@openvtc/trust-tasks 0.22.6 → 0.22.7

package/dist/task-consent/decision/0.2/payload.d.ts

@@ -0,0 +1,775 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/task-consent/decision/0.2/payload.schema.json
+ */
+import type { AuthenticatorAssertionResponseLogin, Decision, DigestMultibase, Ext } from "../../../_shared/components.js";
+/**
+ * An additional factor backing the decision, tagged on `kind`. It never replaces the document's proof — that proof is still REQUIRED and is by the approver's own DID — and it is verified by the executor on top of it. Absent, the proof alone is the authorization, exactly as in 0.1.
+ */
+export type DecisionEvidence = WebAuthn | ApproverSigned;
+/**
+ * An enrolled approver authorizes (or refuses) one pending privileged task, bound to the exact payload it was shown. The proof on this document — not the transport session that carried it — is the authorization, and it is always made by the approver's own DID. Additive over 0.1: an OPTIONAL `evidence` member carries an additional factor (a WebAuthn assertion, or a signed step-up approver statement) the executor verifies on top of the proof, and an OPTIONAL `actionId` links the decision to a Verifiable Trust Community action (vtc/admin/actions/list/0.1). The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface TaskConsentDecisionPayload {
+    /**
+     * Echoes the challenge of the pending request this decision answers — a task-consent/request's `challenge`, or the `challenge` on a VTC action the approver may decide — binding the decision to that one pending request and that one approver. An executor MUST consume the challenge at execution rather than on receipt of this decision: a decision authorizes exactly one execution, and consuming it earlier lets an executor's own retry legitimately replay it.
+     */
+    challenge: string;
+    /**
+     * Echoes the challenge-salted digest of the task being authorized, in the encoding the pending request carried it. The executor re-derives it from the payload it is about to execute and refuses on mismatch — this is what makes the approved payload the executed payload, cryptographically rather than by convention.
+     */
+    payloadDigest: DigestMultibase;
+    decision: Decision;
+    /**
+     * OPTIONAL human-facing note, most useful on a `deny`.
+     */
+    reason?: string;
+    /**
+     * OPTIONAL identifier of the Verifiable Trust Community action (vtc/admin/actions/_shared/0.1 ActionId) this decision answers. A locator only: the executor finds the pending request by `payloadDigest` and checks `challenge` against it exactly as without this member, and refuses a decision whose `actionId` names a different action than the one those resolve to.
+     */
+    actionId?: string;
+    evidence?: DecisionEvidence;
+    ext?: Ext;
+}
+export interface WebAuthn {
+    kind: "webauthn";
+    /**
+     * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.5 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.
+     */
+    assertion: AuthenticatorAssertionResponseLogin;
+}
+export interface ApproverSigned {
+    kind: "approverSigned";
+    /**
+     * A complete, signed https://trusttasks.org/spec/auth/step-up/approver/attest/0.1 Trust Task document whose `purpose` is `decision`, issued by a step-up approver enrolled to the decision's signer: its `subject` is the DID that made this document's proof, its `audience` the executor, its `challenge` this decision's `challenge`, and its `boundTo` this decision's `payloadDigest`. The executor verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over its members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow.
+     */
+    statement: {};
+}
+/**
+ * Acknowledgement of the recorded decision, and whether the approval threshold is now met.
+ */
+export interface TaskConsentDecisionResponsePayload {
+    /**
+     * `granted` = the threshold is met: the requester's re-submit will now execute, or — for a VTC action — the executor has executed (or is executing) the parked operation itself. `pending` = the approval was recorded but more are needed. `denied` = the request was aborted.
+     */
+    status: "granted" | "pending" | "denied";
+    /**
+     * The digest this decision concerned, in the encoding the pending request carried it.
+     */
+    payloadDigest: DigestMultibase;
+    /**
+     * Echoed when the decision carried one.
+     */
+    actionId?: string;
+    /**
+     * Distinct approvals recorded so far.
+     */
+    approvals?: number;
+    /**
+     * Distinct approvals required. Present when status is `pending`.
+     */
+    needed?: number;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Decision, DigestMultibase, Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/task-consent/decision/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = TaskConsentDecisionPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/task-consent/decision/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = TaskConsentDecisionResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/task-consent/decision/0.2";
+    readonly title: "Task Consent Decision — payload";
+    readonly description: "An enrolled approver authorizes (or refuses) one pending privileged task, bound to the exact payload it was shown. The proof on this document — not the transport session that carried it — is the authorization, and it is always made by the approver's own DID. Additive over 0.1: an OPTIONAL `evidence` member carries an additional factor (a WebAuthn assertion, or a signed step-up approver statement) the executor verifies on top of the proof, and an OPTIONAL `actionId` links the decision to a Verifiable Trust Community action (vtc/admin/actions/list/0.1). The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["challenge", "payloadDigest", "decision"];
+    readonly properties: {
+        readonly challenge: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly description: "Echoes the challenge of the pending request this decision answers — a task-consent/request's `challenge`, or the `challenge` on a VTC action the approver may decide — binding the decision to that one pending request and that one approver. An executor MUST consume the challenge at execution rather than on receipt of this decision: a decision authorizes exactly one execution, and consuming it earlier lets an executor's own retry legitimately replay it.";
+        };
+        readonly payloadDigest: {
+            readonly $ref: "#/$defs/DigestMultibase";
+            readonly description: "Echoes the challenge-salted digest of the task being authorized, in the encoding the pending request carried it. The executor re-derives it from the payload it is about to execute and refuses on mismatch — this is what makes the approved payload the executed payload, cryptographically rather than by convention.";
+        };
+        readonly decision: {
+            readonly $ref: "#/$defs/Decision";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly maxLength: 500;
+            readonly description: "OPTIONAL human-facing note, most useful on a `deny`.";
+        };
+        readonly actionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "OPTIONAL identifier of the Verifiable Trust Community action (vtc/admin/actions/_shared/0.1 ActionId) this decision answers. A locator only: the executor finds the pending request by `payloadDigest` and checks `challenge` against it exactly as without this member, and refuses a decision whose `actionId` names a different action than the one those resolve to.";
+        };
+        readonly evidence: {
+            readonly $ref: "#/$defs/Evidence";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Evidence: {
+            readonly $anchor: "evidence";
+            readonly title: "Decision Evidence";
+            readonly description: "An additional factor backing the decision, tagged on `kind`. It never replaces the document's proof — that proof is still REQUIRED and is by the approver's own DID — and it is verified by the executor on top of it. Absent, the proof alone is the authorization, exactly as in 0.1.";
+            readonly oneOf: readonly [{
+                readonly title: "WebAuthn";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "assertion"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webauthn";
+                    };
+                    readonly assertion: {
+                        readonly $ref: "#/$defs/AssertionResponse";
+                        readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.5 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.";
+                    };
+                };
+            }, {
+                readonly title: "ApproverSigned";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "statement"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "approverSigned";
+                    };
+                    readonly statement: {
+                        readonly type: "object";
+                        readonly description: "A complete, signed https://trusttasks.org/spec/auth/step-up/approver/attest/0.1 Trust Task document whose `purpose` is `decision`, issued by a step-up approver enrolled to the decision's signer: its `subject` is the DID that made this document's proof, its `audience` the executor, its `challenge` this decision's `challenge`, and its `boundTo` this decision's `payloadDigest`. The executor verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over its members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow.";
+                    };
+                };
+            }];
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Task Consent Decision — response payload";
+            readonly description: "Acknowledgement of the recorded decision, and whether the approval threshold is now met.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status", "payloadDigest"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["granted", "pending", "denied"];
+                    readonly description: "`granted` = the threshold is met: the requester's re-submit will now execute, or — for a VTC action — the executor has executed (or is executing) the parked operation itself. `pending` = the approval was recorded but more are needed. `denied` = the request was aborted.";
+                };
+                readonly payloadDigest: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "The digest this decision concerned, in the encoding the pending request carried it.";
+                };
+                readonly actionId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Echoed when the decision carried one.";
+                };
+                readonly approvals: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far.";
+                };
+                readonly needed: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals required. Present when status is `pending`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly DigestMultibase: {
+            readonly title: "DigestMultibase";
+            readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+            readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+        };
+        readonly AssertionResponse: {
+            readonly $anchor: "assertionResponse";
+            readonly title: "AuthenticatorAssertionResponse (login)";
+            readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "rawId", "type", "response"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                };
+                readonly rawId: {
+                    readonly type: "string";
+                };
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly response: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                    readonly properties: {
+                        readonly clientDataJSON: {
+                            readonly type: "string";
+                        };
+                        readonly authenticatorData: {
+                            readonly type: "string";
+                        };
+                        readonly signature: {
+                            readonly type: "string";
+                        };
+                        readonly userHandle: {
+                            readonly type: readonly ["string", "null"];
+                        };
+                    };
+                };
+                readonly authenticatorAttachment: {
+                    readonly enum: readonly ["platform", "cross-platform"];
+                };
+                readonly clientExtensionResults: {
+                    readonly type: "object";
+                };
+            };
+        };
+        readonly Decision: {
+            readonly title: "Decision";
+            readonly type: "string";
+            readonly enum: readonly ["approve", "deny"];
+            readonly description: "The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Evidence: {
+            readonly $anchor: "evidence";
+            readonly title: "Decision Evidence";
+            readonly description: "An additional factor backing the decision, tagged on `kind`. It never replaces the document's proof — that proof is still REQUIRED and is by the approver's own DID — and it is verified by the executor on top of it. Absent, the proof alone is the authorization, exactly as in 0.1.";
+            readonly oneOf: readonly [{
+                readonly title: "WebAuthn";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "assertion"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webauthn";
+                    };
+                    readonly assertion: {
+                        readonly $ref: "#/$defs/AssertionResponse";
+                        readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.5 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.";
+                    };
+                };
+            }, {
+                readonly title: "ApproverSigned";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "statement"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "approverSigned";
+                    };
+                    readonly statement: {
+                        readonly type: "object";
+                        readonly description: "A complete, signed https://trusttasks.org/spec/auth/step-up/approver/attest/0.1 Trust Task document whose `purpose` is `decision`, issued by a step-up approver enrolled to the decision's signer: its `subject` is the DID that made this document's proof, its `audience` the executor, its `challenge` this decision's `challenge`, and its `boundTo` this decision's `payloadDigest`. The executor verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over its members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow.";
+                    };
+                };
+            }];
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Task Consent Decision — response payload";
+            readonly description: "Acknowledgement of the recorded decision, and whether the approval threshold is now met.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status", "payloadDigest"];
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["granted", "pending", "denied"];
+                    readonly description: "`granted` = the threshold is met: the requester's re-submit will now execute, or — for a VTC action — the executor has executed (or is executing) the parked operation itself. `pending` = the approval was recorded but more are needed. `denied` = the request was aborted.";
+                };
+                readonly payloadDigest: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "The digest this decision concerned, in the encoding the pending request carried it.";
+                };
+                readonly actionId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Echoed when the decision carried one.";
+                };
+                readonly approvals: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far.";
+                };
+                readonly needed: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals required. Present when status is `pending`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly DigestMultibase: {
+            readonly title: "DigestMultibase";
+            readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+            readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+        };
+        readonly AssertionResponse: {
+            readonly $anchor: "assertionResponse";
+            readonly title: "AuthenticatorAssertionResponse (login)";
+            readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "rawId", "type", "response"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                };
+                readonly rawId: {
+                    readonly type: "string";
+                };
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly response: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                    readonly properties: {
+                        readonly clientDataJSON: {
+                            readonly type: "string";
+                        };
+                        readonly authenticatorData: {
+                            readonly type: "string";
+                        };
+                        readonly signature: {
+                            readonly type: "string";
+                        };
+                        readonly userHandle: {
+                            readonly type: readonly ["string", "null"];
+                        };
+                    };
+                };
+                readonly authenticatorAttachment: {
+                    readonly enum: readonly ["platform", "cross-platform"];
+                };
+                readonly clientExtensionResults: {
+                    readonly type: "object";
+                };
+            };
+        };
+        readonly Decision: {
+            readonly title: "Decision";
+            readonly type: "string";
+            readonly enum: readonly ["approve", "deny"];
+            readonly description: "The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/task-consent/decision/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/task-consent/decision/0.2";
+        readonly title: "Task Consent Decision — payload";
