@openvtc/trust-tasks 0.20.6 → 0.20.8

package/dist/auth/step-up/approve-request/0.3/payload.d.ts

@@ -0,0 +1,613 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approve-request/0.3/payload.schema.json
+ */
+import type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../_shared/components.js";
+/**
+ * A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session, or — bound to one operation — to approve that one act without elevating any session.
+ */
+export interface AuthStepUpApproveRequest {
+    /**
+     * The VID whose session is being elevated, or — for a step-up bound to one operation — the VID whose act that operation is. The approver MUST verify this is a VID it can speak for.
+     */
+    subject: string;
+    /**
+     * The session the relying party wants elevated. Opaque to the approver. Absent only when the step-up is bound to one operation that arrived without a session (a signed Trust Task document, for instance); see `boundTo`.
+     */
+    sessionId?: string;
+    /**
+     * Present when the step-up authorizes exactly one operation rather than raising a session's assurance level. An opaque relying-party identifier for that operation — for an operation that arrived as a signed document, a digest of its type and payload salted with `challenge`. Echoed by a `recorded` approve-response acknowledgement. Not a capability: the binding is the relying party's own state.
+     */
+    boundTo?: string;
+    /**
+     * base64url-encoded nonce the approver will include in the approve-response signature. ≥128 bits entropy.
+     */
+    challenge: string;
+    /**
+     * Human-readable explanation of WHY the relying party is asking (e.g. "confirm transfer of 1000 USD to bob.example"). Surfaced to the user by the approver for consent. SHOULD be specific enough that a user can refuse intelligently.
+     */
+    reason: string;
+    /**
+     * The acr the relying party expects on the elevated session. Approvers MAY refuse if they cannot deliver this level.
+     */
+    targetAcr?: string;
+    /**
+     * Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `methodUnsupported`.
+     *
+     * @minItems 1
+     */
+    acceptableEvidence?: ["didSigned" | "webauthn", ...("didSigned" | "webauthn")[]];
+    /**
+     * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
+     */
+    webauthn?: PublicKeyCredentialRequestOptions;
+    /**
+     * Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.
+     */
+    ttl?: number;
+    ext?: Ext;
+}
+/**
+ * Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response.
+ */
+export interface AuthStepUpApproveRequestResponsePayload {
+    /**
+     * `accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.
+     */
+    status: "accepted" | "refused";
+    /**
+     * Required when status is `refused`.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approve-request/0.3";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproveRequest;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveRequestResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/step-up/approve-request/0.3";
+    readonly title: "Auth — Step-up Approve Request";
+    readonly description: "A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session, or — bound to one operation — to approve that one act without elevating any session.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["subject", "challenge", "reason"];
+    readonly properties: {
+        readonly subject: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The VID whose session is being elevated, or — for a step-up bound to one operation — the VID whose act that operation is. The approver MUST verify this is a VID it can speak for.";
+        };
+        readonly sessionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The session the relying party wants elevated. Opaque to the approver. Absent only when the step-up is bound to one operation that arrived without a session (a signed Trust Task document, for instance); see `boundTo`.";
+        };
+        readonly boundTo: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "Present when the step-up authorizes exactly one operation rather than raising a session's assurance level. An opaque relying-party identifier for that operation — for an operation that arrived as a signed document, a digest of its type and payload salted with `challenge`. Echoed by a `recorded` approve-response acknowledgement. Not a capability: the binding is the relying party's own state.";
+        };
+        readonly challenge: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly description: "base64url-encoded nonce the approver will include in the approve-response signature. ≥128 bits entropy.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 500;
+            readonly description: "Human-readable explanation of WHY the relying party is asking (e.g. \"confirm transfer of 1000 USD to bob.example\"). Surfaced to the user by the approver for consent. SHOULD be specific enough that a user can refuse intelligently.";
+        };
+        readonly targetAcr: {
+            readonly type: "string";
+            readonly description: "The acr the relying party expects on the elevated session. Approvers MAY refuse if they cannot deliver this level.";
+        };
+        readonly acceptableEvidence: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: "string";
+                readonly enum: readonly ["didSigned", "webauthn"];
+            };
+            readonly description: "Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `methodUnsupported`.";
+        };
+        readonly webauthn: {
+            readonly $ref: "#/$defs/CredentialRequestOptions";
+            readonly description: "Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.";
+        };
+        readonly ttl: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly description: "Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Step-up Approve Request — response payload";
+            readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["accepted", "refused"];
+                    readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Required when status is `refused`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Step-up Approve Request — response payload";
+            readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["accepted", "refused"];
+                    readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Required when status is `refused`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approve-request/0.3";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/step-up/approve-request/0.3";
+        readonly title: "Auth — Step-up Approve Request";
+        readonly description: "A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session, or — bound to one operation — to approve that one act without elevating any session.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["subject", "challenge", "reason"];
+        readonly properties: {
+            readonly subject: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The VID whose session is being elevated, or — for a step-up bound to one operation — the VID whose act that operation is. The approver MUST verify this is a VID it can speak for.";
+            };
+            readonly sessionId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The session the relying party wants elevated. Opaque to the approver. Absent only when the step-up is bound to one operation that arrived without a session (a signed Trust Task document, for instance); see `boundTo`.";
+            };
+            readonly boundTo: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "Present when the step-up authorizes exactly one operation rather than raising a session's assurance level. An opaque relying-party identifier for that operation — for an operation that arrived as a signed document, a digest of its type and payload salted with `challenge`. Echoed by a `recorded` approve-response acknowledgement. Not a capability: the binding is the relying party's own state.";
+            };
+            readonly challenge: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly description: "base64url-encoded nonce the approver will include in the approve-response signature. ≥128 bits entropy.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 500;
+                readonly description: "Human-readable explanation of WHY the relying party is asking (e.g. \"confirm transfer of 1000 USD to bob.example\"). Surfaced to the user by the approver for consent. SHOULD be specific enough that a user can refuse intelligently.";
+            };
+            readonly targetAcr: {
+                readonly type: "string";
+                readonly description: "The acr the relying party expects on the elevated session. Approvers MAY refuse if they cannot deliver this level.";
+            };
+            readonly acceptableEvidence: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly type: "string";
+                    readonly enum: readonly ["didSigned", "webauthn"];
+                };
+                readonly description: "Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `methodUnsupported`.";
+            };
+            readonly webauthn: {
+                readonly $ref: "#/$defs/CredentialRequestOptions";
+                readonly description: "Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.";
+            };
+            readonly ttl: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly description: "Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Step-up Approve Request — response payload";
+                readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["accepted", "refused"];
+                        readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Required when status is `refused`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Step-up Approve Request — response payload";
+                readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["accepted", "refused"];
+                        readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Required when status is `refused`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/auth/step-up/approve-request/0.3/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/step-up/approve-request/0.3/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAG/H;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,WAAW,GAAG,UAAU,EAAE,GAAG,CAAC,WAAW,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IACjF;;OAEG;IACH,QAAQ,CAAC,EAAE,iCAAiC,CAAC;IAC7C;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD;;OAEG;IACH,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,CAAC;AAEtF,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,8DAAuE,CAAC;AAEhG,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAE/C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,uEAAgF,CAAC;AAElH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsLjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmH1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}