@openvtc/trust-tasks 0.2.55 → 0.2.56

package/dist/vault/list/0.2/payload.d.ts

@@ -6,6 +6,14 @@
  * Optional filter — only entries of this secret kind are returned.
  */
 export type SecretKind = "password" | "passkey" | "oauthTokens" | "didSelfIssued" | "didcommPeer" | "bearerToken" | "sshKey" | "custom";
+/**
+ * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
+ */
+export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
+/**
+ * Discriminator for the kind of secret this entry holds. The secret material itself is NEVER returned in metadata views; the kind is exposed so consumers can render an appropriate UI affordance and so policy decisions can route by kind.
+ */
+export type SecretKind1 = "password" | "passkey" | "oauthTokens" | "didSelfIssued" | "didcommPeer" | "bearerToken" | "sshKey" | "custom";
 /**
  * Query a vault maintainer for the metadata view of stored entries. All filters are AND-combined. Pagination is opaque-cursor based; the maintainer chooses page size within the caller's bound and its own ceiling. Secret material is NEVER returned by this task — even when the requesting consumer has VaultRead capability for the entry, the secret is only released via vault/release/0.1.
  */
@@ -71,8 +79,186 @@ export interface VaultListPayload {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a vault/list request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vault/list/0.1#response.
+ */
+export interface VaultListResponsePayload {
+    /**
+     * Matching VaultEntry items in metadata-only view, in maintainer-defined order (RECOMMENDED: most-recently-used first when no other order is implied by the filters). May be empty.
+     */
+    entries: VaultEntry[];
+    /**
+     * true when more matching entries exist beyond `entries`; false when this response is the complete result. Independent of `cursor`: a maintainer MAY truncate without supporting pagination, in which case `truncated` is true and `cursor` is absent.
+     */
+    truncated: boolean;
+    /**
+     * Opaque continuation token to fetch the next page. Present only when `truncated` is true AND the maintainer supports pagination from this point.
+     */
+    cursor?: string;
+    /**
+     * Names of VaultEntry fields the maintainer redacted from every returned entry (for example, ['lastUsedAt'] when releasing to a consumer whose policy does not permit timing-data exposure).
+     */
+    redactedFields?: string[];
+    ext?: Ext2;
+}
+export interface VaultEntry {
+    /**
+     * Opaque vault-maintainer-assigned identifier for the entry. ULID/UUID/base32 are common; the wire spec only requires non-empty string equality.
+     */
+    id: string;
+    /**
+     * Identifier of the trust context (persona) the entry belongs to. Opaque string interpreted by the vault maintainer; corresponds to a single ContextRecord on the VTA side.
+     */
+    contextId: string;
+    /**
+     * One or more binding targets — web origins, mobile app identifiers, and/or DIDs — that this credential applies to. A request from any matching target uses this entry. A typical entry for a service that exists as both a website and mobile apps will list a web origin, an iOS bundle id, and an Android package id; passkeys for that service typically list only the origin (because iOS Associated Domains and Android Asset Links bind apps to the domain at the OS level).
+     *
+     * @minItems 1
+     */
+    targets: [SiteTarget, ...SiteTarget[]];
+    /**
+     * Human-readable display name (e.g. "Work GitHub", "Personal bank — checking"). Maintainers MAY enforce a maximum length; the wire spec does not.
+     */
+    label: string;
+    secretKind: SecretKind1;
+    /**
+     * User-defined tags for organisation and filtering (e.g. ["family", "finance"]). Maintainers MAY enforce a maximum count; the wire spec does not.
+     */
+    tags?: string[];
+    /**
+     * Non-sensitive notes the user attached to the entry. Visible in metadata view (suitable for support contact, account number, expiry policy memos). SENSITIVE notes belong in the secret payload as a `secureNotes` field — those are only released by vault/release/0.1.
+     */
+    notes?: string;
+    /**
+     * Optional URI of an icon to display in the consumer UI. Maintainers MAY fetch and cache; consumers SHOULD treat as untrusted content and fetch via a sandboxed pipeline.
+     */
+    favicon?: string;
+    /**
+     * Opaque maintainer-defined selector strings fed to the policy engine when this entry is requested (e.g. "recent_uv_required", "network_class=corp", "step_up_push"). Consumers MUST treat selectors as opaque; they exist for policy authoring on the maintainer side.
+     */
+    selectors?: string[];
+    /**
+     * Names of additional fields the user has attached (e.g. ["security-question-1", "account-number"]). The VALUES live in the secret payload and are only delivered by vault/release/0.1. Exposing names in metadata lets the consumer render the right form layout before requesting release.
+     */
+    customFieldNames?: string[];
+    /**
+     * References to encrypted blobs associated with the entry (recovery codes, PEM files, screenshots of authenticator setup). The blobs themselves are fetched via a separate mechanism the maintainer documents; metadata view exposes only the descriptor.
+     */
+    attachments?: AttachmentRef[];
+    /**
+     * Optional time after which the credential is no longer expected to be valid (e.g. an OAuth refresh token's known expiry, a time-limited API token, an enterprise password rotation policy). Maintainers MAY surface this in the consumer UI as a warning.
