@openvtc/trust-tasks 0.20.8 → 0.21.0

package/dist/auth/passkey/enroll/redeem/start/0.1/payload.d.ts

@@ -0,0 +1,1043 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/passkey/enroll/redeem/start/0.1/payload.schema.json
+ */
+import type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../../_shared/components.js";
+/**
+ * The invitee presents an auth/passkey/enroll/invite token and its claim code, and the auth service begins the WebAuthn registration ceremony the invite authorises.
+ */
+export interface AuthPasskeyEnrollRedeemStart {
+    /**
+     * The invite token, as carried in the invite URL.
+     */
+    token: string;
+    /**
+     * The claim code the administrator delivered separately.
+     */
+    claimCode: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The registration ceremony the invite authorises.
+ */
+export interface AuthPasskeyEnrollRedeemStartResponsePayload {
+    /**
+     * Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim.
+     */
+    enrollmentId: string;
+    /**
+     * The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it.
+     */
+    subject: string;
+    /**
+     * What the credential will authenticate, from the invite.
+     */
+    purpose: "session" | "stepUp";
+    /**
+     * The inviter's suggested label, if any. The invitee MAY override it at finish.
+     */
+    deviceLabel?: string;
+    /**
+     * PublicKeyCredentialCreationOptions for navigator.credentials.create.
+     */
+    options: PublicKeyCredentialCreationOptions;
+    /**
+     * PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish.
+     */
+    uvOptions?: PublicKeyCredentialRequestOptions;
+    /**
+     * When this ceremony lapses (not the invite).
+     */
+    expiresAt: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollRedeemStart;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollRedeemStartResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1";
+    readonly title: "Auth — Passkey Enroll (redeem, start)";
+    readonly description: "The invitee presents an auth/passkey/enroll/invite token and its claim code, and the auth service begins the WebAuthn registration ceremony the invite authorises.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["token", "claimCode"];
+    readonly properties: {
+        readonly token: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly maxLength: 512;
+            readonly description: "The invite token, as carried in the invite URL.";
+        };
+        readonly claimCode: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly description: "The claim code the administrator delivered separately.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Passkey Enroll Redeem Start — response payload";
+            readonly description: "The registration ceremony the invite authorises.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["enrollmentId", "subject", "purpose", "options", "expiresAt"];
+            readonly properties: {
+                readonly enrollmentId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim.";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it.";
+                };
+                readonly purpose: {
+                    readonly type: "string";
+                    readonly enum: readonly ["session", "stepUp"];
+                    readonly description: "What the credential will authenticate, from the invite.";
+                };
+                readonly deviceLabel: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "The inviter's suggested label, if any. The invitee MAY override it at finish.";
+                };
+                readonly options: {
+                    readonly $ref: "#/$defs/CredentialCreationOptions";
+                    readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                };
+                readonly uvOptions: {
+                    readonly $ref: "#/$defs/CredentialRequestOptions";
+                    readonly description: "PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When this ceremony lapses (not the invite).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+        readonly CredentialCreationOptions: {
+            readonly $anchor: "credentialCreationOptions";
+            readonly title: "PublicKeyCredentialCreationOptions";
+            readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly rp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                        };
+                    };
+                };
+                readonly user: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name", "displayName"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                        };
+                        readonly displayName: {
+                            readonly type: "string";
+                            readonly maxLength: 64;
+                        };
+                    };
+                };
+                readonly pubKeyCredParams: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["type", "alg"];
+                        readonly properties: {
+                            readonly type: {
+                                readonly const: "public-key";
+                            };
+                            readonly alg: {
+                                readonly type: "integer";
+                                readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                            };
+                        };
+                    };
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly excludeCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly authenticatorSelection: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly properties: {
+                        readonly authenticatorAttachment: {
+                            readonly enum: readonly ["platform", "cross-platform"];
+                        };
+                        readonly requireResidentKey: {
+                            readonly type: "boolean";
+                        };
+                        readonly residentKey: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                        readonly userVerification: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                    };
+                };
+                readonly attestation: {
+                    readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Passkey Enroll Redeem Start — response payload";
+            readonly description: "The registration ceremony the invite authorises.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["enrollmentId", "subject", "purpose", "options", "expiresAt"];
+            readonly properties: {
+                readonly enrollmentId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim.";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it.";
+                };
+                readonly purpose: {
+                    readonly type: "string";
+                    readonly enum: readonly ["session", "stepUp"];
+                    readonly description: "What the credential will authenticate, from the invite.";
+                };
+                readonly deviceLabel: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "The inviter's suggested label, if any. The invitee MAY override it at finish.";
+                };
+                readonly options: {
+                    readonly $ref: "#/$defs/CredentialCreationOptions";
+                    readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                };
+                readonly uvOptions: {
+                    readonly $ref: "#/$defs/CredentialRequestOptions";
+                    readonly description: "PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When this ceremony lapses (not the invite).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+        readonly CredentialCreationOptions: {
+            readonly $anchor: "credentialCreationOptions";
+            readonly title: "PublicKeyCredentialCreationOptions";
+            readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly rp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                        };
+                    };
+                };
+                readonly user: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name", "displayName"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                        };
+                        readonly displayName: {
+                            readonly type: "string";
+                            readonly maxLength: 64;
+                        };
+                    };
+                };
+                readonly pubKeyCredParams: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["type", "alg"];
+                        readonly properties: {
+                            readonly type: {
+                                readonly const: "public-key";
+                            };
+                            readonly alg: {
+                                readonly type: "integer";
+                                readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                            };
+                        };
+                    };
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly excludeCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly authenticatorSelection: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly properties: {
+                        readonly authenticatorAttachment: {
+                            readonly enum: readonly ["platform", "cross-platform"];
+                        };
