@openvtc/trust-tasks 0.2.55 → 0.2.56

package/dist/auth/passkey/enroll/finish/0.2/payload.d.ts

@@ -55,8 +55,37 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * Acknowledgement of the registered credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2#response.
+ */
+export interface AuthPasskeyEnrollFinishResponsePayload {
+    /**
+     * base64url-encoded WebAuthn credential id, durable identifier for later management.
+     */
+    credentialId: string;
+    /**
+     * The VID the credential is now bound to. Echoed for symmetry with finish-time error responses.
+     */
+    subject: string;
+    /**
+     * The label persisted with the credential.
+     */
+    deviceLabel?: string;
+    registeredAt: string;
+    ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollFinish;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollFinishResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/auth/passkey/enroll/finish/0.2/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,4CAA4C,CAAC;IACzD,YAAY,CAAC,EAAE,mCAAmC,CAAC;IACnD;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,4CAA4C;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,4CAA4C,CAAC;IACzD,YAAY,CAAC,EAAE,mCAAmC,CAAC;IACnD;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,4CAA4C;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACrD;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAE9C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC;AAEhH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sCAAsC,CAAC"}

package/dist/auth/passkey/enroll/finish/0.2/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4DAAqE,CAAC;AAE9F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qEAA8E,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiFH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4DAAqE,CAAC;AAK9F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qEAA8E,CAAC"}

package/dist/auth/passkey/enroll/invite/0.1/payload.d.ts

@@ -34,8 +34,33 @@ export interface AuthPasskeyEnrollInvite {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * The issued invite. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1#response.
+ */
+export interface AuthPasskeyEnrollInviteResponsePayload {
+    invite: {
+        /**
+         * Opaque single-use invite token. The invitee presents it to the consumer during enrollment. ≥128 bits entropy.
+         */
+        token: string;
+        /**
+         * Operator-shareable URL that, when opened in a WebAuthn-capable browser, drives the enrollment ceremony. Contains the token as a query parameter.
+         */
+        url: string;
+    };
+    /**
+     * Echo of the invitee's VID.
+     */
+    subject: string;
+    expiresAt: string;
+    ext?: Ext;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollInvite;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollInviteResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/auth/passkey/enroll/invite/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/invite/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/invite/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACrD,MAAM,EAAE;QACN;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd;;WAEG;QACH,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAE9C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC;AAEhH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sCAAsC,CAAC"}

package/dist/auth/passkey/enroll/invite/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/invite/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4DAAqE,CAAC;AAE9F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qEAA8E,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/invite/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4DAAqE,CAAC;AAK9F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qEAA8E,CAAC"}

package/dist/auth/passkey/enroll/start/0.1/payload.d.ts

@@ -18,8 +18,86 @@ export interface AuthPasskeyEnrollStart {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.1#response.
+ */
+export interface AuthPasskeyEnrollStartResponsePayload {
+    /**
+     * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
+     */
+    enrollmentId: string;
+    options: PublicKeyCredentialCreationOptions;
+    ext?: Ext1;
+}
+/**
+ * PublicKeyCredentialCreationOptions for navigator.credentials.create.
+ */
+export interface PublicKeyCredentialCreationOptions {
+    /**
+     * base64url-encoded one-time nonce.
+     */
+    challenge: string;
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        /**
+         * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
+         */
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    /**
+     * @minItems 1
+     */
+    pubKeyCredParams: [
+        {
+            type: "public-key";
+            /**
+             * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+             */
+            alg: number;
+        },
+        ...{
+            type: "public-key";
+            /**
+             * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+             */
+            alg: number;
+        }[]
+    ];
+    timeout?: number;
+    excludeCredentials?: PublicKeyCredentialDescriptor[];
+    authenticatorSelection?: {
+        authenticatorAttachment?: "platform" | "cross-platform";
+        requireResidentKey?: boolean;
+        residentKey?: "discouraged" | "preferred" | "required";
+        userVerification?: "discouraged" | "preferred" | "required";
+    };
+    attestation?: "none" | "indirect" | "direct" | "enterprise";
+}
+export interface PublicKeyCredentialDescriptor {
+    type: "public-key";
+    /**
+     * base64url-encoded credential id.
+     */
+    id: string;
+    transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollStart;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollStartResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/auth/passkey/enroll/start/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,kCAAkC,CAAC;IAC5C,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE;QACF,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,IAAI,EAAE;QACJ;;WAEG;QACH,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;OAEG;IACH,gBAAgB,EAAE;QAChB;YACE,IAAI,EAAE,YAAY,CAAC;YACnB;;eAEG;YACH,GAAG,EAAE,MAAM,CAAC;SACb;QACD,GAAG;YACD,IAAI,EAAE,YAAY,CAAC;YACnB;;eAEG;YACH,GAAG,EAAE,MAAM,CAAC;SACb,EAAE;KACJ,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,6BAA6B,EAAE,CAAC;IACrD,sBAAsB,CAAC,EAAE;QACvB,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;QACxD,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACvD,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC7D;AACD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;CAChE;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE7C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,qCAAqC,CAAC"}

package/dist/auth/passkey/enroll/start/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6FH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAK7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}

