@openvtc/trust-tasks 0.20.8 → 0.21.1

package/src/auth/step-up/approve-response/0.5/payload.ts

@@ -0,0 +1,593 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approve-response/0.5/payload.schema.json
+ */
+
+import type { AuthenticatorAssertionResponseLogin, Ext, Session } from "../../../../_shared/components.js";
+
+
+/**
+ * How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted.
+ */
+export type StepUpEvidence = DidSigned | WebAuthn;
+
+/**
+ * The approver's signed ratification of a step-up: subject + challenge (+ sessionId, when the request carried one) are echoed inside a gated document so the relying party can elevate the session, or apply the approval to the one operation it was bound to.
+ */
+export interface AuthStepUpApproveResponse {
+  /**
+   * Echoed from the matching approve-request. The relying party verifies it equals the subject bound to the pending step-up — the session's subject, or for a bound step-up the subject named when it was minted.
+   */
+  subject: string;
+  /**
+   * Echoed from the matching approve-request when that request carried one, and absent when it did not — a step-up bound to an operation that arrived without a session. The relying party uses it to locate the session to elevate.
+   */
+  sessionId?: string;
+  /**
+   * Echoed from the matching approve-request. The relying party verifies it equals the bound challenge.
+   */
+  challenge: string;
+  /**
+   * `approved` elevates the session per the relying party's policy. `denied` is a signed refusal — useful for audit even though it elevates nothing.
+   */
+  decision: "approved" | "denied";
+  /**
+   * Required when decision is `denied`. Human-readable rationale the user provided (or which the approver inferred).
+   */
+  deniedReason?: string;
+  /**
+   * The acr the approver believes it has cryptographically demonstrated. The relying party MAY accept this, MAY upgrade to a lower value, but MUST NOT exceed it.
+   */
+  grantedAcr?: string;
+  evidence?: StepUpEvidence;
+  ext?: Ext;
+}
+/**
+ * The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects "vta"/"did".
+ */
+export interface DidSigned {
+  kind: "didSigned";
+}
+export interface WebAuthn {
+  kind: "webauthn";
+  /**
+   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
+   */
+  assertion: AuthenticatorAssertionResponseLogin;
+}
+/**
+ * Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.5#response.
+ */
+export interface AuthStepUpApproveResponseRelyingPartyAck {
+  /**
+   * `elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied.
+   */
+  status: "elevated" | "recorded" | "rejected";
+  /**
+   * Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen.
+   */
+  session?: Session;
+  /**
+   * Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value.
+   */
+  boundTo?: string;
+  /**
+   * Present when status is `rejected` (e.g. "challenge expired", "session not found", "acr ceiling exceeded").
+   */
+  reason?: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext, Session };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.5" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproveResponse;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.5#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveResponseRelyingPartyAck;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/step-up/approve-response/0.5",
+  "title": "Auth — Step-up Approve Response",
+  "description": "The approver's signed ratification of a step-up: subject + challenge (+ sessionId, when the request carried one) are echoed inside a gated document so the relying party can elevate the session, or apply the approval to the one operation it was bound to.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "subject",
+    "challenge",
+    "decision"
+  ],
+  "properties": {
+    "subject": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Echoed from the matching approve-request. The relying party verifies it equals the subject bound to the pending step-up — the session's subject, or for a bound step-up the subject named when it was minted."
+    },
+    "sessionId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Echoed from the matching approve-request when that request carried one, and absent when it did not — a step-up bound to an operation that arrived without a session. The relying party uses it to locate the session to elevate."
+    },
+    "challenge": {
+      "type": "string",
+      "minLength": 16,
+      "description": "Echoed from the matching approve-request. The relying party verifies it equals the bound challenge."
+    },
+    "decision": {
+      "type": "string",
+      "enum": [
+        "approved",
+        "denied"
+      ],
+      "description": "`approved` elevates the session per the relying party's policy. `denied` is a signed refusal — useful for audit even though it elevates nothing."
+    },
+    "deniedReason": {
+      "type": "string",
+      "maxLength": 500,
+      "description": "Required when decision is `denied`. Human-readable rationale the user provided (or which the approver inferred)."
+    },
+    "grantedAcr": {
+      "type": "string",
+      "description": "The acr the approver believes it has cryptographically demonstrated. The relying party MAY accept this, MAY upgrade to a lower value, but MUST NOT exceed it."
+    },
+    "evidence": {
+      "$ref": "#/$defs/Evidence",
+      "description": "How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Evidence": {
+      "$anchor": "evidence",
+      "title": "Step-up Evidence",
+      "description": "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).",
+      "oneOf": [
+        {
+          "title": "DidSigned",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind"
+          ],
+          "properties": {
+            "kind": {
+              "const": "didSigned"
+            }
+          },
+          "description": "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\"."
+        },
+        {
+          "title": "WebAuthn",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "assertion"
+          ],
+          "properties": {
+            "kind": {
+              "const": "webauthn"
+            },
+            "assertion": {
+              "$ref": "#/$defs/AssertionResponse",
+              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\"."
+            }
+          }
+        }
+      ]
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth Step-up Approve Response — relying party ack",
+      "description": "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.5#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "elevated",
+            "recorded",
+            "rejected"
+          ],
+          "description": "`elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied."
+        },
+        "session": {
+          "$ref": "#/$defs/Session",
+          "description": "Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen."
+        },
+        "boundTo": {
+          "type": "string",
+          "maxLength": 256,
+          "description": "Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value."
+        },
+        "reason": {
+          "type": "string",
+          "maxLength": 1024,
+          "description": "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\")."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Session": {
+      "$anchor": "session",
+      "title": "Session",
+      "description": "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "subject",
+        "issuedAt",
+        "expiresAt"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied."
+        },
+        "subject": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The authenticated party's VID (typically a DID URL)."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO-8601 timestamp when the session was created."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after."
+        },
+        "amr": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used."
+        },
+        "acr": {
+          "type": "string",
+          "description": "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor)."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "AssertionResponse": {
+      "$anchor": "assertionResponse",
+      "title": "AuthenticatorAssertionResponse (login)",
+      "description": "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "rawId",
+        "type",
+        "response"
+      ],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "rawId": {
+          "type": "string"
+        },
+        "type": {
+          "const": "public-key"
+        },
+        "response": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "clientDataJSON",
+            "authenticatorData",
+            "signature"
+          ],
+          "properties": {
+            "clientDataJSON": {
+              "type": "string"
+            },
+            "authenticatorData": {
+              "type": "string"
+            },
+            "signature": {
+              "type": "string"
+            },
+            "userHandle": {
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        },
+        "authenticatorAttachment": {
+          "enum": [
+            "platform",
+            "cross-platform"
+          ]
+        },
+        "clientExtensionResults": {
+          "type": "object"
+        }
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Evidence": {
+      "$anchor": "evidence",
+      "title": "Step-up Evidence",
+      "description": "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).",
+      "oneOf": [
+        {
+          "title": "DidSigned",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind"
+          ],
+          "properties": {
+            "kind": {
+              "const": "didSigned"
+            }
+          },
+          "description": "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\"."
+        },
+        {
+          "title": "WebAuthn",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "assertion"
+          ],
+          "properties": {
+            "kind": {
+              "const": "webauthn"
+            },
+            "assertion": {
+              "$ref": "#/$defs/AssertionResponse",
+              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\"."
+            }
+          }
+        }
+      ]
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth Step-up Approve Response — relying party ack",
+      "description": "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.5#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "elevated",
+            "recorded",
+            "rejected"
+          ],
+          "description": "`elevated` — the approval was applied and the session's assurance level was raised. `recorded` — the approval was applied to the single operation it was bound to, and NO session was elevated; see `boundTo`. `rejected` — the approval was not applied."
+        },
+        "session": {
+          "$ref": "#/$defs/Session",
+          "description": "Present when status is `elevated`. The session's updated amr/acr after the approval was applied. Absent for `recorded`, which changes no session — a consumer reading it as a fallback would report an elevation that did not happen."
+        },
+        "boundTo": {
+          "type": "string",
+          "maxLength": 256,
+          "description": "Present when status is `recorded`. An opaque relying-party identifier for the single operation this approval authorised — for a `release: stepUp` disclosure, the `previewId`. Opaque on purpose: it is echoed for the approver's audit trail and is not a capability, since the approval it names is the relying party's own state and cannot be spent by presenting this value."
+        },
+        "reason": {
+          "type": "string",
+          "maxLength": 1024,
+          "description": "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\")."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Session": {
+      "$anchor": "session",
+      "title": "Session",
+      "description": "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "subject",
+        "issuedAt",
+        "expiresAt"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied."
+        },
+        "subject": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The authenticated party's VID (typically a DID URL)."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO-8601 timestamp when the session was created."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after."
+        },
+        "amr": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used."
+        },
+        "acr": {
+          "type": "string",
+          "description": "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor)."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "AssertionResponse": {
+      "$anchor": "assertionResponse",
+      "title": "AuthenticatorAssertionResponse (login)",
+      "description": "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "rawId",
+        "type",
+        "response"
+      ],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "rawId": {
+          "type": "string"
+        },
+        "type": {
+          "const": "public-key"
+        },
+        "response": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "clientDataJSON",
+            "authenticatorData",
+            "signature"
+          ],
+          "properties": {
+            "clientDataJSON": {
+              "type": "string"
+            },
+            "authenticatorData": {
+              "type": "string"
+            },
+            "signature": {
+              "type": "string"
+            },
+            "userHandle": {
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        },
+        "authenticatorAttachment": {
+          "enum": [
+            "platform",
+            "cross-platform"
+          ]
+        },
+        "clientExtensionResults": {
+          "type": "object"
+        }
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/device/list/0.1/payload.ts