+                        readonly requireResidentKey: {
+                            readonly type: "boolean";
+                        };
+                        readonly residentKey: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                        readonly userVerification: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                    };
+                };
+                readonly attestation: {
+                    readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1";
+        readonly title: "Auth — Passkey Enroll (redeem, start)";
+        readonly description: "The invitee presents an auth/passkey/enroll/invite token and its claim code, and the auth service begins the WebAuthn registration ceremony the invite authorises.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["token", "claimCode"];
+        readonly properties: {
+            readonly token: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly maxLength: 512;
+                readonly description: "The invite token, as carried in the invite URL.";
+            };
+            readonly claimCode: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly description: "The claim code the administrator delivered separately.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Passkey Enroll Redeem Start — response payload";
+                readonly description: "The registration ceremony the invite authorises.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["enrollmentId", "subject", "purpose", "options", "expiresAt"];
+                readonly properties: {
+                    readonly enrollmentId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim.";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it.";
+                    };
+                    readonly purpose: {
+                        readonly type: "string";
+                        readonly enum: readonly ["session", "stepUp"];
+                        readonly description: "What the credential will authenticate, from the invite.";
+                    };
+                    readonly deviceLabel: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "The inviter's suggested label, if any. The invitee MAY override it at finish.";
+                    };
+                    readonly options: {
+                        readonly $ref: "#/$defs/CredentialCreationOptions";
+                        readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                    };
+                    readonly uvOptions: {
+                        readonly $ref: "#/$defs/CredentialRequestOptions";
+                        readonly description: "PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When this ceremony lapses (not the invite).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+            readonly CredentialCreationOptions: {
+                readonly $anchor: "credentialCreationOptions";
+                readonly title: "PublicKeyCredentialCreationOptions";
+                readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly rp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 64;
+                            };
+                        };
+                    };
+                    readonly user: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name", "displayName"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 64;
+                            };
+                            readonly displayName: {
+                                readonly type: "string";
+                                readonly maxLength: 64;
+                            };
+                        };
+                    };
+                    readonly pubKeyCredParams: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["type", "alg"];
+                            readonly properties: {
+                                readonly type: {
+                                    readonly const: "public-key";
+                                };
+                                readonly alg: {
+                                    readonly type: "integer";
+                                    readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                                };
+                            };
+                        };
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly excludeCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly authenticatorSelection: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly authenticatorAttachment: {
+                                readonly enum: readonly ["platform", "cross-platform"];
+                            };
+                            readonly requireResidentKey: {
+                                readonly type: "boolean";
+                            };
+                            readonly residentKey: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                            readonly userVerification: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                        };
+                    };
+                    readonly attestation: {
+                        readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/passkey/enroll/redeem/start/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Passkey Enroll Redeem Start — response payload";
+                readonly description: "The registration ceremony the invite authorises.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["enrollmentId", "subject", "purpose", "options", "expiresAt"];
+                readonly properties: {
+                    readonly enrollmentId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque handle correlating this start with the matching auth/passkey/enroll/redeem/finish. Echoed verbatim.";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The VID the invite binds the credential to, so the invitee can see whose passkey they are enrolling before they create it.";
+                    };
+                    readonly purpose: {
+                        readonly type: "string";
+                        readonly enum: readonly ["session", "stepUp"];
+                        readonly description: "What the credential will authenticate, from the invite.";
+                    };
+                    readonly deviceLabel: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "The inviter's suggested label, if any. The invitee MAY override it at finish.";
+                    };
+                    readonly options: {
+                        readonly $ref: "#/$defs/CredentialCreationOptions";
+                        readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                    };
+                    readonly uvOptions: {
+                        readonly $ref: "#/$defs/CredentialRequestOptions";
+                        readonly description: "PublicKeyCredentialRequestOptions over the subject's existing credentials of the same purpose, present exactly when the subject already has one. The invitee MUST run both ceremonies and return both results to finish.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When this ceremony lapses (not the invite).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+            readonly CredentialCreationOptions: {
+                readonly $anchor: "credentialCreationOptions";
+                readonly title: "PublicKeyCredentialCreationOptions";
+                readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly rp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 64;
+                            };
+                        };
+                    };
+                    readonly user: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name", "displayName"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 64;
+                            };
+                            readonly displayName: {
+                                readonly type: "string";
+                                readonly maxLength: 64;
+                            };
+                        };
+                    };
+                    readonly pubKeyCredParams: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["type", "alg"];
+                            readonly properties: {
+                                readonly type: {
+                                    readonly const: "public-key";
+                                };
+                                readonly alg: {
+                                    readonly type: "integer";
+                                    readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                                };
+                            };
+                        };
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly excludeCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly authenticatorSelection: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly authenticatorAttachment: {
+                                readonly enum: readonly ["platform", "cross-platform"];
+                            };
+                            readonly requireResidentKey: {
+                                readonly type: "boolean";
+                            };
+                            readonly residentKey: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                            readonly userVerification: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                        };
+                    };
+                    readonly attestation: {
+                        readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map