package/dist/auth/passkey/enroll/start/0.2/payload.d.ts

@@ -18,8 +18,100 @@ export interface AuthPasskeyEnrollStart {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.
+ */
+export interface AuthPasskeyEnrollStartResponsePayload {
+    /**
+     * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
+     */
+    enrollmentId: string;
+    options: PublicKeyCredentialCreationOptions;
+    uvOptions?: PublicKeyCredentialRequestOptions;
+    ext?: Ext1;
+}
+/**
+ * PublicKeyCredentialCreationOptions for navigator.credentials.create.
+ */
+export interface PublicKeyCredentialCreationOptions {
+    /**
+     * base64url-encoded one-time nonce.
+     */
+    challenge: string;
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        /**
+         * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
+         */
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    /**
+     * @minItems 1
+     */
+    pubKeyCredParams: [
+        {
+            type: "public-key";
+            /**
+             * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+             */
+            alg: number;
+        },
+        ...{
+            type: "public-key";
+            /**
+             * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+             */
+            alg: number;
+        }[]
+    ];
+    timeout?: number;
+    excludeCredentials?: PublicKeyCredentialDescriptor[];
+    authenticatorSelection?: {
+        authenticatorAttachment?: "platform" | "cross-platform";
+        requireResidentKey?: boolean;
+        residentKey?: "discouraged" | "preferred" | "required";
+        userVerification?: "discouraged" | "preferred" | "required";
+    };
+    attestation?: "none" | "indirect" | "direct" | "enterprise";
+}
+export interface PublicKeyCredentialDescriptor {
+    type: "public-key";
+    /**
+     * base64url-encoded credential id.
+     */
+    id: string;
+    transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.
+ */
+export interface PublicKeyCredentialRequestOptions {
+    /**
+     * base64url-encoded one-time nonce.
+     */
+    challenge: string;
+    timeout?: number;
+    rpId?: string;
+    allowCredentials?: PublicKeyCredentialDescriptor[];
+    userVerification?: "discouraged" | "preferred" | "required";
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollStart;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollStartResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/auth/passkey/enroll/start/0.2/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,kCAAkC,CAAC;IAC5C,SAAS,CAAC,EAAE,iCAAiC,CAAC;IAC9C,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE;QACF,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,IAAI,EAAE;QACJ;;WAEG;QACH,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;OAEG;IACH,gBAAgB,EAAE;QAChB;YACE,IAAI,EAAE,YAAY,CAAC;YACnB;;eAEG;YACH,GAAG,EAAE,MAAM,CAAC;SACb;QACD,GAAG;YACD,IAAI,EAAE,YAAY,CAAC;YACnB;;eAEG;YACH,GAAG,EAAE,MAAM,CAAC;SACb,EAAE;KACJ,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,6BAA6B,EAAE,CAAC;IACrD,sBAAsB,CAAC,EAAE;QACvB,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;QACxD,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACvD,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC7D;AACD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,YAAY,CAAC;IACnB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;CAChE;AACD;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,6BAA6B,EAAE,CAAC;IACnD,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;CAC7D;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE7C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,qCAAqC,CAAC"}

package/dist/auth/passkey/enroll/start/0.2/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/enroll/start/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2GH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAK7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}

package/dist/auth/passkey/list/0.1/payload.d.ts

@@ -14,8 +14,53 @@ export interface AuthPasskeyList {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/list/0.1#response.
+ */
+export interface AuthPasskeyListResponsePayload {
+    /**
+     * Every passkey currently bound to the producer's subject. MAY be empty — a subject who authenticates by other means has no passkeys, which is not an error. Consumers SHOULD sort by registeredAt descending.
+     */
+    credentials: RegisteredCredential[];
+    ext?: Ext1;
+}
+/**
+ * A passkey already bound to a subject, as listed by `auth/passkey/list` and targeted by `auth/passkey/revoke/*`. This is the auth service's own management view of a credential — not a WebAuthn dictionary — so its members are camelCase per SPEC.md §4.10. The exception is `transports`, whose values are the externally-owned WebAuthn transport tokens and are carried verbatim.
+ */
+export interface RegisteredCredential {
+    /**
+     * Durable identifier for this credential, as issued by `auth/passkey/enroll/finish`: the base64url-encoded WebAuthn credential id. Opaque to the producer — it MUST be echoed verbatim when revoking and MUST NOT be parsed.
+     */
+    credentialId: string;
+    /**
+     * Operator-facing label captured at enrollment (e.g. "Alice's MacBook Pro"). Absent when the subject enrolled without one. Consumers MUST NOT synthesize a label, because an invented one is indistinguishable from a chosen one to somebody deciding which credential to revoke.
+     */
+    deviceLabel?: string;
+    /**
+     * WebAuthn transport hints reported by the authenticator at enrollment (`usb`, `nfc`, `ble`, `internal`, `hybrid`, …). Externally owned and carried verbatim. Deliberately not an enum — unlike `CredentialDescriptor.transports`, which the consumer itself emits, these values were reported by a third-party authenticator, the WebAuthn transport registry grows independently of this specification, and an unrecognized token here is a display concern rather than a validation failure.
+     */
+    transports?: string[];
+    /**
+     * When the credential was bound to the subject.
+     */
+    registeredAt: string;
+    /**
+     * When this credential last completed an assertion. Absent if it never has, or if the consumer does not track usage. Those two cases are deliberately NOT distinguished: a nullable variant cannot survive the round-trip through generated bindings, which map absent and null onto the same optional, so a distinction stated here would not be one any conforming implementation could rely on. Consumers that need to advertise "usage is not tracked" SHOULD say so under `ext`.
+     */
+    lastUsedAt?: string;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/list/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyList;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/list/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyListResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/auth/passkey/list/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/passkey/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/passkey/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,eAAe,CAAC;AAEtC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC;AAEvG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,8BAA8B,CAAC"}

