@openvtc/trust-tasks 0.23.7 → 0.23.9

package/src/auth/oob/_shared/0.1/oob.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/_shared/0.1/oob.schema.json
+ */
+
+/**
+ * Shared types for the auth/oob/* family: a starter asks a service to open a request, and an approver decides it on another device. Defined once so request, claim, prove, identify, respond, grant, redeem and cancel describe the same handle, keys, closed lists and disclosure records. The family rules are in CONVENTIONS.md beside this file. Not itself a Trust Task specification (the `_shared` folder is skipped by the registry build and the codegen).
+ */
+export interface AuthSharedOutOfBandRequestDefinitions {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../../_shared/components.js".
+ */
+export type { MatchNumber, Mode, OobKey, Origin, Purpose, Requester, RequestId, SameNetwork, Service } from "../../../../_shared/components.js";

package/src/auth/oob/cancel/0.1/payload.ts

@@ -0,0 +1,188 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/cancel/0.1/payload.schema.json
+ */
+
+import type { Ext, RequestId } from "../../../../_shared/components.js";
+
+
+/**
+ * The starter or the lock holder ends an out-of-band request. Issued and signed by the starter key or by the lock key. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, parentThreadId, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBCancelPayload {
+  requestId: RequestId;
+  ext?: Ext;
+}
+/**
+ * Confirms the request is cancelled. Cancelling an already-cancelled request answers the same way.
+ */
+export interface AuthOOBCancelResponsePayload {
+  /**
+   * The request's final state.
+   */
+  status: "cancelled";
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RequestId };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/cancel/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBCancelPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/oob/cancel/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthOOBCancelResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/oob/cancel/0.1",
+  "title": "Auth — OOB Cancel — payload",
+  "description": "The starter or the lock holder ends an out-of-band request. Issued and signed by the starter key or by the lock key. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, parentThreadId, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "requestId"
+  ],
+  "properties": {
+    "requestId": {
+      "$ref": "#/$defs/RequestId"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Cancel — response payload",
+      "description": "Confirms the request is cancelled. Cancelling an already-cancelled request answers the same way.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "cancelled"
+          ],
+          "description": "The request's final state."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Cancel — response payload",
+      "description": "Confirms the request is cancelled. Cancelling an already-cancelled request answers the same way.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "cancelled"
+          ],
+          "description": "The request's final state."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/auth/oob/claim/0.1/payload.ts

