@openvtc/trust-tasks 0.17.4 → 0.17.6

package/dist/auth/step-up/approve-response/0.3/payload.d.ts

@@ -0,0 +1,887 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approve-response/0.3/payload.schema.json
+ */
+import type { AuthenticatorAssertionResponseLogin, Ext, Session } from "../../../../_shared/components.js";
+/**
+ * How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted.
+ */
+export type StepUpEvidence = DidSigned | WebAuthn;
+/**
+ * The approver's signed ratification of a step-up: subject + sessionId + challenge are echoed inside a proof-bearing document so the relying party can elevate the session.
+ */
+export interface AuthStepUpApproveResponse {
+    /**
+     * Echoed from the matching approve-request. The relying party verifies it equals the session's subject.
+     */
+    subject: string;
+    /**
+     * Echoed from the matching approve-request. The relying party uses it to locate the session to elevate.
+     */
+    sessionId: string;
+    /**
+     * Echoed from the matching approve-request. The relying party verifies it equals the bound challenge.
+     */
+    challenge: string;
+    /**
+     * `approved` elevates the session per the relying party's policy. `denied` is a signed refusal — useful for audit even though it elevates nothing.
+     */
+    decision: "approved" | "denied";
+    /**
+     * Required when decision is `denied`. Human-readable rationale the user provided (or which the approver inferred).
+     */
+    deniedReason?: string;
+    /**
+     * The acr the approver believes it has cryptographically demonstrated. The relying party MAY accept this, MAY upgrade to a lower value, but MUST NOT exceed it.
+     */
+    grantedAcr?: string;
+    evidence?: StepUpEvidence;
+    ext?: Ext;
+}
+/**
+ * The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects "vta"/"did".
+ */
+export interface DidSigned {
+    kind: "didSigned";
+}
+export interface WebAuthn {
+    kind: "webauthn";
+    /**
+     * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
+     */
+    assertion: AuthenticatorAssertionResponseLogin;
+}
+/**
+ * Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.3#response.
+ */
+export interface AuthStepUpApproveResponseRelyingPartyAck {
+    /**
+     * `elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied.
+     */
+    status: "elevated" | "recorded" | "rejected";
+    /**
+     * Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen.
+     */
+    session?: Session;
+    /**
+     * Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value.
+     */
+    boundTo?: string;
+    /**
+     * Present when status is `rejected` (e.g. "challenge expired", "session not found", "acr ceiling exceeded").
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext, Session };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approve-response/0.3";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproveResponse;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approve-response/0.3#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveResponseRelyingPartyAck;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/step-up/approve-response/0.3";
+    readonly title: "Auth — Step-up Approve Response";
+    readonly description: "The approver's signed ratification of a step-up: subject + sessionId + challenge are echoed inside a proof-bearing document so the relying party can elevate the session.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["subject", "sessionId", "challenge", "decision"];
+    readonly properties: {
+        readonly subject: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Echoed from the matching approve-request. The relying party verifies it equals the session's subject.";
+        };
+        readonly sessionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Echoed from the matching approve-request. The relying party uses it to locate the session to elevate.";
+        };
+        readonly challenge: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly description: "Echoed from the matching approve-request. The relying party verifies it equals the bound challenge.";
+        };
+        readonly decision: {
+            readonly type: "string";
+            readonly enum: readonly ["approved", "denied"];
+            readonly description: "`approved` elevates the session per the relying party's policy. `denied` is a signed refusal — useful for audit even though it elevates nothing.";
+        };
+        readonly deniedReason: {
+            readonly type: "string";
+            readonly maxLength: 500;
+            readonly description: "Required when decision is `denied`. Human-readable rationale the user provided (or which the approver inferred).";
+        };
+        readonly grantedAcr: {
+            readonly type: "string";
+            readonly description: "The acr the approver believes it has cryptographically demonstrated. The relying party MAY accept this, MAY upgrade to a lower value, but MUST NOT exceed it.";
+        };
+        readonly evidence: {
+            readonly $ref: "#/$defs/Evidence";
+            readonly description: "How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Evidence: {
+            readonly $anchor: "evidence";
+            readonly title: "Step-up Evidence";
+            readonly description: "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).";
+            readonly oneOf: readonly [{
+                readonly title: "DidSigned";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "didSigned";
+                    };
+                };
+                readonly description: "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\".";
+            }, {
+                readonly title: "WebAuthn";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "assertion"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webauthn";
+                    };
+                    readonly assertion: {
+                        readonly $ref: "#/$defs/AssertionResponse";
+                        readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\".";
+                    };
+                };
+            }];
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Step-up Approve Response — relying party ack";
+            readonly description: "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.3#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["elevated", "recorded", "rejected"];
+                    readonly description: "`elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied.";
+                };
+                readonly session: {
+                    readonly $ref: "#/$defs/Session";
+                    readonly description: "Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen.";
+                };
+                readonly boundTo: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\").";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Session: {
+            readonly $anchor: "session";
+            readonly title: "Session";
+            readonly description: "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "subject", "issuedAt", "expiresAt"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The authenticated party's VID (typically a DID URL).";
+                };
+                readonly issuedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "ISO-8601 timestamp when the session was created.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.";
+                };
+                readonly amr: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used.";
+                };
+                readonly acr: {
+                    readonly type: "string";
+                    readonly description: "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly AssertionResponse: {
+            readonly $anchor: "assertionResponse";
+            readonly title: "AuthenticatorAssertionResponse (login)";
+            readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "rawId", "type", "response"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                };
+                readonly rawId: {
+                    readonly type: "string";
+                };
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly response: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                    readonly properties: {
+                        readonly clientDataJSON: {
+                            readonly type: "string";
+                        };
+                        readonly authenticatorData: {
+                            readonly type: "string";
+                        };
+                        readonly signature: {
+                            readonly type: "string";
+                        };
+                        readonly userHandle: {
+                            readonly type: readonly ["string", "null"];
+                        };
+                    };
+                };
+                readonly authenticatorAttachment: {
+                    readonly enum: readonly ["platform", "cross-platform"];
+                };
+                readonly clientExtensionResults: {
+                    readonly type: "object";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Evidence: {
+            readonly $anchor: "evidence";
+            readonly title: "Step-up Evidence";
+            readonly description: "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).";
+            readonly oneOf: readonly [{
+                readonly title: "DidSigned";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "didSigned";
+                    };
+                };
+                readonly description: "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\".";
+            }, {
+                readonly title: "WebAuthn";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "assertion"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webauthn";
+                    };
+                    readonly assertion: {
+                        readonly $ref: "#/$defs/AssertionResponse";
+                        readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\".";
+                    };
+                };
+            }];
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Step-up Approve Response — relying party ack";
+            readonly description: "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.3#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["elevated", "recorded", "rejected"];
+                    readonly description: "`elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied.";
+                };
+                readonly session: {
+                    readonly $ref: "#/$defs/Session";
+                    readonly description: "Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen.";
+                };
+                readonly boundTo: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\").";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Session: {
+            readonly $anchor: "session";
+            readonly title: "Session";
+            readonly description: "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "subject", "issuedAt", "expiresAt"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The authenticated party's VID (typically a DID URL).";
+                };
+                readonly issuedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "ISO-8601 timestamp when the session was created.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.";
+                };
+                readonly amr: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used.";
+                };
+                readonly acr: {
+                    readonly type: "string";
+                    readonly description: "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly AssertionResponse: {
+            readonly $anchor: "assertionResponse";
+            readonly title: "AuthenticatorAssertionResponse (login)";
+            readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "rawId", "type", "response"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                };
+                readonly rawId: {
+                    readonly type: "string";
+                };
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly response: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                    readonly properties: {
+                        readonly clientDataJSON: {
+                            readonly type: "string";
+                        };
+                        readonly authenticatorData: {
+                            readonly type: "string";
+                        };
+                        readonly signature: {
+                            readonly type: "string";
+                        };
+                        readonly userHandle: {
+                            readonly type: readonly ["string", "null"];
+                        };
+                    };
+                };
+                readonly authenticatorAttachment: {
+                    readonly enum: readonly ["platform", "cross-platform"];
+                };
+                readonly clientExtensionResults: {
+                    readonly type: "object";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approve-response/0.3";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/step-up/approve-response/0.3";
+        readonly title: "Auth — Step-up Approve Response";
+        readonly description: "The approver's signed ratification of a step-up: subject + sessionId + challenge are echoed inside a proof-bearing document so the relying party can elevate the session.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["subject", "sessionId", "challenge", "decision"];
+        readonly properties: {
+            readonly subject: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Echoed from the matching approve-request. The relying party verifies it equals the session's subject.";
+            };
+            readonly sessionId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Echoed from the matching approve-request. The relying party uses it to locate the session to elevate.";
+            };
+            readonly challenge: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly description: "Echoed from the matching approve-request. The relying party verifies it equals the bound challenge.";
+            };
+            readonly decision: {
+                readonly type: "string";
+                readonly enum: readonly ["approved", "denied"];
+                readonly description: "`approved` elevates the session per the relying party's policy. `denied` is a signed refusal — useful for audit even though it elevates nothing.";
+            };
+            readonly deniedReason: {
+                readonly type: "string";
+                readonly maxLength: 500;
+                readonly description: "Required when decision is `denied`. Human-readable rationale the user provided (or which the approver inferred).";
+            };
+            readonly grantedAcr: {
+                readonly type: "string";
+                readonly description: "The acr the approver believes it has cryptographically demonstrated. The relying party MAY accept this, MAY upgrade to a lower value, but MUST NOT exceed it.";
+            };
+            readonly evidence: {
+                readonly $ref: "#/$defs/Evidence";
+                readonly description: "How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Evidence: {
+                readonly $anchor: "evidence";
+                readonly title: "Step-up Evidence";
+                readonly description: "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).";
+                readonly oneOf: readonly [{
+                    readonly title: "DidSigned";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "didSigned";
+                        };
+                    };
+                    readonly description: "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\".";
+                }, {
+                    readonly title: "WebAuthn";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "assertion"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webauthn";