+     */
+    expiresAt?: string;
+    /**
+     * Set by the maintainer (via HIBP integration or equivalent) when the password material associated with this entry is known to appear in a public breach. Consumers SHOULD surface this prominently. Cleared when the user rotates the password and the new password is not in any known breach.
+     */
+    breachedAt?: string;
+    /**
+     * Set whenever the password component of the secret payload is rotated. Maintainers MUST update this on every secret-material change for entries of kind `password` (or any kind that carries a password component). Used by consumers to surface rotation-overdue warnings.
+     */
+    passwordChangedAt?: string;
+    createdAt: string;
+    /**
+     * VID of the consumer that originally created the entry.
+     */
+    createdBy?: string;
+    updatedAt: string;
+    /**
+     * VID of the consumer that last modified the entry.
+     */
+    updatedBy?: string;
+    /**
+     * Most recent time the entry was used (either released or proxy-login performed). Maintainers MAY return this with reduced precision (e.g. hour-floored) when releasing to a less-trusted consumer.
+     */
+    lastUsedAt?: string;
+    /**
+     * Monotonic version counter incremented on every mutation. Used by consumers for optimistic-concurrency checks on vault/upsert and as the seq baseline for vault/sync.
+     */
+    version: number;
+    /**
+     * Optional cached DID the entry will act AS for DID-shaped flows — mirrors the `did` field of the entry's secret payload when `secretKind` carries one (`didSelfIssued`, `didcommPeer`). Absent for kinds that have no DID concept (`password`, `passkey`, `oauthTokens`, `bearerToken`, `sshKey`, `custom`). MAINTAINER-DERIVED, NOT CONSUMER-SUPPLIED: the maintainer MUST recompute this from the canonical secret at every upsert / secret rotation; a producer-supplied value on `vault/upsert/0.1` MUST be ignored (no error, but no honour). Read-only on the wire, present in metadata views so consumers can drive RP-side flows (e.g. fetch `/auth/challenge` keyed on the principal DID before requesting a proxy-login) without releasing the secret.
+     */
+    principalDid?: string;
+    ext?: Ext1;
+}
+export interface WebOrigin {
+    kind: "webOrigin";
+    /**
+     * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
+     */
+    origin: string;
+}
+export interface Did {
+    kind: "did";
+    /**
+     * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
+     */
+    did: string;
+}
+export interface IosApp {
+    kind: "iosApp";
+    /**
+     * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
+     */
+    bundleId: string;
+    /**
+     * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
+     */
+    teamId?: string;
+}
+export interface AndroidApp {
+    kind: "androidApp";
+    /**
+     * Android package name in reverse-DNS form (e.g. "com.github.android").
+     */
+    packageName: string;
+    /**
+     * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
+     *
+     * @minItems 1
+     */
+    sha256CertFingerprints: [string, ...string[]];
+}
+export interface AttachmentRef {
+    /**
+     * Opaque maintainer-assigned id for this attachment; used to fetch the blob via a separate mechanism.
+     */
+    id: string;
+    /**
+     * User-supplied filename (e.g. "recovery-codes.txt").
+     */
+    name: string;
+    /**
+     * Size of the encrypted blob in bytes. Maintainers MAY enforce a maximum per attachment and per entry.
+     */
+    sizeBytes: number;
+    /**
+     * Hex-encoded SHA-256 of the encrypted blob bytes (post-encryption). Lets the consumer verify integrity after fetch.
+     */
+    sha256: string;
+    /**
+     * Optional MIME type hint for the consumer UI (e.g. "text/plain", "application/x-pem-file").
+     */
+    contentType?: string;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/vault/list/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SecretKind;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vault/list/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultListResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/vault/list/0.2/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/list/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,SAAS,GACT,aAAa,GACb,eAAe,GACf,aAAa,GACb,aAAa,GACb,QAAQ,GACR,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;OAEG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,KAAK,CAAC;CACpD;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qDAA8D,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/list/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,SAAS,GACT,aAAa,GACb,eAAe,GACf,aAAa,GACb,aAAa,GACb,QAAQ,GACR,QAAQ,CAAC;AACb;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAC/D;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,SAAS,GACT,aAAa,GACb,eAAe,GACf,aAAa,GACb,aAAa,GACb,QAAQ,GACR,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;OAEG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,KAAK,CAAC;CACpD;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACvC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,WAAW,CAAC;IACxB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;OAEG;IACH,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4CAAqD,CAAC;AAE9E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC;AAEjC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qDAA8D,CAAC;AAEhG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,wBAAwB,CAAC"}