@@ -0,0 +1,306 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/claim/0.1/payload.schema.json
+ */
+
+import type { Ext, Origin, Purpose, RequestId, Service } from "../../../../_shared/components.js";
+
+
+/**
+ * An approver claims a pending out-of-band request, locking it to a throwaway Ed25519 key (`K_a`) generated for this one exchange. The document is the first request of a trigger-link exchange (VTI-LNK-054): issued and signed by `K_a`, addressed to the service, and carrying the request's handle both here and as the envelope's `parentThreadId`. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, parentThreadId, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBClaimPayload {
+  /**
+   * The handle read from the trigger link's `_id`. MUST equal the document's `parentThreadId`.
+   */
+  requestId: RequestId;
+  ext?: Ext;
+}
+/**
+ * Step 1 of the disclosure ladder, signed by the service's assertionMethod key: who the service is, where the request will be used and for what, and when the decision window closes. It MUST contain nothing about the starter.
+ */
+export interface AuthOOBClaimResponsePayloadStep1 {
+  requestId: RequestId;
+  service: Service;
+  origin: Origin;
+  purpose: Purpose;
+  /**
+   * When the decision window, started by the claim, closes, as integer UTC epoch seconds. Prove, respond and redeem must all complete before it. At most 180 s after the claim; 120 s RECOMMENDED.
+   */
+  decisionDeadline: number;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Origin, Purpose, RequestId, Service };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/claim/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBClaimPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/oob/claim/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthOOBClaimResponsePayloadStep1;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/oob/claim/0.1",
+  "title": "Auth — OOB Claim — payload",
+  "description": "An approver claims a pending out-of-band request, locking it to a throwaway Ed25519 key (`K_a`) generated for this one exchange. The document is the first request of a trigger-link exchange (VTI-LNK-054): issued and signed by `K_a`, addressed to the service, and carrying the request's handle both here and as the envelope's `parentThreadId`. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, parentThreadId, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "requestId"
+  ],
+  "properties": {
+    "requestId": {
+      "$ref": "#/$defs/RequestId",
+      "description": "The handle read from the trigger link's `_id`. MUST equal the document's `parentThreadId`."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Claim — response payload (step 1)",
+      "description": "Step 1 of the disclosure ladder, signed by the service's assertionMethod key: who the service is, where the request will be used and for what, and when the decision window closes. It MUST contain nothing about the starter.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requestId",
+        "service",
+        "origin",
+        "purpose",
+        "decisionDeadline"
+      ],
+      "properties": {
+        "requestId": {
+          "$ref": "#/$defs/RequestId"
+        },
+        "service": {
+          "$ref": "#/$defs/Service"
+        },
+        "origin": {
+          "$ref": "#/$defs/Origin"
+        },
+        "purpose": {
+          "$ref": "#/$defs/Purpose"
+        },
+        "decisionDeadline": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "When the decision window, started by the claim, closes, as integer UTC epoch seconds. Prove, respond and redeem must all complete before it. At most 180 s after the claim; 120 s RECOMMENDED."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Purpose": {
+      "title": "Purpose",
+      "type": "string",
+      "enum": [
+        "login"
+      ],
+      "description": "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit."
+    },
+    "Origin": {
+      "title": "Origin",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 2048,
+      "pattern": "^https://[^/?#\\s]+$",
+      "description": "A web origin (`https://host[:port]`, no path, no trailing slash) — for `login`, the origin of the portal where the starter runs, which is the origin of the `serviceEndpoint` of the service's `SignInPortal` service in its DID document."
+    },
+    "Service": {
+      "title": "Service",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "did",
+        "name"
+      ],
+      "properties": {
+        "did": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The service's DID: the `recipient` of every request in the family, and the `_from` of the trigger link."
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "The name the service calls itself. Supplied by the service: an approver shows the name from its OWN records and flags a difference from this one (VTI-LNK-104); it never shows this value as the community's name on its own authority."
+        }
+      },
+      "description": "Who the service says it is."
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Claim — response payload (step 1)",
+      "description": "Step 1 of the disclosure ladder, signed by the service's assertionMethod key: who the service is, where the request will be used and for what, and when the decision window closes. It MUST contain nothing about the starter.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requestId",
+        "service",
+        "origin",
+        "purpose",
+        "decisionDeadline"
+      ],
+      "properties": {
+        "requestId": {
+          "$ref": "#/$defs/RequestId"
+        },
+        "service": {
+          "$ref": "#/$defs/Service"
+        },
+        "origin": {
+          "$ref": "#/$defs/Origin"
+        },
+        "purpose": {
+          "$ref": "#/$defs/Purpose"
+        },
+        "decisionDeadline": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "When the decision window, started by the claim, closes, as integer UTC epoch seconds. Prove, respond and redeem must all complete before it. At most 180 s after the claim; 120 s RECOMMENDED."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Purpose": {
+      "title": "Purpose",
+      "type": "string",
+      "enum": [
+        "login"
+      ],
+      "description": "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit."
+    },
+    "Origin": {
+      "title": "Origin",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 2048,
+      "pattern": "^https://[^/?#\\s]+$",
+      "description": "A web origin (`https://host[:port]`, no path, no trailing slash) — for `login`, the origin of the portal where the starter runs, which is the origin of the `serviceEndpoint` of the service's `SignInPortal` service in its DID document."
+    },
+    "Service": {
+      "title": "Service",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "did",
+        "name"
+      ],
+      "properties": {
+        "did": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The service's DID: the `recipient` of every request in the family, and the `_from` of the trigger link."
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "The name the service calls itself. Supplied by the service: an approver shows the name from its OWN records and flags a difference from this one (VTI-LNK-104); it never shows this value as the community's name on its own authority."
+        }
+      },
+      "description": "Who the service says it is."
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/auth/oob/grant/0.1/payload.ts

