
@@ -376,6 +419,18 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
             readonly type: "integer";
             readonly minimum: 1;
         };
+        readonly ReleaseRequirement: {
+            readonly title: "ReleaseRequirement";
+            readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+            readonly type: "string";
+            readonly enum: readonly ["consent", "stepUp"];
+        };
+        readonly Sensitivity: {
+            readonly title: "Sensitivity";
+            readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+            readonly type: "string";
+            readonly enum: readonly ["normal", "high"];
+        };
         readonly Provenance: {
             readonly title: "Provenance";
             readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
@@ -495,6 +550,11 @@ export declare const SPEC: {
                 readonly default: false;
                 readonly description: "When false (the default), each returned attribute carries its metadata and no `value`. A pool listing is the common case and it does not need plaintext: a picker renders `type` and `label`. Defaulting to false means the expensive, sensitive path is the one a producer has to ask for.";
             };
+            readonly includeSensitive: {
+                readonly type: "boolean";
+                readonly default: false;
+                readonly description: "When false (the default), a listing that asked for values still omits the value of any attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for those too.\n\nThis is the half of sensitivity that is not cosmetic. A consumer that masks a value it has already received defends a screen; it does not keep a card number out of a log, a crash dump or a process's memory. Ignoring this member and masking client-side is a conforming implementation of nothing.\n\nSeparate from `includeValues` rather than a third state of it, because the two escalations are answerable by different callers: a picker wants every name and no card, and should not have to choose between plaintext for everything and plaintext for nothing.\n\nHas no effect unless `includeValues` is also set: it widens that request, and can never be the thing that introduces plaintext on its own.";
+            };
             readonly includeStale: {
                 readonly type: "boolean";
                 readonly default: true;
@@ -588,6 +648,14 @@ export declare const SPEC: {
                         readonly enum: readonly ["revoked", "expired", "archived", "deleted", "notFound"];
                         readonly description: "Why re-derivation failed. Present only alongside `stale`.";
                     };
+                    readonly sensitivity: {
+                        readonly $ref: "#/$defs/Sensitivity";
+                        readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.";
+                    };
+                    readonly release: {
+                        readonly $ref: "#/$defs/ReleaseRequirement";
+                        readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.";
+                    };
                     readonly version: {
                         readonly $ref: "#/$defs/Version";
                     };
@@ -607,6 +675,18 @@ export declare const SPEC: {
                 readonly type: "integer";
                 readonly minimum: 1;
             };
+            readonly ReleaseRequirement: {
+                readonly title: "ReleaseRequirement";
+                readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+                readonly type: "string";
+                readonly enum: readonly ["consent", "stepUp"];
+            };
+            readonly Sensitivity: {
+                readonly title: "Sensitivity";
+                readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+                readonly type: "string";
+                readonly enum: readonly ["normal", "high"];
+            };
             readonly Provenance: {
                 readonly title: "Provenance";
                 readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
@@ -783,6 +863,14 @@ export declare const RESPONSE_SPEC: {
                         readonly enum: readonly ["revoked", "expired", "archived", "deleted", "notFound"];
                         readonly description: "Why re-derivation failed. Present only alongside `stale`.";
                     };
+                    readonly sensitivity: {
+                        readonly $ref: "#/$defs/Sensitivity";
+                        readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.";
+                    };
+                    readonly release: {
+                        readonly $ref: "#/$defs/ReleaseRequirement";
+                        readonly description: "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.";
+                    };
                     readonly version: {
                         readonly $ref: "#/$defs/Version";
                     };
@@ -802,6 +890,18 @@ export declare const RESPONSE_SPEC: {
                 readonly type: "integer";
                 readonly minimum: 1;
             };
+            readonly ReleaseRequirement: {
+                readonly title: "ReleaseRequirement";
+                readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+                readonly type: "string";
+                readonly enum: readonly ["consent", "stepUp"];
+            };
+            readonly Sensitivity: {
+                readonly title: "Sensitivity";
+                readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+                readonly type: "string";
+                readonly enum: readonly ["normal", "high"];
+            };
             readonly Provenance: {
                 readonly title: "Provenance";
                 readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";

package/dist/persona/attribute/list/1.0/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/attribute/list/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG3J;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;OAEG;IACH,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAE3F,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,wDAAiE,CAAC;AAE1F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,iEAA0E,CAAC;AAE5G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,mCAAmC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmQjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+N1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/attribute/list/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG5L;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;OAEG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;OAEG;IACH,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAE5H,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,wDAAiE,CAAC;AAE1F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,iEAA0E,CAAC;AAE5G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,mCAAmC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkSjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyP1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/persona/attribute/list/1.0/payload.js

@@ -33,6 +33,11 @@ export const PAYLOAD_SCHEMA = {
             "default": false,
             "description": "When false (the default), each returned attribute carries its metadata and no `value`. A pool listing is the common case and it does not need plaintext: a picker renders `type` and `label`. Defaulting to false means the expensive, sensitive path is the one a producer has to ask for."