+                        };
+                        readonly assertion: {
+                            readonly $ref: "#/$defs/AssertionResponse";
+                            readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\".";
+                        };
+                    };
+                }];
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Step-up Approve Response — relying party ack";
+                readonly description: "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.3#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["elevated", "recorded", "rejected"];
+                        readonly description: "`elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied.";
+                    };
+                    readonly session: {
+                        readonly $ref: "#/$defs/Session";
+                        readonly description: "Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen.";
+                    };
+                    readonly boundTo: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\").";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Session: {
+                readonly $anchor: "session";
+                readonly title: "Session";
+                readonly description: "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "subject", "issuedAt", "expiresAt"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The authenticated party's VID (typically a DID URL).";
+                    };
+                    readonly issuedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "ISO-8601 timestamp when the session was created.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.";
+                    };
+                    readonly amr: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly description: "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used.";
+                    };
+                    readonly acr: {
+                        readonly type: "string";
+                        readonly description: "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly AssertionResponse: {
+                readonly $anchor: "assertionResponse";
+                readonly title: "AuthenticatorAssertionResponse (login)";
+                readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "rawId", "type", "response"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                    };
+                    readonly rawId: {
+                        readonly type: "string";
+                    };
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly response: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                        readonly properties: {
+                            readonly clientDataJSON: {
+                                readonly type: "string";
+                            };
+                            readonly authenticatorData: {
+                                readonly type: "string";
+                            };
+                            readonly signature: {
+                                readonly type: "string";
+                            };
+                            readonly userHandle: {
+                                readonly type: readonly ["string", "null"];
+                            };
+                        };
+                    };
+                    readonly authenticatorAttachment: {
+                        readonly enum: readonly ["platform", "cross-platform"];
+                    };
+                    readonly clientExtensionResults: {
+                        readonly type: "object";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approve-response/0.3#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Evidence: {
+                readonly $anchor: "evidence";
+                readonly title: "Step-up Evidence";
+                readonly description: "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).";
+                readonly oneOf: readonly [{
+                    readonly title: "DidSigned";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "didSigned";
+                        };
+                    };
+                    readonly description: "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\".";
+                }, {
+                    readonly title: "WebAuthn";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "assertion"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webauthn";
+                        };
+                        readonly assertion: {
+                            readonly $ref: "#/$defs/AssertionResponse";
+                            readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\".";
+                        };
+                    };
+                }];
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Step-up Approve Response — relying party ack";
+                readonly description: "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.3#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["elevated", "recorded", "rejected"];
+                        readonly description: "`elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied.";
+                    };
+                    readonly session: {
+                        readonly $ref: "#/$defs/Session";
+                        readonly description: "Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen.";
+                    };
+                    readonly boundTo: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\").";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Session: {
+                readonly $anchor: "session";
+                readonly title: "Session";
+                readonly description: "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "subject", "issuedAt", "expiresAt"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The authenticated party's VID (typically a DID URL).";
+                    };
+                    readonly issuedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "ISO-8601 timestamp when the session was created.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.";
+                    };
+                    readonly amr: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly description: "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used.";
+                    };
+                    readonly acr: {
+                        readonly type: "string";
+                        readonly description: "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly AssertionResponse: {
+                readonly $anchor: "assertionResponse";
+                readonly title: "AuthenticatorAssertionResponse (login)";
+                readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "rawId", "type", "response"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                    };
+                    readonly rawId: {
+                        readonly type: "string";
+                    };
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly response: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                        readonly properties: {
+                            readonly clientDataJSON: {
+                                readonly type: "string";
+                            };
+                            readonly authenticatorData: {
+                                readonly type: "string";
+                            };
+                            readonly signature: {
+                                readonly type: "string";
+                            };
+                            readonly userHandle: {
+                                readonly type: readonly ["string", "null"];
+                            };
+                        };
+                    };
+                    readonly authenticatorAttachment: {
+                        readonly enum: readonly ["platform", "cross-platform"];
+                    };
+                    readonly clientExtensionResults: {
+                        readonly type: "object";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map