@openvtc/trust-tasks 0.26.0 → 0.26.1

package/dist/vtc/oid4vp/identities/list/0.1/payload.d.ts

@@ -0,0 +1,938 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/oid4vp/identities/list/0.1/payload.schema.json
+ */
+import type { Ext } from "../../../../../_shared/components.js";
+/**
+ * An administrator reads the OpenID4VP verifier identities the community holds — the identities it presents to wallets that speak OpenID4VP and no Trust Task protocol — and, for each, whether it can open a presentation session now and what stands in the way. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTCOpenID4VPVerifierIdentitiesListPayload {
+    ext?: Ext;
+}
+export interface VTCOpenID4VPVerifierIdentitiesListResponsePayload {
+    /**
+     * Every verifier identity the community holds, by `id`. Empty when it holds none.
+     */
+    identities: Identity[];
+    /**
+     * The identity the community is configured to use when a session names no client identifier prefix; null when none is configured, and the first usable identity is used.
+     */
+    defaultIdentity?: string | null;
+    /**
+     * What is wrong with the community's verifier as a whole, rather than with one identity. Empty when nothing is.
+     */
+    problems: Problem[];
+    ext?: Ext;
+}
+/**
+ * One verifier identity, described by what is public about it. The signing key's private half, and where a remote custodian keeps it, are never returned.
+ */
+export interface Identity {
+    /**
+     * The administrator's name for the identity.
+     */
+    id: string;
+    /**
+     * The wallet ecosystem it is known to: `swiyu` (a DID registered in the swiyu Base Registry) or `eudi` (an X.509 access certificate).
+     */
+    kind: "swiyu" | "eudi";
+    /**
+     * The OpenID4VP client identifier wallets see, prefix included. Null while an `eudi` identity has no certificate.
+     */
+    clientId?: string | null;
+    /**
+     * The identity's DID, for a `swiyu` identity.
+     */
+    did?: string | null;
+    /**
+     * The verification method that signs request objects, for an identity known by a DID.
+     */
+    keyId?: string | null;
+    /**
+     * Where the signing key is: `cached` by the community, kept by its `agent` (which signs every request object), or `invalid` when the record names neither or both.
+     */
+    custody: "cached" | "agent" | "invalid";
+    /**
+     * Whether a session could be opened on this identity now: true exactly when no `error` problem applies to it, and none other than `defaultIdentityNotInstalled` applies to the community's verifier as a whole.
+     */
+    usable: boolean;
+    /**
+     * Whether a session that names no client identifier prefix uses this identity.
+     */
+    isDefault: boolean;
+    certificate?: Certificate;
+    /**
+     * What every request object carries in `verifier_info`, in the order it carries them. Empty when it carries none.
+     */
+    attestations: Attestation[];
+    /**
+     * What is wrong with this identity. Empty when nothing is.
+     */
+    problems: Problem[];
+    installedAt: string;
+}
+/**
+ * The access certificate, for an `eudi` identity that has one.
+ */
+export interface Certificate {
+    /**
+     * The leaf's subject distinguished name, as RFC 4514 renders it.
+     */
+    subject?: string;
+    /**
+     * The leaf's issuer distinguished name, as RFC 4514 renders it.
+     */
+    issuer?: string;
+    notBefore: string;
+    notAfter: string;
+    /**
+     * Certificates in the chain, leaf included.
+     */
+    chainLength: number;
+}
+/**
+ * One attestation about the verifier that every request object carries in `verifier_info`.
+ */
+export interface Attestation {
+    /**
+     * Which attestation it is, as tabled in the specification.
+     */
+    kind: "identityTrustStatement" | "protectedVerificationAuthorization" | "registrationCertificate" | "other";
+    /**
+     * When it expires, if it says; null when it carries no expiry the maintainer reads.
+     */
+    expiresAt?: string | null;
+}
+/**
+ * One thing that stops, or will soon stop, a verifier identity or the community's verifier as a whole from serving wallets.
+ */
+export interface Problem {
+    /**
+     * What is wrong, as tabled in the specification.