         },
+        "includeSensitive": {
+            "type": "boolean",
+            "default": false,
+            "description": "When false (the default), a listing that asked for values still omits the value of any attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for those too.\n\nThis is the half of sensitivity that is not cosmetic. A consumer that masks a value it has already received defends a screen; it does not keep a card number out of a log, a crash dump or a process's memory. Ignoring this member and masking client-side is a conforming implementation of nothing.\n\nSeparate from `includeValues` rather than a third state of it, because the two escalations are answerable by different callers: a picker wants every name and no card, and should not have to choose between plaintext for everything and plaintext for nothing.\n\nHas no effect unless `includeValues` is also set: it widens that request, and can never be the thing that introduces plaintext on its own."
+        },
         "includeStale": {
             "type": "boolean",
             "default": true,
@@ -141,6 +146,14 @@ export const PAYLOAD_SCHEMA = {
                     ],
                     "description": "Why re-derivation failed. Present only alongside `stale`."
                 },
+                "sensitivity": {
+                    "$ref": "#/$defs/Sensitivity",
+                    "description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'."
+                },
+                "release": {
+                    "$ref": "#/$defs/ReleaseRequirement",
+                    "description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry."
+                },
                 "version": {
                     "$ref": "#/$defs/Version"
                 },
@@ -160,6 +173,24 @@ export const PAYLOAD_SCHEMA = {
             "type": "integer",
             "minimum": 1
         },
+        "ReleaseRequirement": {
+            "title": "ReleaseRequirement",
+            "description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
+            "type": "string",
+            "enum": [
+                "consent",
+                "stepUp"
+            ]
+        },
+        "Sensitivity": {
+            "title": "Sensitivity",
+            "description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
+            "type": "string",
+            "enum": [
+                "normal",
+                "high"
+            ]
+        },
         "Provenance": {
             "title": "Provenance",
             "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
@@ -366,6 +397,14 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
                     ],
                     "description": "Why re-derivation failed. Present only alongside `stale`."
                 },
+                "sensitivity": {
+                    "$ref": "#/$defs/Sensitivity",
+                    "description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'."
+                },
+                "release": {
+                    "$ref": "#/$defs/ReleaseRequirement",
+                    "description": "Set only where the holder decided it explicitly. Absent resolves from the claim-type registry."