+        readonly description: "An enrolled approver authorizes (or refuses) one pending privileged task, bound to the exact payload it was shown. The proof on this document — not the transport session that carried it — is the authorization, and it is always made by the approver's own DID. Additive over 0.1: an OPTIONAL `evidence` member carries an additional factor (a WebAuthn assertion, or a signed step-up approver statement) the executor verifies on top of the proof, and an OPTIONAL `actionId` links the decision to a Verifiable Trust Community action (vtc/admin/actions/list/0.1). The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["challenge", "payloadDigest", "decision"];
+        readonly properties: {
+            readonly challenge: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly description: "Echoes the challenge of the pending request this decision answers — a task-consent/request's `challenge`, or the `challenge` on a VTC action the approver may decide — binding the decision to that one pending request and that one approver. An executor MUST consume the challenge at execution rather than on receipt of this decision: a decision authorizes exactly one execution, and consuming it earlier lets an executor's own retry legitimately replay it.";
+            };
+            readonly payloadDigest: {
+                readonly $ref: "#/$defs/DigestMultibase";
+                readonly description: "Echoes the challenge-salted digest of the task being authorized, in the encoding the pending request carried it. The executor re-derives it from the payload it is about to execute and refuses on mismatch — this is what makes the approved payload the executed payload, cryptographically rather than by convention.";
+            };
+            readonly decision: {
+                readonly $ref: "#/$defs/Decision";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly maxLength: 500;
+                readonly description: "OPTIONAL human-facing note, most useful on a `deny`.";
+            };
+            readonly actionId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "OPTIONAL identifier of the Verifiable Trust Community action (vtc/admin/actions/_shared/0.1 ActionId) this decision answers. A locator only: the executor finds the pending request by `payloadDigest` and checks `challenge` against it exactly as without this member, and refuses a decision whose `actionId` names a different action than the one those resolve to.";
+            };
+            readonly evidence: {
+                readonly $ref: "#/$defs/Evidence";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Evidence: {
+                readonly $anchor: "evidence";
+                readonly title: "Decision Evidence";
+                readonly description: "An additional factor backing the decision, tagged on `kind`. It never replaces the document's proof — that proof is still REQUIRED and is by the approver's own DID — and it is verified by the executor on top of it. Absent, the proof alone is the authorization, exactly as in 0.1.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebAuthn";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "assertion"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webauthn";
+                        };
+                        readonly assertion: {
+                            readonly $ref: "#/$defs/AssertionResponse";
+                            readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.5 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.";
+                        };
+                    };
+                }, {
+                    readonly title: "ApproverSigned";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "statement"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "approverSigned";
+                        };
+                        readonly statement: {
+                            readonly type: "object";
+                            readonly description: "A complete, signed https://trusttasks.org/spec/auth/step-up/approver/attest/0.1 Trust Task document whose `purpose` is `decision`, issued by a step-up approver enrolled to the decision's signer: its `subject` is the DID that made this document's proof, its `audience` the executor, its `challenge` this decision's `challenge`, and its `boundTo` this decision's `payloadDigest`. The executor verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over its members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow.";
+                        };
+                    };
+                }];
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Task Consent Decision — response payload";
+                readonly description: "Acknowledgement of the recorded decision, and whether the approval threshold is now met.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status", "payloadDigest"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["granted", "pending", "denied"];
+                        readonly description: "`granted` = the threshold is met: the requester's re-submit will now execute, or — for a VTC action — the executor has executed (or is executing) the parked operation itself. `pending` = the approval was recorded but more are needed. `denied` = the request was aborted.";
+                    };
+                    readonly payloadDigest: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "The digest this decision concerned, in the encoding the pending request carried it.";
+                    };
+                    readonly actionId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Echoed when the decision carried one.";
+                    };
+                    readonly approvals: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far.";
+                    };
+                    readonly needed: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals required. Present when status is `pending`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly DigestMultibase: {
+                readonly title: "DigestMultibase";
+                readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+                readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+            };
+            readonly AssertionResponse: {
+                readonly $anchor: "assertionResponse";
+                readonly title: "AuthenticatorAssertionResponse (login)";
+                readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "rawId", "type", "response"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                    };
+                    readonly rawId: {
+                        readonly type: "string";
+                    };
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly response: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                        readonly properties: {
+                            readonly clientDataJSON: {
