@openvtc/trust-tasks 0.23.8 → 0.24.0

package/dist/auth/oob/request/0.1/payload.d.ts

@@ -0,0 +1,330 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/request/0.1/payload.schema.json
+ */
+import type { Ext, Mode, Purpose, RequestId } from "../../../../_shared/components.js";
+/**
+ * A starter asks a service to open an out-of-band request that an approver will decide on another device. The document is issued and signed by the starter's fresh Ed25519 key, which is fixed for the life of the request. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthOOBRequestPayload {
+    purpose: Purpose;
+    mode: Mode;
+    ext?: Ext;
+}
+/**
+ * The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.
+ */
+export interface AuthOOBRequestResponsePayload {
+    requestId: RequestId;
+    /**
+     * The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED.
+     */
+    claimDeadline: number;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Mode, Purpose, RequestId };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/auth/oob/request/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthOOBRequestPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/oob/request/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthOOBRequestResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/oob/request/0.1";
+    readonly title: "Auth — OOB Request — payload";
+    readonly description: "A starter asks a service to open an out-of-band request that an approver will decide on another device. The document is issued and signed by the starter's fresh Ed25519 key, which is fixed for the life of the request. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["purpose", "mode"];
+    readonly properties: {
+        readonly purpose: {
+            readonly $ref: "#/$defs/Purpose";
+        };
+        readonly mode: {
+            readonly $ref: "#/$defs/Mode";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth — OOB Request — response payload";
+            readonly description: "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["requestId", "claimDeadline"];
+            readonly properties: {
+                readonly requestId: {
+                    readonly $ref: "#/$defs/RequestId";
+                };
+                readonly claimDeadline: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RequestId: {
+            readonly title: "RequestId";
+            readonly type: "string";
+            readonly minLength: 22;
+            readonly maxLength: 43;
+            readonly pattern: "^[A-Za-z0-9_-]{22,43}$";
+            readonly description: "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder.";
+        };
+        readonly Mode: {
+            readonly title: "Mode";
+            readonly type: "string";
+            readonly enum: readonly ["scan"];
+            readonly description: "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names.";
+        };
+        readonly Purpose: {
+            readonly title: "Purpose";
+            readonly type: "string";
+            readonly enum: readonly ["login"];
+            readonly description: "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth — OOB Request — response payload";
+            readonly description: "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["requestId", "claimDeadline"];
+            readonly properties: {
+                readonly requestId: {
+                    readonly $ref: "#/$defs/RequestId";
+                };
+                readonly claimDeadline: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RequestId: {
+            readonly title: "RequestId";
+            readonly type: "string";
+            readonly minLength: 22;
+            readonly maxLength: 43;
+            readonly pattern: "^[A-Za-z0-9_-]{22,43}$";
+            readonly description: "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder.";
+        };
+        readonly Mode: {
+            readonly title: "Mode";
+            readonly type: "string";
+            readonly enum: readonly ["scan"];
+            readonly description: "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names.";
+        };
+        readonly Purpose: {
+            readonly title: "Purpose";
+            readonly type: "string";
+            readonly enum: readonly ["login"];
+            readonly description: "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/oob/request/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/oob/request/0.1";
+        readonly title: "Auth — OOB Request — payload";
+        readonly description: "A starter asks a service to open an out-of-band request that an approver will decide on another device. The document is issued and signed by the starter's fresh Ed25519 key, which is fixed for the life of the request. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["purpose", "mode"];
+        readonly properties: {
+            readonly purpose: {
+                readonly $ref: "#/$defs/Purpose";
+            };
+            readonly mode: {
+                readonly $ref: "#/$defs/Mode";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth — OOB Request — response payload";
+                readonly description: "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["requestId", "claimDeadline"];
+                readonly properties: {
+                    readonly requestId: {
+                        readonly $ref: "#/$defs/RequestId";
+                    };
+                    readonly claimDeadline: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RequestId: {
+                readonly title: "RequestId";
+                readonly type: "string";
+                readonly minLength: 22;
+                readonly maxLength: 43;
+                readonly pattern: "^[A-Za-z0-9_-]{22,43}$";
+                readonly description: "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder.";
+            };
+            readonly Mode: {
+                readonly title: "Mode";
+                readonly type: "string";
+                readonly enum: readonly ["scan"];
+                readonly description: "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names.";
+            };
+            readonly Purpose: {
+                readonly title: "Purpose";
+                readonly type: "string";
+                readonly enum: readonly ["login"];
+                readonly description: "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/auth/oob/request/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth — OOB Request — response payload";
+                readonly description: "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["requestId", "claimDeadline"];
+                readonly properties: {
+                    readonly requestId: {
+                        readonly $ref: "#/$defs/RequestId";
+                    };
+                    readonly claimDeadline: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RequestId: {
+                readonly title: "RequestId";
+                readonly type: "string";
+                readonly minLength: 22;
+                readonly maxLength: 43;
+                readonly pattern: "^[A-Za-z0-9_-]{22,43}$";
+                readonly description: "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder.";
+            };
+            readonly Mode: {
+                readonly title: "Mode";
+                readonly type: "string";
+                readonly enum: readonly ["scan"];
+                readonly description: "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names.";
+            };
+            readonly Purpose: {
+                readonly title: "Purpose";
+                readonly type: "string";
+                readonly enum: readonly ["login"];
+                readonly description: "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/auth/oob/request/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/oob/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGvF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,SAAS,CAAC;IACrB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAE9C,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,kDAA2D,CAAC;AAEpF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAE5C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,2DAAoE,CAAC;AAEtG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkFjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/auth/oob/request/0.1/payload.js