+                },
                 "version": {
                     "$ref": "#/$defs/Version"
                 },
@@ -385,6 +424,24 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "type": "integer",
             "minimum": 1
         },
+        "ReleaseRequirement": {
+            "title": "ReleaseRequirement",
+            "description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
+            "type": "string",
+            "enum": [
+                "consent",
+                "stepUp"
+            ]
+        },
+        "Sensitivity": {
+            "title": "Sensitivity",
+            "description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
+            "type": "string",
+            "enum": [
+                "normal",
+                "high"
+            ]
+        },
         "Provenance": {
             "title": "Provenance",
             "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",

package/dist/persona/attribute/list/1.0/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/persona/attribute/list/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,wDAAiE,CAAC;AAK1F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iEAA0E,CAAC;AAK5G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,wDAAwD;IAC/D,OAAO,EAAE,kCAAkC;IAC3C,aAAa,EAAE,gNAAgN;IAC/N,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,YAAY,EAAE;QACZ,YAAY,EAAE;YACZ,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,+YAA+Y;SAC/Z;QACD,eAAe,EAAE;YACf,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,6RAA6R;SAC7S;QACD,cAAc,EAAE;YACd,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,qZAAqZ;SACra;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,6GAA6G;SAC7H;QACD,OAAO,EAAE;YACP,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,8LAA8L;SAC9M;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,mHAAmH;YAClI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;aACb;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6HAA6H;iBAC7I;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,4RAA4R;YAC3S,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,MAAM;gBACN,WAAW;gBACX,YAAY;gBACZ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,aAAa,EAAE,ojBAAojB;iBACpkB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,oBAAoB;iBAC7B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,2JAA2J;iBAC3K;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,SAAS;wBACT,UAAU;wBACV,SAAS;wBACT,UAAU;qBACX;oBACD,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,mHAAmH;YAClI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;aACb;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6HAA6H;iBAC7I;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,4RAA4R;YAC3S,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,MAAM;gBACN,WAAW;gBACX,YAAY;gBACZ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,aAAa,EAAE,ojBAAojB;iBACpkB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,oBAAoB;iBAC7B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,2JAA2J;iBAC3K;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,SAAS;wBACT,UAAU;wBACV,SAAS;wBACT,UAAU;qBACX;oBACD,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/persona/attribute/list/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2DH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,wDAAiE,CAAC;AAK1F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iEAA0E,CAAC;AAK5G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,wDAAwD;IAC/D,OAAO,EAAE,kCAAkC;IAC3C,aAAa,EAAE,gNAAgN;IAC/N,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,YAAY,EAAE;QACZ,YAAY,EAAE;YACZ,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,+YAA+Y;SAC/Z;QACD,eAAe,EAAE;YACf,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,6RAA6R;SAC7S;QACD,kBAAkB,EAAE;YAClB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,g5BAAg5B;SACh6B;QACD,cAAc,EAAE;YACd,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,qZAAqZ;SACra;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,6GAA6G;SAC7H;QACD,OAAO,EAAE;YACP,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,8LAA8L;SAC9M;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,mHAAmH;YAClI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;aACb;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6HAA6H;iBAC7I;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,4RAA4R;YAC3S,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,MAAM;gBACN,WAAW;gBACX,YAAY;gBACZ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,aAAa,EAAE,ojBAAojB;iBACpkB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,oBAAoB;iBAC7B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,2JAA2J;iBAC3K;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,SAAS;wBACT,UAAU;wBACV,SAAS;wBACT,UAAU;qBACX;oBACD,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,kKAAkK;iBAClL;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,4BAA4B;oBACpC,aAAa,EAAE,gGAAgG;iBAChH;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,oBAAoB,EAAE;YACpB,OAAO,EAAE,oBAAoB;YAC7B,aAAa,EAAE,q0BAAq0B;YACp1B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;aACT;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,qxBAAqxB;YACpyB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,MAAM;aACP;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,mHAAmH;YAClI,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;aACb;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6HAA6H;iBAC7I;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,4RAA4R;YAC3S,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,aAAa;gBACb,MAAM;gBACN,WAAW;gBACX,YAAY;gBACZ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,aAAa,EAAE;oBACb,MAAM,EAAE,cAAc;iBACvB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,aAAa,EAAE,ojBAAojB;iBACpkB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oHAAoH;iBACpI;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,oBAAoB;iBAC7B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,2JAA2J;iBAC3K;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,SAAS;wBACT,UAAU;wBACV,SAAS;wBACT,UAAU;qBACX;oBACD,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,kKAAkK;iBAClL;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,4BAA4B;oBACpC,aAAa,EAAE,gGAAgG;iBAChH;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,gGAAgG;YAC/G,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;SACb;QACD,oBAAoB,EAAE;YACpB,OAAO,EAAE,oBAAoB;YAC7B,aAAa,EAAE,q0BAAq0B;YACp1B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;aACT;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,qxBAAqxB;YACpyB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,MAAM;aACP;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,8jCAA8jC;YAC7kC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE;gBACV,MAAM;aACP;YACD,OAAO,EAAE;gBACP;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,cAAc;yBACxB;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,cAAc;wBACd,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,kBAAkB;yBAC5B;wBACD,cAAc,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,6CAA6C;yBAC7D;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,SAAS,EAAE,4BAA4B;4BACvC,aAAa,EAAE,iGAAiG;yBACjH;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,aAAa,EAAE,qHAAqH;yBACrI;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE,mBAAmB;4BAC3B,aAAa,EAAE,+DAA+D;yBAC/E;qBACF;iBACF;gBACD;oBACE,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,WAAW;yBACrB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,EAAE;4BACf,aAAa,EAAE,kEAAkE;yBAClF;wBACD,aAAa,EAAE;4BACb,MAAM,EAAE,SAAS;4BACjB,SAAS,EAAE,IAAI;4BACf,aAAa,EAAE,oGAAoG;yBACpH;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,64BAA64B;YAC55B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,SAAS;gBACT,qBAAqB;gBACrB,OAAO;aACR;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0YAA0Y;YACzZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ;aACT;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,waAAwa;YACvb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/dist/persona/attribute/put/1.0/payload.d.ts

@@ -2,7 +2,7 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/persona/attribute/put/1.0/payload.schema.json
  */
-import type { ClaimType, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, ProofRung, Provenance, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
+import type { ClaimType, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
 /**
  * Create or replace one attribute in the holder's pool. Omit `attributeId` to create; supply it to replace. `expectedVersion` makes the write conditional.
  */
@@ -24,6 +24,14 @@ export interface PersonaAttributePutPayload {
      */
     label?: string;
     provenance: Provenance;
+    /**
+     * How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed.
+     */
+    sensitivity?: Sensitivity;
+    /**
+     * What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`.
+     */
+    release?: ReleaseRequirement;
     /**
      * Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.
      */
@@ -58,7 +66,7 @@ export interface PersonaAttributePutResponsePayload {
     ext?: Ext;
 }
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ClaimType, ExpectedVersion, Ext, ProofRung, Provenance, Ulid, ValueType, Version };
+export type { ClaimType, ExpectedVersion, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version };
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/persona/attribute/put/1.0";
 /** Stable alias for this specification's request payload shape. */
@@ -106,6 +114,14 @@ export declare const PAYLOAD_SCHEMA: {
         readonly provenance: {
             readonly $ref: "#/$defs/Provenance";
         };
+        readonly sensitivity: {
+            readonly $ref: "#/$defs/Sensitivity";
+            readonly description: "How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed.";
+        };
+        readonly release: {
+            readonly $ref: "#/$defs/ReleaseRequirement";
+            readonly description: "What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`.";
+        };
         readonly expectedVersion: {
             readonly $ref: "#/$defs/ExpectedVersion";
             readonly description: "Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.";
@@ -192,6 +208,18 @@ export declare const PAYLOAD_SCHEMA: {
             readonly type: "integer";
             readonly minimum: 0;
         };
+        readonly ReleaseRequirement: {
+            readonly title: "ReleaseRequirement";
+            readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+            readonly type: "string";
+            readonly enum: readonly ["consent", "stepUp"];
+        };
+        readonly Sensitivity: {
+            readonly title: "Sensitivity";
+            readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+            readonly type: "string";
+            readonly enum: readonly ["normal", "high"];
+        };
         readonly Provenance: {
             readonly title: "Provenance";
             readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
@@ -356,6 +384,18 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
             readonly type: "integer";
             readonly minimum: 0;
         };
+        readonly ReleaseRequirement: {
+            readonly title: "ReleaseRequirement";
+            readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+            readonly type: "string";
+            readonly enum: readonly ["consent", "stepUp"];
+        };
+        readonly Sensitivity: {
+            readonly title: "Sensitivity";
+            readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+            readonly type: "string";
+            readonly enum: readonly ["normal", "high"];
+        };
         readonly Provenance: {
             readonly title: "Provenance";
             readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
@@ -481,6 +521,14 @@ export declare const SPEC: {
             readonly provenance: {
                 readonly $ref: "#/$defs/Provenance";
             };
+            readonly sensitivity: {
+                readonly $ref: "#/$defs/Sensitivity";
+                readonly description: "How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed.";
+            };
+            readonly release: {
+                readonly $ref: "#/$defs/ReleaseRequirement";
+                readonly description: "What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`.";
+            };
             readonly expectedVersion: {
                 readonly $ref: "#/$defs/ExpectedVersion";
                 readonly description: "Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.";
@@ -567,6 +615,18 @@ export declare const SPEC: {
                 readonly type: "integer";
                 readonly minimum: 0;
             };
+            readonly ReleaseRequirement: {
+                readonly title: "ReleaseRequirement";
+                readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+                readonly type: "string";
+                readonly enum: readonly ["consent", "stepUp"];
+            };
+            readonly Sensitivity: {
+                readonly title: "Sensitivity";
+                readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+                readonly type: "string";
+                readonly enum: readonly ["normal", "high"];
+            };
             readonly Provenance: {
                 readonly title: "Provenance";
                 readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
@@ -742,6 +802,18 @@ export declare const RESPONSE_SPEC: {
                 readonly type: "integer";
                 readonly minimum: 0;
             };
+            readonly ReleaseRequirement: {
+                readonly title: "ReleaseRequirement";
+                readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+                readonly type: "string";
+                readonly enum: readonly ["consent", "stepUp"];
+            };
+            readonly Sensitivity: {
+                readonly title: "Sensitivity";
+                readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+                readonly type: "string";
+                readonly enum: readonly ["normal", "high"];
+            };
             readonly Provenance: {
                 readonly title: "Provenance";
                 readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";

package/dist/persona/attribute/put/1.0/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/attribute/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,2BAA2B,IAAI,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAGhM;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;IACrB;;OAEG;IACH,KAAK,EAAE;QACL,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,WAAW,EAAE,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;QAClC;;WAEG;QACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAEjG,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAEjD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgPjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuM1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/attribute/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,2BAA2B,IAAI,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAGjO;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;IACrB;;OAEG;IACH,KAAK,EAAE;QACL,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,WAAW,EAAE,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;QAClC;;WAEG;QACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAElI,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAEjD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0QjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyN1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/persona/attribute/put/1.0/payload.js

@@ -50,6 +50,14 @@ export const PAYLOAD_SCHEMA = {
         "provenance": {
             "$ref": "#/$defs/Provenance"
         },
+        "sensitivity": {
+            "$ref": "#/$defs/Sensitivity",
+            "description": "How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed."
+        },
+        "release": {
+            "$ref": "#/$defs/ReleaseRequirement",
+            "description": "What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`."
+        },
         "expectedVersion": {
             "$ref": "#/$defs/ExpectedVersion",
             "description": "Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only."
@@ -147,6 +155,24 @@ export const PAYLOAD_SCHEMA = {
             "type": "integer",
             "minimum": 0
         },
+        "ReleaseRequirement": {
+            "title": "ReleaseRequirement",
+            "description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
+            "type": "string",
+            "enum": [
+                "consent",
+                "stepUp"
+            ]
+        },
+        "Sensitivity": {
+            "title": "Sensitivity",
+            "description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
+            "type": "string",
+            "enum": [
+                "normal",
+                "high"
+            ]
+        },
         "Provenance": {
             "title": "Provenance",
             "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
@@ -348,6 +374,24 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "type": "integer",
             "minimum": 0
         },
+        "ReleaseRequirement": {
+            "title": "ReleaseRequirement",
+            "description": "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.",
+            "type": "string",
+            "enum": [
+                "consent",
+                "stepUp"
+            ]
+        },
+        "Sensitivity": {
+            "title": "Sensitivity",
+            "description": "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.",
+            "type": "string",
+            "enum": [
+                "normal",
+                "high"
+            ]
+        },
         "Provenance": {
             "title": "Provenance",
             "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",