+                                readonly type: "string";
+                            };
+                            readonly authenticatorData: {
+                                readonly type: "string";
+                            };
+                            readonly signature: {
+                                readonly type: "string";
+                            };
+                            readonly userHandle: {
+                                readonly type: readonly ["string", "null"];
+                            };
+                        };
+                    };
+                    readonly authenticatorAttachment: {
+                        readonly enum: readonly ["platform", "cross-platform"];
+                    };
+                    readonly clientExtensionResults: {
+                        readonly type: "object";
+                    };
+                };
+            };
+            readonly Decision: {
+                readonly title: "Decision";
+                readonly type: "string";
+                readonly enum: readonly ["approve", "deny"];
+                readonly description: "The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/task-consent/decision/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Evidence: {
+                readonly $anchor: "evidence";
+                readonly title: "Decision Evidence";
+                readonly description: "An additional factor backing the decision, tagged on `kind`. It never replaces the document's proof — that proof is still REQUIRED and is by the approver's own DID — and it is verified by the executor on top of it. Absent, the proof alone is the authorization, exactly as in 0.1.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebAuthn";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "assertion"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webauthn";
+                        };
+                        readonly assertion: {
+                            readonly $ref: "#/$defs/AssertionResponse";
+                            readonly description: "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.5 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.";
+                        };
+                    };
+                }, {
+                    readonly title: "ApproverSigned";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "statement"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "approverSigned";
+                        };
+                        readonly statement: {
+                            readonly type: "object";
+                            readonly description: "A complete, signed https://trusttasks.org/spec/auth/step-up/approver/attest/0.1 Trust Task document whose `purpose` is `decision`, issued by a step-up approver enrolled to the decision's signer: its `subject` is the DID that made this document's proof, its `audience` the executor, its `challenge` this decision's `challenge`, and its `boundTo` this decision's `payloadDigest`. The executor verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over its members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow.";
+                        };
+                    };
+                }];
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Task Consent Decision — response payload";
+                readonly description: "Acknowledgement of the recorded decision, and whether the approval threshold is now met.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status", "payloadDigest"];
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["granted", "pending", "denied"];
+                        readonly description: "`granted` = the threshold is met: the requester's re-submit will now execute, or — for a VTC action — the executor has executed (or is executing) the parked operation itself. `pending` = the approval was recorded but more are needed. `denied` = the request was aborted.";
+                    };
+                    readonly payloadDigest: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "The digest this decision concerned, in the encoding the pending request carried it.";
+                    };
+                    readonly actionId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Echoed when the decision carried one.";
+                    };
+                    readonly approvals: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far.";
+                    };
+                    readonly needed: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals required. Present when status is `pending`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly DigestMultibase: {
+                readonly title: "DigestMultibase";
+                readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+                readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+            };
+            readonly AssertionResponse: {
+                readonly $anchor: "assertionResponse";
+                readonly title: "AuthenticatorAssertionResponse (login)";
+                readonly description: "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "rawId", "type", "response"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                    };
+                    readonly rawId: {
+                        readonly type: "string";
+                    };
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly response: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["clientDataJSON", "authenticatorData", "signature"];
+                        readonly properties: {
+                            readonly clientDataJSON: {
+                                readonly type: "string";
+                            };
+                            readonly authenticatorData: {
+                                readonly type: "string";
+                            };
+                            readonly signature: {
+                                readonly type: "string";
+                            };
+                            readonly userHandle: {
+                                readonly type: readonly ["string", "null"];
+                            };
+                        };
+                    };
+                    readonly authenticatorAttachment: {
+                        readonly enum: readonly ["platform", "cross-platform"];
+                    };
+                    readonly clientExtensionResults: {
+                        readonly type: "object";
+                    };
+                };
+            };
+            readonly Decision: {
+                readonly title: "Decision";
+                readonly type: "string";
+                readonly enum: readonly ["approve", "deny"];
+                readonly description: "The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map