package/dist/auth/passkey/list/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/auth/passkey/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,mDAA4D,CAAC;AAErF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4DAAqE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/auth/passkey/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,mDAA4D,CAAC;AAKrF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4DAAqE,CAAC"}

package/dist/auth/passkey/login/finish/0.1/payload.d.ts

@@ -35,8 +35,101 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response. For `purpose: login` the payload includes the new session + tokens; for `purpose: step-up` only the elevated session is included (the producer's existing tokens are unchanged — they now carry a higher acr at the next token introspection).
+ */
+export interface AuthPasskeyLoginFinishResponsePayload {
+    session: Session;
+    purpose: "login" | "step-up";
+    tokens?: TokenBundle;
+    ext?: Ext3;
+}
+/**
+ * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
+ */
+export interface Session {
+    /**
+     * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+     */
+    id: string;
+    /**
+     * The authenticated party's VID (typically a DID URL).
+     */
+    subject: string;
+    /**
+     * ISO-8601 timestamp when the session was created.
+     */
+    issuedAt: string;
+    /**
+     * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+     */
+    expiresAt: string;
+    /**
+     * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+     *
+     * @minItems 1
+     */
+    amr?: [string, ...string[]];
+    /**
+     * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+     */
+    acr?: string;
+    ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Present when `purpose: login` (a new session). Absent for `step-up` — the producer's existing tokens remain valid and now carry the elevated acr.
+ */
+export interface TokenBundle {
+    /**
+     * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
+     */
+    accessToken: string;
+    /**
+     * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
+     */
+    refreshToken?: string;
+    /**
+     * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
+     */
+    tokenType: string;
+    /**
+     * Seconds from issuance until the access token expires.
+     */
+    expiresIn: number;
+    /**
+     * Seconds from issuance until the refresh token expires, when one was issued.
+     */
+    refreshExpiresIn?: number;
+    /**
+     * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+     */
+    scope?: string[];
+    ext?: Ext2;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext3 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/login/finish/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyLoginFinish;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyLoginFinishResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/auth/passkey/login/finish/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,mCAAmC,CAAC;IAChD,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,mCAAmC,CAAC;IAChD,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE7C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,qCAAqC,CAAC"}

package/dist/auth/passkey/login/finish/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6HH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAK7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}

package/dist/auth/passkey/login/finish/0.2/payload.d.ts

@@ -35,8 +35,101 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response. For `purpose: login` the payload includes the new session + tokens; for `purpose: step-up` only the elevated session is included (the producer's existing tokens are unchanged — they now carry a higher acr at the next token introspection).
+ */
+export interface AuthPasskeyLoginFinishResponsePayload {
+    session: Session;
+    purpose: "login" | "stepUp";
+    tokens?: TokenBundle;
+    ext?: Ext3;
+}
+/**
+ * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
+ */
+export interface Session {
+    /**
+     * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+     */
+    id: string;
+    /**
+     * The authenticated party's VID (typically a DID URL).
+     */
+    subject: string;
+    /**
+     * ISO-8601 timestamp when the session was created.
+     */
+    issuedAt: string;
+    /**
+     * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+     */
+    expiresAt: string;
+    /**
+     * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+     *
+     * @minItems 1
+     */
+    amr?: [string, ...string[]];
+    /**
+     * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+     */
+    acr?: string;
+    ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Present when `purpose: login` (a new session). Absent for `stepUp` — the producer's existing tokens remain valid and now carry the elevated acr.
+ */
+export interface TokenBundle {
+    /**
+     * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
+     */
+    accessToken: string;
+    /**
+     * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
+     */
+    refreshToken?: string;
+    /**
+     * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
+     */
+    tokenType: string;
+    /**
+     * Seconds from issuance until the access token expires.
+     */
+    expiresIn: number;
+    /**
+     * Seconds from issuance until the refresh token expires, when one was issued.
+     */
+    refreshExpiresIn?: number;
+    /**
+     * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+     */
+    scope?: string[];
+    ext?: Ext2;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext3 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/login/finish/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyLoginFinish;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/login/finish/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyLoginFinishResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/auth/passkey/login/finish/0.2/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,mCAAmC,CAAC;IAChD,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,mCAAmC,CAAC;IAChD,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE7C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,qCAAqC,CAAC"}

package/dist/auth/passkey/login/finish/0.2/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAE7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/auth/passkey/login/finish/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6HH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAK7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC"}