@@ -0,0 +1,159 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/grant/0.1/payload.schema.json
+ */
+
+import type { DigestMultibase, OobKey, Origin, RequestId } from "../../../../_shared/components.js";
+
+
+/**
+ * The member's decision on one out-of-band request, as an attestation: "let this starter key act as me at this origin until notAfter, having seen this context", or a decline. Issued by the DID that proved membership and signed by its VTA for `assertionMethod`, only after user verification. Never sent on its own, only carried inside auth/oob/respond. Closed: additionalProperties false and no `ext`. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBGrantPayload {
+  requestId: RequestId;
+  /**
+   * The member's decision. A decline still names the context it declines, and needs no user verification.
+   */
+  decision: "approve" | "decline";
+  /**
+   * The starter key `K_b`, from step 2. On approve, the only key the grant lets act as the issuer.
+   */
+  sessionKey: OobKey;
+  /**
+   * The lock key `K_a`. MUST equal the issuer of the respond that carries this document.
+   */
+  approverKey: OobKey;
+  /**
+   * The portal origin from step 2, at which the session key may act.
+   */
+  origin: Origin;
+  /**
+   * SHA-256 multihash over the RFC 8785 (JCS) canonical form of the signed step 2 response document (the auth/oob/prove response), proof included, written as multibase. Producers emit base58btc (`z…`). Binds the decision to exactly what the member was shown.
+   */
+  contextDigest: DigestMultibase;
+  /**
+   * The latest instant the session key may act as the issuer, as integer UTC epoch seconds. The service ends the session at the earlier of this and its own session limit.
+   */
+  notAfter: number;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, OobKey, Origin, RequestId };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/grant/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBGrantPayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/oob/grant/0.1",
+  "title": "Auth — OOB Grant — payload",
+  "description": "The member's decision on one out-of-band request, as an attestation: \"let this starter key act as me at this origin until notAfter, having seen this context\", or a decline. Issued by the DID that proved membership and signed by its VTA for `assertionMethod`, only after user verification. Never sent on its own, only carried inside auth/oob/respond. Closed: additionalProperties false and no `ext`. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "requestId",
+    "decision",
+    "sessionKey",
+    "approverKey",
+    "origin",
+    "contextDigest",
+    "notAfter"
+  ],
+  "properties": {
+    "requestId": {
+      "$ref": "#/$defs/RequestId"
+    },
+    "decision": {
+      "type": "string",
+      "enum": [
+        "approve",
+        "decline"
+      ],
+      "description": "The member's decision. A decline still names the context it declines, and needs no user verification."
+    },
+    "sessionKey": {
+      "$ref": "#/$defs/OobKey",
+      "description": "The starter key `K_b`, from step 2. On approve, the only key the grant lets act as the issuer."
+    },
+    "approverKey": {
+      "$ref": "#/$defs/OobKey",
+      "description": "The lock key `K_a`. MUST equal the issuer of the respond that carries this document."
+    },
+    "origin": {
+      "$ref": "#/$defs/Origin",
+      "description": "The portal origin from step 2, at which the session key may act."
+    },
+    "contextDigest": {
+      "$ref": "#/$defs/DigestMultibase",
+      "description": "SHA-256 multihash over the RFC 8785 (JCS) canonical form of the signed step 2 response document (the auth/oob/prove response), proof included, written as multibase. Producers emit base58btc (`z…`). Binds the decision to exactly what the member was shown."
+    },
+    "notAfter": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "The latest instant the session key may act as the issuer, as integer UTC epoch seconds. The service ends the session at the earlier of this and its own session limit."
+    }
+  },
+  "$defs": {
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "Origin": {
+      "title": "Origin",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 2048,
+      "pattern": "^https://[^/?#\\s]+$",
+      "description": "A web origin (`https://host[:port]`, no path, no trailing slash) — for `login`, the origin of the portal where the starter runs, which is the origin of the `serviceEndpoint` of the service's `SignInPortal` service in its DID document."
+    },
+    "OobKey": {
+      "title": "OobKey",
+      "type": "string",
+      "minLength": 48,
+      "maxLength": 64,
+      "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "A starter key (`K_b`) or an approver lock key (`K_a`), as an Ed25519 `did:key` (`z6Mk…`) generated for this one request and used nowhere else. Ed25519 only: a service refuses any other key type with `auth/oob:keyUnsupported` before parsing beyond the multicodec prefix."
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;