+     */
+    code: "keyCustodyInvalid" | "signerNotLoaded" | "agentLinkMissing" | "certificateMissing" | "certificateNotYetValid" | "certificateExpired" | "certificateExpiresSoon" | "identityStatementMissing" | "statementExpired" | "statementExpiresSoon" | "defaultIdentityNotInstalled" | "noPublicUrl";
+    /**
+     * `error`: sessions are refused, or wallets will refuse what the community sends, until it is fixed. `warning`: it works now and will not for long.
+     */
+    severity: "error" | "warning";
+    /**
+     * Maintainer-authored prose for the administrator — what to run to fix it. Never parsed.
+     */
+    detail?: string;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/oid4vp/identities/list/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCOpenID4VPVerifierIdentitiesListPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtc/oid4vp/identities/list/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCOpenID4VPVerifierIdentitiesListResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vtc/oid4vp/identities/list/0.1";
+    readonly title: "VTC OpenID4VP Verifier Identities List — payload";
+    readonly description: "An administrator reads the OpenID4VP verifier identities the community holds — the identities it presents to wallets that speak OpenID4VP and no Trust Task protocol — and, for each, whether it can open a presentation session now and what stands in the way. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Problem: {
+            readonly title: "Problem";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "One thing that stops, or will soon stop, a verifier identity or the community's verifier as a whole from serving wallets.";
+            readonly required: readonly ["code", "severity"];
+            readonly properties: {
+                readonly code: {
+                    readonly type: "string";
+                    readonly enum: readonly ["keyCustodyInvalid", "signerNotLoaded", "agentLinkMissing", "certificateMissing", "certificateNotYetValid", "certificateExpired", "certificateExpiresSoon", "identityStatementMissing", "statementExpired", "statementExpiresSoon", "defaultIdentityNotInstalled", "noPublicUrl"];
+                    readonly description: "What is wrong, as tabled in the specification.";
+                };
+                readonly severity: {
+                    readonly type: "string";
+                    readonly enum: readonly ["error", "warning"];
+                    readonly description: "`error`: sessions are refused, or wallets will refuse what the community sends, until it is fixed. `warning`: it works now and will not for long.";
+                };
+                readonly detail: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Maintainer-authored prose for the administrator — what to run to fix it. Never parsed.";
+                };
+            };
+        };
+        readonly Certificate: {
+            readonly title: "Certificate";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "An X.509-identified verifier's access certificate: the leaf of the chain it sends wallets as `x5c`.";
+            readonly required: readonly ["notBefore", "notAfter", "chainLength"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The leaf's subject distinguished name, as RFC 4514 renders it.";
+                };
+                readonly issuer: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The leaf's issuer distinguished name, as RFC 4514 renders it.";
+                };
+                readonly notBefore: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly notAfter: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly chainLength: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Certificates in the chain, leaf included.";
+                };
+            };
+        };
+        readonly Attestation: {
+            readonly title: "Attestation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "One attestation about the verifier that every request object carries in `verifier_info`.";
+            readonly required: readonly ["kind"];
+            readonly properties: {
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["identityTrustStatement", "protectedVerificationAuthorization", "registrationCertificate", "other"];
+                    readonly description: "Which attestation it is, as tabled in the specification.";
+                };
+                readonly expiresAt: {
+                    readonly type: readonly ["string", "null"];
+                    readonly format: "date-time";
+                    readonly description: "When it expires, if it says; null when it carries no expiry the maintainer reads.";
+                };
+            };
+        };
+        readonly Identity: {
+            readonly title: "Identity";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "One verifier identity, described by what is public about it. The signing key's private half, and where a remote custodian keeps it, are never returned.";
+            readonly required: readonly ["id", "kind", "custody", "usable", "isDefault", "attestations", "problems", "installedAt"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "The administrator's name for the identity.";
+                };
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["swiyu", "eudi"];
+                    readonly description: "The wallet ecosystem it is known to: `swiyu` (a DID registered in the swiyu Base Registry) or `eudi` (an X.509 access certificate).";
+                };
+                readonly clientId: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The OpenID4VP client identifier wallets see, prefix included. Null while an `eudi` identity has no certificate.";
+                };
+                readonly did: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The identity's DID, for a `swiyu` identity.";
+                };
+                readonly keyId: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The verification method that signs request objects, for an identity known by a DID.";
+                };
+                readonly custody: {
+                    readonly type: "string";
+                    readonly enum: readonly ["cached", "agent", "invalid"];
+                    readonly description: "Where the signing key is: `cached` by the community, kept by its `agent` (which signs every request object), or `invalid` when the record names neither or both.";
+                };
+                readonly usable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether a session could be opened on this identity now: true exactly when no `error` problem applies to it, and none other than `defaultIdentityNotInstalled` applies to the community's verifier as a whole.";
+                };
+                readonly isDefault: {
+                    readonly type: "boolean";
+                    readonly description: "Whether a session that names no client identifier prefix uses this identity.";
+                };
+                readonly certificate: {
+                    readonly $ref: "#/$defs/Certificate";
+                    readonly description: "The access certificate, for an `eudi` identity that has one.";
+                };
+                readonly attestations: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Attestation";
+                    };
+                    readonly description: "What every request object carries in `verifier_info`, in the order it carries them. Empty when it carries none.";
+                };
+                readonly problems: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Problem";
+                    };
+                    readonly description: "What is wrong with this identity. Empty when nothing is.";
+                };
+                readonly installedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC OpenID4VP Verifier Identities List — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["identities", "problems"];
+            readonly properties: {
+                readonly identities: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Identity";
+                    };
+                    readonly description: "Every verifier identity the community holds, by `id`. Empty when it holds none.";
+                };
+                readonly defaultIdentity: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The identity the community is configured to use when a session names no client identifier prefix; null when none is configured, and the first usable identity is used.";
+                };
+                readonly problems: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Problem";
+                    };
+                    readonly description: "What is wrong with the community's verifier as a whole, rather than with one identity. Empty when nothing is.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Problem: {
+            readonly title: "Problem";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "One thing that stops, or will soon stop, a verifier identity or the community's verifier as a whole from serving wallets.";
+            readonly required: readonly ["code", "severity"];
+            readonly properties: {
+                readonly code: {
+                    readonly type: "string";
+                    readonly enum: readonly ["keyCustodyInvalid", "signerNotLoaded", "agentLinkMissing", "certificateMissing", "certificateNotYetValid", "certificateExpired", "certificateExpiresSoon", "identityStatementMissing", "statementExpired", "statementExpiresSoon", "defaultIdentityNotInstalled", "noPublicUrl"];
+                    readonly description: "What is wrong, as tabled in the specification.";
+                };
+                readonly severity: {
+                    readonly type: "string";
+                    readonly enum: readonly ["error", "warning"];
+                    readonly description: "`error`: sessions are refused, or wallets will refuse what the community sends, until it is fixed. `warning`: it works now and will not for long.";
+                };
+                readonly detail: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Maintainer-authored prose for the administrator — what to run to fix it. Never parsed.";
+                };
+            };
+        };
+        readonly Certificate: {
+            readonly title: "Certificate";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "An X.509-identified verifier's access certificate: the leaf of the chain it sends wallets as `x5c`.";
+            readonly required: readonly ["notBefore", "notAfter", "chainLength"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The leaf's subject distinguished name, as RFC 4514 renders it.";
+                };
+                readonly issuer: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The leaf's issuer distinguished name, as RFC 4514 renders it.";
+                };
+                readonly notBefore: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly notAfter: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly chainLength: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Certificates in the chain, leaf included.";
+                };
+            };
+        };
+        readonly Attestation: {
+            readonly title: "Attestation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "One attestation about the verifier that every request object carries in `verifier_info`.";
+            readonly required: readonly ["kind"];
+            readonly properties: {
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["identityTrustStatement", "protectedVerificationAuthorization", "registrationCertificate", "other"];
+                    readonly description: "Which attestation it is, as tabled in the specification.";
+                };
+                readonly expiresAt: {
+                    readonly type: readonly ["string", "null"];
+                    readonly format: "date-time";
+                    readonly description: "When it expires, if it says; null when it carries no expiry the maintainer reads.";
+                };
+            };
+        };
+        readonly Identity: {
+            readonly title: "Identity";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "One verifier identity, described by what is public about it. The signing key's private half, and where a remote custodian keeps it, are never returned.";
+            readonly required: readonly ["id", "kind", "custody", "usable", "isDefault", "attestations", "problems", "installedAt"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "The administrator's name for the identity.";
+                };
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["swiyu", "eudi"];
+                    readonly description: "The wallet ecosystem it is known to: `swiyu` (a DID registered in the swiyu Base Registry) or `eudi` (an X.509 access certificate).";
+                };
+                readonly clientId: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The OpenID4VP client identifier wallets see, prefix included. Null while an `eudi` identity has no certificate.";
+                };
+                readonly did: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The identity's DID, for a `swiyu` identity.";
+                };
+                readonly keyId: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The verification method that signs request objects, for an identity known by a DID.";
+                };
+                readonly custody: {
+                    readonly type: "string";
+                    readonly enum: readonly ["cached", "agent", "invalid"];
+                    readonly description: "Where the signing key is: `cached` by the community, kept by its `agent` (which signs every request object), or `invalid` when the record names neither or both.";
+                };
+                readonly usable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether a session could be opened on this identity now: true exactly when no `error` problem applies to it, and none other than `defaultIdentityNotInstalled` applies to the community's verifier as a whole.";
+                };
+                readonly isDefault: {
+                    readonly type: "boolean";
+                    readonly description: "Whether a session that names no client identifier prefix uses this identity.";
+                };
+                readonly certificate: {
+                    readonly $ref: "#/$defs/Certificate";
+                    readonly description: "The access certificate, for an `eudi` identity that has one.";
+                };
+                readonly attestations: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Attestation";
+                    };
+                    readonly description: "What every request object carries in `verifier_info`, in the order it carries them. Empty when it carries none.";
+                };
+                readonly problems: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Problem";
+                    };
+                    readonly description: "What is wrong with this identity. Empty when nothing is.";
+                };
+                readonly installedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC OpenID4VP Verifier Identities List — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["identities", "problems"];
+            readonly properties: {
+                readonly identities: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Identity";
+                    };
+                    readonly description: "Every verifier identity the community holds, by `id`. Empty when it holds none.";
+                };
+                readonly defaultIdentity: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "The identity the community is configured to use when a session names no client identifier prefix; null when none is configured, and the first usable identity is used.";
+                };
+                readonly problems: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Problem";
+                    };
+                    readonly description: "What is wrong with the community's verifier as a whole, rather than with one identity. Empty when nothing is.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/oid4vp/identities/list/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vtc/oid4vp/identities/list/0.1";
+        readonly title: "VTC OpenID4VP Verifier Identities List — payload";
+        readonly description: "An administrator reads the OpenID4VP verifier identities the community holds — the identities it presents to wallets that speak OpenID4VP and no Trust Task protocol — and, for each, whether it can open a presentation session now and what stands in the way. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Problem: {
+                readonly title: "Problem";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "One thing that stops, or will soon stop, a verifier identity or the community's verifier as a whole from serving wallets.";
+                readonly required: readonly ["code", "severity"];
+                readonly properties: {
+                    readonly code: {
+                        readonly type: "string";
+                        readonly enum: readonly ["keyCustodyInvalid", "signerNotLoaded", "agentLinkMissing", "certificateMissing", "certificateNotYetValid", "certificateExpired", "certificateExpiresSoon", "identityStatementMissing", "statementExpired", "statementExpiresSoon", "defaultIdentityNotInstalled", "noPublicUrl"];
+                        readonly description: "What is wrong, as tabled in the specification.";
+                    };
+                    readonly severity: {
+                        readonly type: "string";
+                        readonly enum: readonly ["error", "warning"];
+                        readonly description: "`error`: sessions are refused, or wallets will refuse what the community sends, until it is fixed. `warning`: it works now and will not for long.";
+                    };
+                    readonly detail: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Maintainer-authored prose for the administrator — what to run to fix it. Never parsed.";
+                    };
+                };
+            };
+            readonly Certificate: {
+                readonly title: "Certificate";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "An X.509-identified verifier's access certificate: the leaf of the chain it sends wallets as `x5c`.";
+                readonly required: readonly ["notBefore", "notAfter", "chainLength"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The leaf's subject distinguished name, as RFC 4514 renders it.";
+                    };
+                    readonly issuer: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The leaf's issuer distinguished name, as RFC 4514 renders it.";
+                    };
+                    readonly notBefore: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly notAfter: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly chainLength: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Certificates in the chain, leaf included.";
+                    };
+                };
+            };
+            readonly Attestation: {
+                readonly title: "Attestation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "One attestation about the verifier that every request object carries in `verifier_info`.";
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["identityTrustStatement", "protectedVerificationAuthorization", "registrationCertificate", "other"];
+                        readonly description: "Which attestation it is, as tabled in the specification.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: readonly ["string", "null"];
+                        readonly format: "date-time";
+                        readonly description: "When it expires, if it says; null when it carries no expiry the maintainer reads.";
+                    };
+                };
+            };
+            readonly Identity: {
+                readonly title: "Identity";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "One verifier identity, described by what is public about it. The signing key's private half, and where a remote custodian keeps it, are never returned.";
+                readonly required: readonly ["id", "kind", "custody", "usable", "isDefault", "attestations", "problems", "installedAt"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "The administrator's name for the identity.";
+                    };
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["swiyu", "eudi"];
+                        readonly description: "The wallet ecosystem it is known to: `swiyu` (a DID registered in the swiyu Base Registry) or `eudi` (an X.509 access certificate).";
+                    };
+                    readonly clientId: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The OpenID4VP client identifier wallets see, prefix included. Null while an `eudi` identity has no certificate.";
+                    };
+                    readonly did: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The identity's DID, for a `swiyu` identity.";
+                    };
+                    readonly keyId: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The verification method that signs request objects, for an identity known by a DID.";
+                    };
+                    readonly custody: {
+                        readonly type: "string";
+                        readonly enum: readonly ["cached", "agent", "invalid"];
+                        readonly description: "Where the signing key is: `cached` by the community, kept by its `agent` (which signs every request object), or `invalid` when the record names neither or both.";
+                    };
+                    readonly usable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether a session could be opened on this identity now: true exactly when no `error` problem applies to it, and none other than `defaultIdentityNotInstalled` applies to the community's verifier as a whole.";
+                    };
+                    readonly isDefault: {
+                        readonly type: "boolean";
+                        readonly description: "Whether a session that names no client identifier prefix uses this identity.";
+                    };
+                    readonly certificate: {
+                        readonly $ref: "#/$defs/Certificate";
+                        readonly description: "The access certificate, for an `eudi` identity that has one.";
+                    };
+                    readonly attestations: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Attestation";
+                        };
+                        readonly description: "What every request object carries in `verifier_info`, in the order it carries them. Empty when it carries none.";
+                    };
+                    readonly problems: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Problem";
+                        };
+                        readonly description: "What is wrong with this identity. Empty when nothing is.";
+                    };
+                    readonly installedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC OpenID4VP Verifier Identities List — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["identities", "problems"];
+                readonly properties: {
+                    readonly identities: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Identity";
+                        };
+                        readonly description: "Every verifier identity the community holds, by `id`. Empty when it holds none.";
+                    };
+                    readonly defaultIdentity: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The identity the community is configured to use when a session names no client identifier prefix; null when none is configured, and the first usable identity is used.";
+                    };
+                    readonly problems: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Problem";
+                        };
+                        readonly description: "What is wrong with the community's verifier as a whole, rather than with one identity. Empty when nothing is.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/oid4vp/identities/list/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Problem: {
+                readonly title: "Problem";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "One thing that stops, or will soon stop, a verifier identity or the community's verifier as a whole from serving wallets.";
+                readonly required: readonly ["code", "severity"];
+                readonly properties: {
+                    readonly code: {
+                        readonly type: "string";
+                        readonly enum: readonly ["keyCustodyInvalid", "signerNotLoaded", "agentLinkMissing", "certificateMissing", "certificateNotYetValid", "certificateExpired", "certificateExpiresSoon", "identityStatementMissing", "statementExpired", "statementExpiresSoon", "defaultIdentityNotInstalled", "noPublicUrl"];
+                        readonly description: "What is wrong, as tabled in the specification.";
+                    };
+                    readonly severity: {
+                        readonly type: "string";
+                        readonly enum: readonly ["error", "warning"];
+                        readonly description: "`error`: sessions are refused, or wallets will refuse what the community sends, until it is fixed. `warning`: it works now and will not for long.";