package/dist/vault/list/0.2/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/list/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiFH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qDAA8D,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/list/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+QH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4CAAqD,CAAC;AAK9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qDAA8D,CAAC"}

package/dist/vault/proxy-login/0.1/payload.d.ts

@@ -6,6 +6,10 @@
  * Optional — when an entry has multiple targets, names which one the consumer is acting against. The maintainer matches this against the entry's `targets[]`; if not supplied, the maintainer chooses the most specific target compatible with the requesting consumer's form factor (e.g. an iOS Companion gets the iOS-app target if one exists; otherwise the web-origin target).
  */
 export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
+/**
+ * Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.
+ */
+export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
 /**
  * Consumer requests that the vault maintainer perform a login at the bound third-party site on the consumer's behalf, using the entry's secret material WITHOUT releasing it to the consumer. The maintainer returns a SessionBlob in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope) containing the resulting cookies/headers the consumer can use to operate the session — but never the long-term credential.
  */
@@ -102,8 +106,58 @@ export interface StepUpProof {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+export interface VaultProxyLoginResponsePayload {
+    sealedSessionBlob: SealedEnvelope;
+    ext?: Ext;
+}
+/**
+ * DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.
+ *
+ * M2A is the only implementation today; this is also the canonical default for new code.
+ */
+export interface DidcommAuthcryptEnvelope {
+    envelope: "didcomm-authcrypt";
+    /**
+     * Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.
+     */
+    jwe: string;
+}
+/**
+ * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.
+ *
+ * No open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.
+ */
+export interface HpkeArmoredEnvelope {
+    envelope: "hpke-armored";
+    /**
+     * ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.
+     */
+    armored: string;
+    /**
+     * did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.
+     */
+    recipientKeyId: string;
+    /**
+     * Producer-assertion mode per the sealed-transfer framework. `did-signed` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinned-only` = OOB SHA-256 digest only (dev/test, NOT for production).
+     */
+    producerAssertion?: "did-signed" | "attested" | "pinned-only";
+}
+/**
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ */
+export interface TspMessageEnvelope {
+    envelope: "tsp-message";
+    /**
+     * Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format
+     */
+    message: string;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/vault/proxy-login/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SiteTarget;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vault/proxy-login/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultProxyLoginResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/vault/proxy-login/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAC/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,wBAAwB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEjG;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,cAAc,CAAC;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,iBAAiB,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,aAAa,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC;AAEjC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC;AAEvG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,8BAA8B,CAAC"}

