@openvtc/trust-tasks 0.22.5 → 0.22.7

package/dist/auth/step-up/approve-request/0.4/payload.d.ts

@@ -0,0 +1,672 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approve-request/0.4/payload.schema.json
+ */
+import type { ApproverDid, Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../_shared/components.js";
+/**
+ * A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session, or — bound to one operation — to approve that one act without elevating any session, and states which kinds of evidence it will accept, including a statement by one of the subject's bound step-up approvers.
+ */
+export interface AuthStepUpApproveRequest {
+    /**
+     * The VID whose session is being elevated, or — for a step-up bound to one operation — the VID whose act that operation is. The approver MUST verify this is a VID it can speak for.
+     */
+    subject: string;
+    /**
+     * The session the relying party wants elevated. Opaque to the approver. Absent only when the step-up is bound to one operation that arrived without a session (a signed Trust Task document, for instance); see `boundTo`.
+     */
+    sessionId?: string;
+    /**
+     * Present when the step-up authorizes exactly one operation rather than raising a session's assurance level. An opaque relying-party identifier for that operation — for an operation that arrived as a signed document, a digest of its type and payload salted with `challenge`. Copied into a step-up approver's statement, and echoed by a `recorded` approve-response acknowledgement. Not a capability: the binding is the relying party's own state.
+     */
+    boundTo?: string;
+    /**
+     * base64url-encoded nonce the approver will include in the approve-response signature, the WebAuthn assertion, or the step-up approver's statement. ≥128 bits entropy.
+     */
+    challenge: string;
+    /**
+     * Human-readable explanation of WHY the relying party is asking (e.g. "confirm transfer of 1000 USD to bob.example"). Surfaced to the user by the approver for consent. SHOULD be specific enough that a user can refuse intelligently.
+     */
+    reason: string;
+    /**
+     * The acr the relying party expects on the elevated session. Approvers MAY refuse if they cannot deliver this level.
+     */
+    targetAcr?: string;
+    /**
+     * Every approve-response evidence kind the relying party will accept for this step-up, and no other (see auth/step-up/approve-response/0.6 `evidence`). Replaces 0.3's optional `acceptableEvidence`. An approver that can satisfy none of them SHOULD refuse with `methodUnsupported`.
+     *
+     * @minItems 1
+     */
+    accepts: ["webauthn" | "approverSigned" | "didSigned", ...("webauthn" | "approverSigned" | "didSigned")[]];
+    /**
+     * WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. Present exactly when `accepts` lists `webauthn`. Its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side.
+     */
+    webauthn?: PublicKeyCredentialRequestOptions;
+    /**
+     * The step-up approvers bound to `subject` that the relying party will accept a statement from (auth/step-up/approver/attest/0.1, purpose `stepUp`). Present exactly when `accepts` lists `approverSigned`. Names factors, not authorities: an approver confers nothing, and the relying party re-checks the binding when the statement arrives.
+     *
+     * @minItems 1
+     * @maxItems 5
+     */
+    approvers?: [ApproverDid] | [ApproverDid, ApproverDid] | [ApproverDid, ApproverDid, ApproverDid] | [ApproverDid, ApproverDid, ApproverDid, ApproverDid] | [ApproverDid, ApproverDid, ApproverDid, ApproverDid, ApproverDid];
+    /**
+     * Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.
+     */
+    ttl?: number;
+    ext?: Ext;
+}
+/**
+ * Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.4#response.
+ */
+export interface AuthStepUpApproveRequestResponsePayload {
+    /**
+     * `accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.
+     */
+    status: "accepted" | "refused";
+    /**
+     * Required when status is `refused`.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ApproverDid, Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approve-request/0.4";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproveRequest;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/step-up/approve-request/0.4#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveRequestResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/step-up/approve-request/0.4";
+    readonly title: "Auth — Step-up Approve Request";
+    readonly description: "A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session, or — bound to one operation — to approve that one act without elevating any session, and states which kinds of evidence it will accept, including a statement by one of the subject's bound step-up approvers.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["subject", "challenge", "reason", "accepts"];
+    readonly properties: {
+        readonly subject: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The VID whose session is being elevated, or — for a step-up bound to one operation — the VID whose act that operation is. The approver MUST verify this is a VID it can speak for.";
+        };
+        readonly sessionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The session the relying party wants elevated. Opaque to the approver. Absent only when the step-up is bound to one operation that arrived without a session (a signed Trust Task document, for instance); see `boundTo`.";
+        };
+        readonly boundTo: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "Present when the step-up authorizes exactly one operation rather than raising a session's assurance level. An opaque relying-party identifier for that operation — for an operation that arrived as a signed document, a digest of its type and payload salted with `challenge`. Copied into a step-up approver's statement, and echoed by a `recorded` approve-response acknowledgement. Not a capability: the binding is the relying party's own state.";
+        };
+        readonly challenge: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly description: "base64url-encoded nonce the approver will include in the approve-response signature, the WebAuthn assertion, or the step-up approver's statement. ≥128 bits entropy.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 500;
+            readonly description: "Human-readable explanation of WHY the relying party is asking (e.g. \"confirm transfer of 1000 USD to bob.example\"). Surfaced to the user by the approver for consent. SHOULD be specific enough that a user can refuse intelligently.";
+        };
+        readonly targetAcr: {
+            readonly type: "string";
+            readonly description: "The acr the relying party expects on the elevated session. Approvers MAY refuse if they cannot deliver this level.";
+        };
+        readonly accepts: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: "string";
+                readonly enum: readonly ["webauthn", "approverSigned", "didSigned"];
+            };
+            readonly description: "Every approve-response evidence kind the relying party will accept for this step-up, and no other (see auth/step-up/approve-response/0.6 `evidence`). Replaces 0.3's optional `acceptableEvidence`. An approver that can satisfy none of them SHOULD refuse with `methodUnsupported`.";
+        };
+        readonly webauthn: {
+            readonly $ref: "#/$defs/CredentialRequestOptions";
+            readonly description: "WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. Present exactly when `accepts` lists `webauthn`. Its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side.";
+        };
+        readonly approvers: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly maxItems: 5;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly $ref: "#/$defs/ApproverDid";