+                    };
+                    readonly detail: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Maintainer-authored prose for the administrator — what to run to fix it. Never parsed.";
+                    };
+                };
+            };
+            readonly Certificate: {
+                readonly title: "Certificate";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "An X.509-identified verifier's access certificate: the leaf of the chain it sends wallets as `x5c`.";
+                readonly required: readonly ["notBefore", "notAfter", "chainLength"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The leaf's subject distinguished name, as RFC 4514 renders it.";
+                    };
+                    readonly issuer: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The leaf's issuer distinguished name, as RFC 4514 renders it.";
+                    };
+                    readonly notBefore: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly notAfter: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly chainLength: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Certificates in the chain, leaf included.";
+                    };
+                };
+            };
+            readonly Attestation: {
+                readonly title: "Attestation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "One attestation about the verifier that every request object carries in `verifier_info`.";
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["identityTrustStatement", "protectedVerificationAuthorization", "registrationCertificate", "other"];
+                        readonly description: "Which attestation it is, as tabled in the specification.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: readonly ["string", "null"];
+                        readonly format: "date-time";
+                        readonly description: "When it expires, if it says; null when it carries no expiry the maintainer reads.";
+                    };
+                };
+            };
+            readonly Identity: {
+                readonly title: "Identity";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "One verifier identity, described by what is public about it. The signing key's private half, and where a remote custodian keeps it, are never returned.";
+                readonly required: readonly ["id", "kind", "custody", "usable", "isDefault", "attestations", "problems", "installedAt"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "The administrator's name for the identity.";
+                    };
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["swiyu", "eudi"];
+                        readonly description: "The wallet ecosystem it is known to: `swiyu` (a DID registered in the swiyu Base Registry) or `eudi` (an X.509 access certificate).";
+                    };
+                    readonly clientId: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The OpenID4VP client identifier wallets see, prefix included. Null while an `eudi` identity has no certificate.";
+                    };
+                    readonly did: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The identity's DID, for a `swiyu` identity.";
+                    };
+                    readonly keyId: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The verification method that signs request objects, for an identity known by a DID.";
+                    };
+                    readonly custody: {
+                        readonly type: "string";
+                        readonly enum: readonly ["cached", "agent", "invalid"];
+                        readonly description: "Where the signing key is: `cached` by the community, kept by its `agent` (which signs every request object), or `invalid` when the record names neither or both.";
+                    };
+                    readonly usable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether a session could be opened on this identity now: true exactly when no `error` problem applies to it, and none other than `defaultIdentityNotInstalled` applies to the community's verifier as a whole.";
+                    };
+                    readonly isDefault: {
+                        readonly type: "boolean";
+                        readonly description: "Whether a session that names no client identifier prefix uses this identity.";
+                    };
+                    readonly certificate: {
+                        readonly $ref: "#/$defs/Certificate";
+                        readonly description: "The access certificate, for an `eudi` identity that has one.";
+                    };
+                    readonly attestations: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Attestation";
+                        };
+                        readonly description: "What every request object carries in `verifier_info`, in the order it carries them. Empty when it carries none.";
+                    };
+                    readonly problems: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Problem";
+                        };
+                        readonly description: "What is wrong with this identity. Empty when nothing is.";
+                    };
+                    readonly installedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC OpenID4VP Verifier Identities List — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["identities", "problems"];
+                readonly properties: {
+                    readonly identities: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Identity";
+                        };
+                        readonly description: "Every verifier identity the community holds, by `id`. Empty when it holds none.";
+                    };
+                    readonly defaultIdentity: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "The identity the community is configured to use when a session names no client identifier prefix; null when none is configured, and the first usable identity is used.";
+                    };
+                    readonly problems: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Problem";
+                        };
+                        readonly description: "What is wrong with the community's verifier as a whole, rather than with one identity. Empty when nothing is.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map