package/dist/vault/proxy-login/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwGH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,mDAA4D,CAAC;AAErF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4DAAqE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0JH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,mDAA4D,CAAC;AAKrF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4DAAqE,CAAC"}

package/dist/vault/proxy-login/0.2/payload.d.ts

@@ -6,6 +6,10 @@
  * Optional — when an entry has multiple targets, names which one the consumer is acting against. The maintainer matches this against the entry's `targets[]`; if not supplied, the maintainer chooses the most specific target compatible with the requesting consumer's form factor (e.g. an iOS Companion gets the iOS-app target if one exists; otherwise the web-origin target).
  */
 export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
+/**
+ * Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.
+ */
+export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
 /**
  * Consumer requests that the vault maintainer perform a login at the bound third-party site on the consumer's behalf, using the entry's secret material WITHOUT releasing it to the consumer. The maintainer returns a SessionBlob in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope) containing the resulting cookies/headers the consumer can use to operate the session — but never the long-term credential.
  */
@@ -102,8 +106,58 @@ export interface StepUpProof {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+export interface VaultProxyLoginResponsePayload {
+    sealedSessionBlob: SealedEnvelope;
+    ext?: Ext;
+}
+/**
+ * DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.
+ *
+ * M2A is the only implementation today; this is also the canonical default for new code.
+ */
+export interface DidcommAuthcryptEnvelope {
+    envelope: "didcommAuthcrypt";
+    /**
+     * Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.
+     */
+    jwe: string;
+}
+/**
+ * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`didSigned` / `attested` / `pinnedOnly`) is the integrity / authenticity anchor.
+ *
+ * No open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.
+ */
+export interface HpkeArmoredEnvelope {
+    envelope: "hpkeArmored";
+    /**
+     * ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.
+     */
+    armored: string;
+    /**
+     * did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.
+     */
+    recipientKeyId: string;
+    /**
+     * Producer-assertion mode per the sealed-transfer framework. `didSigned` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinnedOnly` = OOB SHA-256 digest only (dev/test, NOT for production).
+     */
+    producerAssertion?: "didSigned" | "attested" | "pinnedOnly";
+}
+/**
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ */
+export interface TspMessageEnvelope {
+    envelope: "tspMessage";
+    /**
+     * Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format
+     */
+    message: string;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/vault/proxy-login/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SiteTarget;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vault/proxy-login/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultProxyLoginResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/vault/proxy-login/0.2/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,cAAc,GAAG,MAAM,CAAC;IAC7C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAC/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,wBAAwB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEjG;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,cAAc,GAAG,MAAM,CAAC;IAC7C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,cAAc,CAAC;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,iBAAiB,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;CAC7D;AACD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,YAAY,CAAC;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC;AAEjC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC;AAEvG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,8BAA8B,CAAC"}

package/dist/vault/proxy-login/0.2/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwGH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,mDAA4D,CAAC;AAErF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4DAAqE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/proxy-login/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0JH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,mDAA4D,CAAC;AAKrF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4DAAqE,CAAC"}