@@ -0,0 +1,193 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/oob/request/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/oob/request/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/oob/request/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/auth/oob/request/0.1",
+    "title": "Auth — OOB Request — payload",
+    "description": "A starter asks a service to open an out-of-band request that an approver will decide on another device. The document is issued and signed by the starter's fresh Ed25519 key, which is fixed for the life of the request. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "purpose",
+        "mode"
+    ],
+    "properties": {
+        "purpose": {
+            "$ref": "#/$defs/Purpose"
+        },
+        "mode": {
+            "$ref": "#/$defs/Mode"
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth — OOB Request — response payload",
+            "description": "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "requestId",
+                "claimDeadline"
+            ],
+            "properties": {
+                "requestId": {
+                    "$ref": "#/$defs/RequestId"
+                },
+                "claimDeadline": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RequestId": {
+            "title": "RequestId",
+            "type": "string",
+            "minLength": 22,
+            "maxLength": 43,
+            "pattern": "^[A-Za-z0-9_-]{22,43}$",
+            "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+        },
+        "Mode": {
+            "title": "Mode",
+            "type": "string",
+            "enum": [
+                "scan"
+            ],
+            "description": "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names."
+        },
+        "Purpose": {
+            "title": "Purpose",
+            "type": "string",
+            "enum": [
+                "login"
+            ],
+            "description": "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit."
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth — OOB Request — response payload",
+            "description": "The handle of the new request and its claim deadline. The starter builds the trigger link from these and the service's DID.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "requestId",
+                "claimDeadline"
+            ],
+            "properties": {
+                "requestId": {
+                    "$ref": "#/$defs/RequestId"
+                },
+                "claimDeadline": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "The instant by which the request must be claimed, as integer UTC epoch seconds — the same unit as the trigger link's `_exp`, into which it is written unchanged. At most 180 s after the request was accepted; 120 s is RECOMMENDED."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RequestId": {
+            "title": "RequestId",
+            "type": "string",
+            "minLength": 22,
+            "maxLength": 43,
+            "pattern": "^[A-Za-z0-9_-]{22,43}$",
+            "description": "The service-generated handle of one request: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is RECOMMENDED). It is also the nonce of the exchange, so the family needs no separate challenge, and it is the `_id` of the trigger link (VTI-LNK-033). Compared as a string. It confers no authority on its holder."
+        },
+        "Mode": {
+            "title": "Mode",
+            "type": "string",
+            "enum": [
+                "scan"
+            ],
+            "description": "How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names."
+        },
+        "Purpose": {
+            "title": "Purpose",
+            "type": "string",
+            "enum": [
+                "login"
+            ],
+            "description": "What the request is for. A CLOSED list: each purpose has a fixed row in CONVENTIONS.md §3 stating what is revealed at each step, what the grant contains, what redeem returns and the window lengths. Version 0.1 defines `login` only. `stepUp` and `deviceEnrol` are reserved names; adding one is a new version of this component and of every task that references it, never an in-place edit."
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/auth/oob/request/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/auth/oob/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,kDAA2D,CAAC;AAKpF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,2DAAoE,CAAC;AAKtG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,kDAAkD;IACzD,OAAO,EAAE,8BAA8B;IACvC,aAAa,EAAE,wVAAwV;IACvW,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;QACT,MAAM;KACP;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,iBAAiB;SAC1B;QACD,MAAM,EAAE;YACN,MAAM,EAAE,cAAc;SACvB;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,6HAA6H;YAC5I,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,eAAe;aAChB;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,sOAAsO;iBACtP;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wBAAwB;YACnC,aAAa,EAAE,+YAA+Y;SAC/Z;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,MAAM;aACP;YACD,aAAa,EAAE,uWAAuW;SACvX;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,OAAO;aACR;YACD,aAAa,EAAE,oYAAoY;SACpZ;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,6HAA6H;YAC5I,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,eAAe;aAChB;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,sOAAsO;iBACtP;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wBAAwB;YACnC,aAAa,EAAE,+YAA+Y;SAC/Z;QACD,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,MAAM;aACP;YACD,aAAa,EAAE,uWAAuW;SACvX;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,OAAO;aACR;YACD,aAAa,EAAE,oYAAoY;SACpZ;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}