+            };
+            readonly description: "The step-up approvers bound to `subject` that the relying party will accept a statement from (auth/step-up/approver/attest/0.1, purpose `stepUp`). Present exactly when `accepts` lists `approverSigned`. Names factors, not authorities: an approver confers nothing, and the relying party re-checks the binding when the statement arrives.";
+        };
+        readonly ttl: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly description: "Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Step-up Approve Request — response payload";
+            readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.4#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["accepted", "refused"];
+                    readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Required when status is `refused`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly ApproverDid: {
+            readonly title: "ApproverDid";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly maxLength: 128;
+            readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+            readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Step-up Approve Request — response payload";
+            readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.4#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["accepted", "refused"];
+                    readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Required when status is `refused`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly ApproverDid: {
+            readonly title: "ApproverDid";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly maxLength: 128;
+            readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+            readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly extensions: {
+                    readonly type: "object";
+                    readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approve-request/0.4";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/step-up/approve-request/0.4";
+        readonly title: "Auth — Step-up Approve Request";
+        readonly description: "A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session, or — bound to one operation — to approve that one act without elevating any session, and states which kinds of evidence it will accept, including a statement by one of the subject's bound step-up approvers.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["subject", "challenge", "reason", "accepts"];
+        readonly properties: {
+            readonly subject: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The VID whose session is being elevated, or — for a step-up bound to one operation — the VID whose act that operation is. The approver MUST verify this is a VID it can speak for.";
+            };
+            readonly sessionId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The session the relying party wants elevated. Opaque to the approver. Absent only when the step-up is bound to one operation that arrived without a session (a signed Trust Task document, for instance); see `boundTo`.";
+            };
+            readonly boundTo: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "Present when the step-up authorizes exactly one operation rather than raising a session's assurance level. An opaque relying-party identifier for that operation — for an operation that arrived as a signed document, a digest of its type and payload salted with `challenge`. Copied into a step-up approver's statement, and echoed by a `recorded` approve-response acknowledgement. Not a capability: the binding is the relying party's own state.";
+            };
+            readonly challenge: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly description: "base64url-encoded nonce the approver will include in the approve-response signature, the WebAuthn assertion, or the step-up approver's statement. ≥128 bits entropy.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 500;
+                readonly description: "Human-readable explanation of WHY the relying party is asking (e.g. \"confirm transfer of 1000 USD to bob.example\"). Surfaced to the user by the approver for consent. SHOULD be specific enough that a user can refuse intelligently.";
+            };
+            readonly targetAcr: {
+                readonly type: "string";
+                readonly description: "The acr the relying party expects on the elevated session. Approvers MAY refuse if they cannot deliver this level.";
+            };
+            readonly accepts: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly type: "string";
+                    readonly enum: readonly ["webauthn", "approverSigned", "didSigned"];
+                };
+                readonly description: "Every approve-response evidence kind the relying party will accept for this step-up, and no other (see auth/step-up/approve-response/0.6 `evidence`). Replaces 0.3's optional `acceptableEvidence`. An approver that can satisfy none of them SHOULD refuse with `methodUnsupported`.";
+            };
+            readonly webauthn: {
+                readonly $ref: "#/$defs/CredentialRequestOptions";
+                readonly description: "WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. Present exactly when `accepts` lists `webauthn`. Its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side.";
+            };
+            readonly approvers: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly maxItems: 5;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly $ref: "#/$defs/ApproverDid";
+                };
+                readonly description: "The step-up approvers bound to `subject` that the relying party will accept a statement from (auth/step-up/approver/attest/0.1, purpose `stepUp`). Present exactly when `accepts` lists `approverSigned`. Names factors, not authorities: an approver confers nothing, and the relying party re-checks the binding when the statement arrives.";
+            };
+            readonly ttl: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly description: "Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Step-up Approve Request — response payload";
+                readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.4#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["accepted", "refused"];
+                        readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Required when status is `refused`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly ApproverDid: {
+                readonly title: "ApproverDid";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly maxLength: 128;
+                readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+                readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/step-up/approve-request/0.4#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Step-up Approve Request — response payload";
+                readonly description: "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.4#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["accepted", "refused"];
+                        readonly description: "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Required when status is `refused`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly ApproverDid: {
+                readonly title: "ApproverDid";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly maxLength: 128;
+                readonly pattern: "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$";
+                readonly description: "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.";
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly extensions: {
+                        readonly type: "object";
+                        readonly description: "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.";
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map