package/dist/vault/release/0.1/payload.d.ts

@@ -6,6 +6,14 @@
  * Optional — for entries with multiple targets, indicates which one the consumer is acting against. The maintainer's policy may decide release based on the target (e.g. release for web origin allowed, release for iOS app denied).
  */
 export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
+/**
+ * Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelope_unsupported`.
+ */
+export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
+/**
+ * Discriminator so the consumer can pre-allocate the right type before unsealing.
+ */
+export type SecretKind = "password" | "passkey" | "oauth-tokens" | "did-self-issued" | "didcomm-peer" | "bearer-token" | "ssh-key" | "custom";
 /**
  * Consumer requests that the maintainer release the cleartext secret material of a vault entry. The response carries the secret in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope); the cleartext shape is `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. This is the fallback when proxy-login is not viable (`vault/proxy-login:not_proxyable`) or when the consumer needs the raw secret for a flow the maintainer cannot perform (e.g. autofill into a desktop app, copy-to-clipboard for offline use).
  */
@@ -95,8 +103,63 @@ export interface StepUpProof {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+export interface VaultReleaseResponsePayload {
+    sealedSecret: SealedEnvelope;
+    secretKind: SecretKind;
+    /**
+     * Cache TTL the consumer MUST enforce — wipe the cleartext after this many seconds, even if the user has not finished interacting with it.
+     */
+    ttlSeconds: number;
+    ext?: Ext;
+}
+/**
+ * DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.
+ *
+ * M2A is the only implementation today; this is also the canonical default for new code.
+ */
+export interface DidcommAuthcryptEnvelope {
+    envelope: "didcomm-authcrypt";
+    /**
+     * Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.
+     */
+    jwe: string;
+}
+/**
+ * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.
+ *
+ * No open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.
+ */
+export interface HpkeArmoredEnvelope {
+    envelope: "hpke-armored";
+    /**
+     * ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.
+     */
+    armored: string;
+    /**
+     * did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.
+     */
+    recipientKeyId: string;
+    /**
+     * Producer-assertion mode per the sealed-transfer framework. `did-signed` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinned-only` = OOB SHA-256 digest only (dev/test, NOT for production).
+     */
+    producerAssertion?: "did-signed" | "attested" | "pinned-only";
+}
+/**
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ */
+export interface TspMessageEnvelope {
+    envelope: "tsp-message";
+    /**
+     * Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format
+     */
+    message: string;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/vault/release/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SiteTarget;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vault/release/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultReleaseResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/vault/release/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/release/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,+CAAwD,CAAC;AAEjF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,wDAAiE,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/release/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAC/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,wBAAwB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AACjG;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,SAAS,GACT,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,SAAS,GACT,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,cAAc,CAAC;IAC7B,UAAU,EAAE,UAAU,CAAC;IACvB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,iBAAiB,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,aAAa,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,+CAAwD,CAAC;AAEjF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC;AAEjC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,wDAAiE,CAAC;AAEnG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,2BAA2B,CAAC"}

package/dist/vault/release/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/release/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiGH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,+CAAwD,CAAC;AAEjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wDAAiE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/release/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoKH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,+CAAwD,CAAC;AAKjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wDAAiE,CAAC"}

package/dist/vault/release/0.2/payload.d.ts

@@ -6,6 +6,14 @@
  * Optional — for entries with multiple targets, indicates which one the consumer is acting against. The maintainer's policy may decide release based on the target (e.g. release for web origin allowed, release for iOS app denied).
  */
 export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
+/**
+ * Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelope_unsupported`.
+ */
+export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
+/**
+ * Discriminator so the consumer can pre-allocate the right type before unsealing.
+ */
+export type SecretKind = "password" | "passkey" | "oauthTokens" | "didSelfIssued" | "didcommPeer" | "bearerToken" | "sshKey" | "custom";
 /**
  * Consumer requests that the maintainer release the cleartext secret material of a vault entry. The response carries the secret in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope); the cleartext shape is `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. This is the fallback when proxy-login is not viable (`vault/proxy-login:not_proxyable`) or when the consumer needs the raw secret for a flow the maintainer cannot perform (e.g. autofill into a desktop app, copy-to-clipboard for offline use).
  */
@@ -95,8 +103,63 @@ export interface StepUpProof {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+export interface VaultReleaseResponsePayload {
+    sealedSecret: SealedEnvelope;
+    secretKind: SecretKind;
+    /**
+     * Cache TTL the consumer MUST enforce — wipe the cleartext after this many seconds, even if the user has not finished interacting with it.
+     */
+    ttlSeconds: number;
+    ext?: Ext;
+}
+/**
+ * DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.
+ *
+ * M2A is the only implementation today; this is also the canonical default for new code.
+ */
+export interface DidcommAuthcryptEnvelope {
+    envelope: "didcommAuthcrypt";
+    /**
+     * Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.
+     */
+    jwe: string;
+}
+/**
+ * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`didSigned` / `attested` / `pinnedOnly`) is the integrity / authenticity anchor.
+ *
+ * No open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.
+ */
+export interface HpkeArmoredEnvelope {
+    envelope: "hpkeArmored";
+    /**
+     * ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.
+     */
+    armored: string;
+    /**
+     * did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.
+     */
+    recipientKeyId: string;
+    /**
+     * Producer-assertion mode per the sealed-transfer framework. `didSigned` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinnedOnly` = OOB SHA-256 digest only (dev/test, NOT for production).
+     */
+    producerAssertion?: "didSigned" | "attested" | "pinnedOnly";
+}
+/**
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ */
+export interface TspMessageEnvelope {
+    envelope: "tspMessage";
+    /**
+     * Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format
+     */
+    message: string;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/vault/release/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SiteTarget;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vault/release/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultReleaseResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/vault/release/0.2/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/release/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,cAAc,GAAG,MAAM,CAAC;IAC7C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,+CAAwD,CAAC;AAEjF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,wDAAiE,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/release/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC;AAC/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,wBAAwB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AACjG;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,SAAS,GACT,aAAa,GACb,eAAe,GACf,aAAa,GACb,aAAa,GACb,QAAQ,GACR,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;CAC/C;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,cAAc,GAAG,MAAM,CAAC;IAC7C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,cAAc,CAAC;IAC7B,UAAU,EAAE,UAAU,CAAC;IACvB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AACD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,iBAAiB,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;CAC7D;AACD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,YAAY,CAAC;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,+CAAwD,CAAC;AAEjF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC;AAEjC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,wDAAiE,CAAC;AAEnG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,2BAA2B,CAAC"}

package/dist/vault/release/0.2/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/release/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiGH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,+CAAwD,CAAC;AAEjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wDAAiE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/release/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoKH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,+CAAwD,CAAC;AAKjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wDAAiE,CAAC"}

package/dist/vault/sign-trust-task/0.1/payload.d.ts

@@ -92,8 +92,19 @@ export interface StepUpProof {
      */
     challengeId: string;
 }
+export interface VaultSignTrustTaskResponsePayload {
+    /**
+     * The supplied `unsignedEnvelope` with a Data Integrity `proof` attached. `proof.verificationMethod` is `<principalDid>#<signingKeyId>`; `proof.proofPurpose` is `assertionMethod`; `proof.cryptosuite` is `eddsa-jcs-2022`. All other members of the envelope (`id`, `type`, `issuer`, `recipient`, `issuedAt`, `expiresAt`, `payload`, `ext`) are unchanged from the request.
+     */
+    signedEnvelope: {};
+    ext?: Ext;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/vault/sign-trust-task/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VaultSignTrustTaskPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vault/sign-trust-task/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultSignTrustTaskResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/vault/sign-trust-task/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/sign-trust-task/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/vault/sign-trust-task/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC/D;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,cAAc,EAAE,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,iCAAiC,CAAC"}

package/dist/vault/sign-trust-task/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/sign-trust-task/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6FH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAEzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/vault/sign-trust-task/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoGH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC"}