@@ -247,7 +247,8 @@ export const PAYLOAD_SCHEMA = {
         "memory-read",
         "memory-write",
         "room-present",
-        "room-open"
+        "room-open",
+        "key-export"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -585,7 +586,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memory-read",
         "memory-write",
         "room-present",
-        "room-open"
+        "room-open",
+        "key-export"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/list/0.2/payload.ts

@@ -247,7 +247,8 @@ export const PAYLOAD_SCHEMA = {
         "memoryRead",
         "memoryWrite",
         "roomPresent",
-        "roomOpen"
+        "roomOpen",
+        "keyExport"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -585,7 +586,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memoryRead",
         "memoryWrite",
         "roomPresent",
-        "roomOpen"
+        "roomOpen",
+        "keyExport"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/register/0.1/payload.ts

@@ -215,7 +215,8 @@ export const PAYLOAD_SCHEMA = {
         "memory-read",
         "memory-write",
         "room-present",
-        "room-open"
+        "room-open",
+        "key-export"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -543,7 +544,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memory-read",
         "memory-write",
         "room-present",
-        "room-open"
+        "room-open",
+        "key-export"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/register/0.2/payload.ts

@@ -215,7 +215,8 @@ export const PAYLOAD_SCHEMA = {
         "memoryRead",
         "memoryWrite",
         "roomPresent",
-        "roomOpen"
+        "roomOpen",
+        "keyExport"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -543,7 +544,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memoryRead",
         "memoryWrite",
         "roomPresent",
-        "roomOpen"
+        "roomOpen",
+        "keyExport"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },