@openvtc/trust-tasks 0.23.7 → 0.23.9

package/src/auth/oob/redeem/0.1/payload.ts

@@ -0,0 +1,248 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/redeem/0.1/payload.schema.json
+ */
+
+import type { Ext, RequestId } from "../../../../_shared/components.js";
+
+
+/**
+ * The starter turns an approved out-of-band request into the outcome its purpose defines — for `login`, a session bound to the starter key. Issued and signed by the starter key; held as a long poll until the request is approved. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBRedeemPayload {
+  requestId: RequestId;
+  ext?: Ext;
+}
+/**
+ * For `login`: who is now signed in, for the starter's "Continue as …?" confirmation. Never tokens: over HTTPS the session itself is delivered as HttpOnly cookies.
+ */
+export interface AuthOOBRedeemResponsePayload {
+  /**
+   * The approving DID — the grant's issuer — now the session's subject.
+   */
+  subject: string;
+  /**
+   * A name for the signed-in identity, for the confirmation step. Untrusted wherever rendered.
+   */
+  displayName: string;
+  /**
+   * When the session ends, as integer UTC epoch seconds: the earlier of the grant's `notAfter` and the service's session limit.
+   */
+  notAfter: number;
+  /**
+   * Authentication Methods References (RFC 8176) for the session. For this family: `["did", "oob", "uv"]`.
+   *
+   * @minItems 1
+   */
+  amr: [string, ...string[]];
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RequestId };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/redeem/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBRedeemPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/oob/redeem/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthOOBRedeemResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/oob/redeem/0.1",
+  "title": "Auth — OOB Redeem — payload",
+  "description": "The starter turns an approved out-of-band request into the outcome its purpose defines — for `login`, a session bound to the starter key. Issued and signed by the starter key; held as a long poll until the request is approved. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "requestId"
+  ],
+  "properties": {
+    "requestId": {
+      "$ref": "#/$defs/RequestId"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Redeem — response payload",
+      "description": "For `login`: who is now signed in, for the starter's \"Continue as …?\" confirmation. Never tokens: over HTTPS the session itself is delivered as HttpOnly cookies.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "subject",
+        "displayName",
+        "notAfter",
+        "amr"
+      ],
+      "properties": {
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The approving DID — the grant's issuer — now the session's subject."
+        },
+        "displayName": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "A name for the signed-in identity, for the confirmation step. Untrusted wherever rendered."
+        },
+        "notAfter": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "When the session ends, as integer UTC epoch seconds: the earlier of the grant's `notAfter` and the service's session limit."
+        },
+        "amr": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Authentication Methods References (RFC 8176) for the session. For this family: `[\"did\", \"oob\", \"uv\"]`."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Redeem — response payload",
+      "description": "For `login`: who is now signed in, for the starter's \"Continue as …?\" confirmation. Never tokens: over HTTPS the session itself is delivered as HttpOnly cookies.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "subject",
+        "displayName",
+        "notAfter",
+        "amr"
+      ],
+      "properties": {
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The approving DID — the grant's issuer — now the session's subject."
+        },
+        "displayName": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "A name for the signed-in identity, for the confirmation step. Untrusted wherever rendered."
+        },
+        "notAfter": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "When the session ends, as integer UTC epoch seconds: the earlier of the grant's `notAfter` and the service's session limit."
+        },
+        "amr": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Authentication Methods References (RFC 8176) for the session. For this family: `[\"did\", \"oob\", \"uv\"]`."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/auth/oob/request/0.1/payload.ts

@@ -0,0 +1,230 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/request/0.1/payload.schema.json
+ */
+
+import type { Ext, Mode, Purpose, RequestId } from "../../../../_shared/components.js";
+
+
+/**
+ * A starter asks a service to open an out-of-band request that an approver will decide on another device. The document is issued and signed by the starter's fresh Ed25519 key, which is fixed for the life of the request. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBRequestPayload {
+  purpose: Purpose;
+  mode: Mode;
+  ext?: Ext;
+}
+/**
+ * The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.
+ */
+export interface AuthOOBRequestResponsePayload {
+  requestId: RequestId;
+  /**
+   * The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED.
+   */
+  claimDeadline: number;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Mode, Purpose, RequestId };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/request/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBRequestPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/oob/request/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthOOBRequestResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/oob/request/0.1",
+  "title": "Auth — OOB Request — payload",
+  "description": "A starter asks a service to open an out-of-band request that an approver will decide on another device. The document is issued and signed by the starter's fresh Ed25519 key, which is fixed for the life of the request. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "purpose",
+    "mode"
+  ],
+  "properties": {
+    "purpose": {
+      "$ref": "#/$defs/Purpose"
+    },
+    "mode": {
+      "$ref": "#/$defs/Mode"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Request — response payload",
+      "description": "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requestId",
+        "claimDeadline"
+      ],
+      "properties": {
+        "requestId": {
+          "$ref": "#/$defs/RequestId"
+        },
+        "claimDeadline": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    },
+    "Mode": {
+      "title": "Mode",
+      "type": "string",
+      "enum": [
+        "scan"
+      ],
+      "description": "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names."
+    },
+    "Purpose": {
+      "title": "Purpose",
+      "type": "string",
+      "enum": [
+        "login"
+      ],
+      "description": "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Request — response payload",
+      "description": "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requestId",
+        "claimDeadline"
+      ],
+      "properties": {
+        "requestId": {
+          "$ref": "#/$defs/RequestId"
+        },
+        "claimDeadline": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RequestId": {
+      "title": "RequestId",
+      "type": "string",
+      "minLength": 22,
+      "maxLength": 43,
+      "pattern": "^[A-Za-z0-9_-]{22,43}$",
+      "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+    },
+    "Mode": {
+      "title": "Mode",
+      "type": "string",
+      "enum": [
+        "scan"
+      ],
+      "description": "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names."
+    },
+    "Purpose": {
+      "title": "Purpose",
+      "type": "string",
+      "enum": [
+        "login"
+      ],
+      "description": "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/auth/oob/respond/0.1/payload.ts

@@ -0,0 +1,178 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/respond/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * The lock holder delivers the member's signed decision on an out-of-band request by carrying a signed auth/oob/grant document. Issued and signed by the lock key `K_a`. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, parentThreadId, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBRespondPayload {
+  /**
+   * A complete, signed auth/oob/grant/0.1 Trust Task document, issued by the identified DID and signed by its VTA for `assertionMethod`. The service verifies it as a document in its own right — envelope, proof and payload against that specification's schema — over the members exactly as received: its proof covers every member, so it is deliberately an open object here rather than a typed one a binding could narrow.
+   */
+  grant: {};
+  ext?: Ext;
+}
+/**
+ * The outcome the service recorded. It never contains session material: authority goes to the starter key, through auth/oob/redeem only.
+ */
+export interface AuthOOBRespondResponsePayload {
+  /**
+   * `approved` when the grant approved and every check passed; `declined` when the grant declined.
+   */
+  status: "approved" | "declined";
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/respond/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBRespondPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/oob/respond/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthOOBRespondResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/oob/respond/0.1",
+  "title": "Auth — OOB Respond — payload",
+  "description": "The lock holder delivers the member's signed decision on an out-of-band request by carrying a signed auth/oob/grant document. Issued and signed by the lock key `K_a`. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, parentThreadId, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "grant"
+  ],
+  "properties": {
+    "grant": {
+      "type": "object",
+      "description": "A complete, signed auth/oob/grant/0.1 Trust Task document, issued by the identified DID and signed by its VTA for `assertionMethod`. The service verifies it as a document in its own right — envelope, proof and payload against that specification's schema — over the members exactly as received: its proof covers every member, so it is deliberately an open object here rather than a typed one a binding could narrow."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Respond — response payload",
+      "description": "The outcome the service recorded. It never contains session material: authority goes to the starter key, through auth/oob/redeem only.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "approved",
+            "declined"
+          ],
+          "description": "`approved` when the grant approved and every check passed; `declined` when the grant declined."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — OOB Respond — response payload",
+      "description": "The outcome the service recorded. It never contains session material: authority goes to the starter key, through auth/oob/redeem only.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "approved",
+            "declined"
+          ],
+          "description": "`approved` when the grant approved and every check passed; `declined` when the grant declined."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/device/list/0.1/payload.ts

@@ -249,7 +249,9 @@ export const PAYLOAD_SCHEMA = {
         "room-present",
         "room-open",
         "key-export",
-        "sign-sshsig"
+        "sign-sshsig",
+        "external-accounts-manage",
+        "external-auth-use"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -589,7 +591,9 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "room-present",
         "room-open",
         "key-export",
-        "sign-sshsig"
+        "sign-sshsig",
+        "external-accounts-manage",
+        "external-auth-use"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },