@openvtc/trust-tasks 0.28.20 → 0.28.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -11,6 +11,46 @@ The package versions over **its own API** — what a consumer compiles against
11
11
  not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
12
12
  component.
13
13
 
14
+ ## 0.28.21 — 2026-11-08
15
+
16
+
17
+ ### Added
18
+
19
+ - **vtc/badges**: Show answers the caller's own awards (myAwards), so a holder can share one (#1057)
20
+
21
+ * feat(vtc/badges): show answers the caller's own awards (myAwards), so a holder can share one
22
+
23
+ vtc/badges/awards/share and unshare (#1054) name an award, but no read answered a holder their own accepted award identifiers for a community badge: mine/list carries badges, show only myCount. vtc/badges/show/0.1#response gains the optional myAwards - the caller's own accepted awards of the badge, newest first, each with its shared - and conformance item 4 says so. Additive, on a draft.
24
+
25
+ - **auth/step-up**: Requests/show — the subject's wallet fetches a step-up refused to a delegated producer (auth/step-up/requests/show/0.1) (#1056)
26
+
27
+ A relying party that refuses an operation until its subject steps up carries
28
+ the request inline in the refusal (approve-request/0.5, Inline delivery). That
29
+ only works when the producer of the operation can gather the evidence itself.
30
+ A process acting with a key the subject delegated to it — an assistant, an
31
+ automation — can redeem a recorded step-up but never make one. It cannot
32
+ forward the inline request to the subject's wallet either, because the inline
33
+ request carries no proof.
34
+
35
+ This adds a hand-off by reference. Beside the inline request, the relying
36
+ party MAY carry `details.stepUpHandoff` (`$defs.Handoff`): a single-use handle
37
+ of at least 128 bits, its expiry and this task's Type URI. The person's
38
+ approver agent sends the handle and receives two things:
39
+
40
+ - the relying party's own signed approve-request/0.5, addressed to the
41
+ subject, with the same challenge and binding as the inline request;
42
+ - the operation the step-up is bound to, exactly as received.
43
+
44
+ The agent verifies the proof and shows the operation itself. It recomputes the
45
+ binding where it knows the construction. It then answers with approve-response
46
+ 0.7, signed by the subject's own DID, directly to the relying party. The
47
+ producer resends the identical operation, and the recorded step-up is redeemed.
48
+
49
+ A handle is answered at most once, atomically. Unknown, spent, expired and
50
+ settled handles all return `notFound`. Reading a handle is never part of an
51
+ approval, so a party that sees the handle can spend the read but cannot
52
+ approve.
53
+
14
54
  ## 0.28.20 — 2026-11-07
15
55
 
16
56
 
@@ -0,0 +1,458 @@
1
+ /**
2
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
3
+ * Source: specs/auth/step-up/requests/show/0.1/payload.schema.json
4
+ */
5
+ import type { Ext } from "../../../../../_shared/components.js";
6
+ /**
7
+ * A single-use reference to one pending step-up, minted by the relying party with at least 128 bits of entropy and carried as base64url without padding. It names the request; it is not the request's challenge, and knowing it authorizes nothing but this one read.
8
+ */
9
+ export type Handle = string;
10
+ /**
11
+ * The approver's agent asks the relying party for a pending step-up bound to one operation, named by the hand-off handle the relying party gave the operation's producer. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
12
+ */
13
+ export interface AuthStepUpRequestShowPayload {
14
+ handle: Handle;
15
+ ext?: Ext;
16
+ }
17
+ /**
18
+ * The pending step-up and the operation it is bound to. Failures use trust-task-error, not this shape.
19
+ */
20
+ export interface AuthStepUpRequestShowResponsePayload {
21
+ /**
22
+ * A complete auth/step-up/approve-request/0.5 Trust Task document, issued and signed by the relying party, whose recipient is the step-up's subject and whose payload is the request the operation's producer received inline — the same challenge, boundTo, accepts and approvers. The agent verifies it as a document in its own right — envelope, proof and payload against that specification's schema — over the members exactly as received: its proof covers every member, so it is deliberately an open object here rather than a typed one a binding could narrow.
23
+ */
24
+ request: {};
25
+ operation: Operation;
26
+ ext?: Ext;
27
+ }
28
+ /**
29
+ * The operation the step-up is bound to, exactly as the relying party received it.
30
+ */
31
+ export interface Operation {
32
+ /**
33
+ * The operation's Type URI, as the document the relying party refused named it.
34
+ */
35
+ type: string;
36
+ /**
37
+ * The operation's payload, member for member as received, so that the approver's agent can show it and — where it knows how the relying party derives `boundTo` — recompute the binding.
38
+ */
39
+ payload: {};
40
+ }
41
+ /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
42
+ export type { Ext };
43
+ /** Trust Task type URI. */
44
+ export declare const TYPE_URI: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
45
+ /**
46
+ * The earlier version of this specification that this one declares it
47
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
48
+ * `null`. Only the direct declaration — follow the chain with
49
+ * `extendsChain` / `readForSpec`.
50
+ */
51
+ export declare const EXTENDS: string | null;
52
+ /**
53
+ * Why this version is deprecated, or `null` while it is current. A
54
+ * superseded or retired version is still supported, and is withdrawn from
55
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
56
+ * Versions").
57
+ */
58
+ export declare const DEPRECATION: string | null;
59
+ /** Stable alias for this specification's request payload shape. */
60
+ export type Payload = AuthStepUpRequestShowPayload;
61
+ /** Trust Task response type URI (request type URI + "#response"). */
62
+ export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1#response";
63
+ /** Stable alias for this specification's success-response payload shape. */
64
+ export type Response = AuthStepUpRequestShowResponsePayload;
65
+ /**
66
+ * This specification's payload schema, as a value.
67
+ *
68
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
69
+ * rather than only as a `.json` file because TypeScript types are erased
70
+ * at runtime: without a schema a consumer has nothing to validate, and
71
+ * every REQUIRED payload member is optional in practice. Cross-file
72
+ * `$ref`s are already inlined, so it needs no resolver.
73
+ */
74
+ export declare const PAYLOAD_SCHEMA: {
75
+ readonly $schema: "https://json-schema.org/draft/2020-12/schema";
76
+ readonly $id: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
77
+ readonly title: "Auth — Step-up Request Show — payload";
78
+ readonly description: "The approver's agent asks the relying party for a pending step-up bound to one operation, named by the hand-off handle the relying party gave the operation's producer. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
79
+ readonly type: "object";
80
+ readonly additionalProperties: false;
81
+ readonly required: readonly ["handle"];
82
+ readonly properties: {
83
+ readonly handle: {
84
+ readonly $ref: "#/$defs/Handle";
85
+ };
86
+ readonly ext: {
87
+ readonly $ref: "#/$defs/Ext";
88
+ };
89
+ };
90
+ readonly $defs: {
91
+ readonly Handle: {
92
+ readonly title: "Handle";
93
+ readonly description: "A single-use reference to one pending step-up, minted by the relying party with at least 128 bits of entropy and carried as base64url without padding. It names the request; it is not the request's challenge, and knowing it authorizes nothing but this one read.";
94
+ readonly type: "string";
95
+ readonly pattern: "^[A-Za-z0-9_-]{22,86}$";
96
+ };
97
+ readonly Handoff: {
98
+ readonly title: "Handoff";
99
+ readonly description: "What a relying party MAY carry as `details.stepUpHandoff` beside an inline `details.stepUpRequest` (auth/step-up/approve-request/0.5, Inline delivery), so that a producer which cannot obtain the evidence itself can hand the step-up to the subject's approver agent. Not a payload of this task: defined here so producers and consumers share one shape.";
100
+ readonly type: "object";
101
+ readonly additionalProperties: false;
102
+ readonly required: readonly ["handle", "expiresAt", "show"];
103
+ readonly properties: {
104
+ readonly handle: {
105
+ readonly $ref: "#/$defs/Handle";
106
+ };
107
+ readonly expiresAt: {
108
+ readonly type: "string";
109
+ readonly format: "date-time";
110
+ readonly description: "The instant after which the relying party answers the handle with `notFound`: no later than the pending step-up's own expiry.";
111
+ };
112
+ readonly show: {
113
+ readonly type: "string";
114
+ readonly const: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
115
+ readonly description: "The Type URI the approver's agent sends with the handle.";
116
+ };
117
+ };
118
+ };
119
+ readonly Operation: {
120
+ readonly title: "Operation";
121
+ readonly description: "The operation the step-up is bound to, exactly as the relying party received it.";
122
+ readonly type: "object";
123
+ readonly additionalProperties: false;
124
+ readonly required: readonly ["type", "payload"];
125
+ readonly properties: {
126
+ readonly type: {
127
+ readonly type: "string";
128
+ readonly minLength: 1;
129
+ readonly maxLength: 2048;
130
+ readonly description: "The operation's Type URI, as the document the relying party refused named it.";
131
+ };
132
+ readonly payload: {
133
+ readonly type: "object";
134
+ readonly description: "The operation's payload, member for member as received, so that the approver's agent can show it and — where it knows how the relying party derives `boundTo` — recompute the binding.";
135
+ };
136
+ };
137
+ };
138
+ readonly Response: {
139
+ readonly $anchor: "response";
140
+ readonly title: "Auth — Step-up Request Show — response payload";
141
+ readonly type: "object";
142
+ readonly additionalProperties: false;
143
+ readonly required: readonly ["request", "operation"];
144
+ readonly description: "The pending step-up and the operation it is bound to. Failures use trust-task-error, not this shape.";
145
+ readonly properties: {
146
+ readonly request: {
147
+ readonly type: "object";
148
+ readonly description: "A complete auth/step-up/approve-request/0.5 Trust Task document, issued and signed by the relying party, whose recipient is the step-up's subject and whose payload is the request the operation's producer received inline — the same challenge, boundTo, accepts and approvers. The agent verifies it as a document in its own right — envelope, proof and payload against that specification's schema — over the members exactly as received: its proof covers every member, so it is deliberately an open object here rather than a typed one a binding could narrow.";
149
+ };
150
+ readonly operation: {
151
+ readonly $ref: "#/$defs/Operation";
152
+ };
153
+ readonly ext: {
154
+ readonly $ref: "#/$defs/Ext";
155
+ };
156
+ };
157
+ };
158
+ readonly Ext: {
159
+ readonly title: "Ext";
160
+ readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
161
+ readonly type: "object";
162
+ readonly minProperties: 1;
163
+ readonly additionalProperties: true;
164
+ readonly propertyNames: {
165
+ readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
166
+ };
167
+ };
168
+ };
169
+ };
170
+ /** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
171
+ export declare const RESPONSE_PAYLOAD_SCHEMA: {
172
+ readonly $schema: "https://json-schema.org/draft/2020-12/schema";
173
+ readonly $ref: "#/$defs/Response";
174
+ readonly $defs: {
175
+ readonly Handle: {
176
+ readonly title: "Handle";
177
+ readonly description: "A single-use reference to one pending step-up, minted by the relying party with at least 128 bits of entropy and carried as base64url without padding. It names the request; it is not the request's challenge, and knowing it authorizes nothing but this one read.";
178
+ readonly type: "string";
179
+ readonly pattern: "^[A-Za-z0-9_-]{22,86}$";
180
+ };
181
+ readonly Handoff: {
182
+ readonly title: "Handoff";
183
+ readonly description: "What a relying party MAY carry as `details.stepUpHandoff` beside an inline `details.stepUpRequest` (auth/step-up/approve-request/0.5, Inline delivery), so that a producer which cannot obtain the evidence itself can hand the step-up to the subject's approver agent. Not a payload of this task: defined here so producers and consumers share one shape.";
184
+ readonly type: "object";
185
+ readonly additionalProperties: false;
186
+ readonly required: readonly ["handle", "expiresAt", "show"];
187
+ readonly properties: {
188
+ readonly handle: {
189
+ readonly $ref: "#/$defs/Handle";
190
+ };
191
+ readonly expiresAt: {
192
+ readonly type: "string";
193
+ readonly format: "date-time";
194
+ readonly description: "The instant after which the relying party answers the handle with `notFound`: no later than the pending step-up's own expiry.";
195
+ };
196
+ readonly show: {
197
+ readonly type: "string";
198
+ readonly const: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
199
+ readonly description: "The Type URI the approver's agent sends with the handle.";
200
+ };
201
+ };
202
+ };
203
+ readonly Operation: {
204
+ readonly title: "Operation";
205
+ readonly description: "The operation the step-up is bound to, exactly as the relying party received it.";
206
+ readonly type: "object";
207
+ readonly additionalProperties: false;
208
+ readonly required: readonly ["type", "payload"];
209
+ readonly properties: {
210
+ readonly type: {
211
+ readonly type: "string";
212
+ readonly minLength: 1;
213
+ readonly maxLength: 2048;
214
+ readonly description: "The operation's Type URI, as the document the relying party refused named it.";
215
+ };
216
+ readonly payload: {
217
+ readonly type: "object";
218
+ readonly description: "The operation's payload, member for member as received, so that the approver's agent can show it and — where it knows how the relying party derives `boundTo` — recompute the binding.";
219
+ };
220
+ };
221
+ };
222
+ readonly Response: {
223
+ readonly $anchor: "response";
224
+ readonly title: "Auth — Step-up Request Show — response payload";
225
+ readonly type: "object";
226
+ readonly additionalProperties: false;
227
+ readonly required: readonly ["request", "operation"];
228
+ readonly description: "The pending step-up and the operation it is bound to. Failures use trust-task-error, not this shape.";
229
+ readonly properties: {
230
+ readonly request: {
231
+ readonly type: "object";
232
+ readonly description: "A complete auth/step-up/approve-request/0.5 Trust Task document, issued and signed by the relying party, whose recipient is the step-up's subject and whose payload is the request the operation's producer received inline — the same challenge, boundTo, accepts and approvers. The agent verifies it as a document in its own right — envelope, proof and payload against that specification's schema — over the members exactly as received: its proof covers every member, so it is deliberately an open object here rather than a typed one a binding could narrow.";
233
+ };
234
+ readonly operation: {
235
+ readonly $ref: "#/$defs/Operation";
236
+ };
237
+ readonly ext: {
238
+ readonly $ref: "#/$defs/Ext";
239
+ };
240
+ };
241
+ };
242
+ readonly Ext: {
243
+ readonly title: "Ext";
244
+ readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
245
+ readonly type: "object";
246
+ readonly minProperties: 1;
247
+ readonly additionalProperties: true;
248
+ readonly propertyNames: {
249
+ readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
250
+ };
251
+ };
252
+ };
253
+ };
254
+ /**
255
+ * SPEC.md §7.2 policy for the request variant, from this specification's
256
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
257
+ * per-specification and cannot be derived from the document alone, and
258
+ * item 2 needs the schema this carries.
259
+ */
260
+ export declare const SPEC: {
261
+ readonly typeUri: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
262
+ readonly isBearer: false;
263
+ readonly isProofRequired: true;
264
+ readonly isRecipientRequired: true;
265
+ readonly isIssuedAtRequired: true;
266
+ readonly payloadSchema: {
267
+ readonly $schema: "https://json-schema.org/draft/2020-12/schema";
268
+ readonly $id: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
269
+ readonly title: "Auth — Step-up Request Show — payload";
270
+ readonly description: "The approver's agent asks the relying party for a pending step-up bound to one operation, named by the hand-off handle the relying party gave the operation's producer. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
271
+ readonly type: "object";
272
+ readonly additionalProperties: false;
273
+ readonly required: readonly ["handle"];
274
+ readonly properties: {
275
+ readonly handle: {
276
+ readonly $ref: "#/$defs/Handle";
277
+ };
278
+ readonly ext: {
279
+ readonly $ref: "#/$defs/Ext";
280
+ };
281
+ };
282
+ readonly $defs: {
283
+ readonly Handle: {
284
+ readonly title: "Handle";
285
+ readonly description: "A single-use reference to one pending step-up, minted by the relying party with at least 128 bits of entropy and carried as base64url without padding. It names the request; it is not the request's challenge, and knowing it authorizes nothing but this one read.";
286
+ readonly type: "string";
287
+ readonly pattern: "^[A-Za-z0-9_-]{22,86}$";
288
+ };
289
+ readonly Handoff: {
290
+ readonly title: "Handoff";
291
+ readonly description: "What a relying party MAY carry as `details.stepUpHandoff` beside an inline `details.stepUpRequest` (auth/step-up/approve-request/0.5, Inline delivery), so that a producer which cannot obtain the evidence itself can hand the step-up to the subject's approver agent. Not a payload of this task: defined here so producers and consumers share one shape.";
292
+ readonly type: "object";
293
+ readonly additionalProperties: false;
294
+ readonly required: readonly ["handle", "expiresAt", "show"];
295
+ readonly properties: {
296
+ readonly handle: {
297
+ readonly $ref: "#/$defs/Handle";
298
+ };
299
+ readonly expiresAt: {
300
+ readonly type: "string";
301
+ readonly format: "date-time";
302
+ readonly description: "The instant after which the relying party answers the handle with `notFound`: no later than the pending step-up's own expiry.";
303
+ };
304
+ readonly show: {
305
+ readonly type: "string";
306
+ readonly const: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
307
+ readonly description: "The Type URI the approver's agent sends with the handle.";
308
+ };
309
+ };
310
+ };
311
+ readonly Operation: {
312
+ readonly title: "Operation";
313
+ readonly description: "The operation the step-up is bound to, exactly as the relying party received it.";
314
+ readonly type: "object";
315
+ readonly additionalProperties: false;
316
+ readonly required: readonly ["type", "payload"];
317
+ readonly properties: {
318
+ readonly type: {
319
+ readonly type: "string";
320
+ readonly minLength: 1;
321
+ readonly maxLength: 2048;
322
+ readonly description: "The operation's Type URI, as the document the relying party refused named it.";
323
+ };
324
+ readonly payload: {
325
+ readonly type: "object";
326
+ readonly description: "The operation's payload, member for member as received, so that the approver's agent can show it and — where it knows how the relying party derives `boundTo` — recompute the binding.";
327
+ };
328
+ };
329
+ };
330
+ readonly Response: {
331
+ readonly $anchor: "response";
332
+ readonly title: "Auth — Step-up Request Show — response payload";
333
+ readonly type: "object";
334
+ readonly additionalProperties: false;
335
+ readonly required: readonly ["request", "operation"];
336
+ readonly description: "The pending step-up and the operation it is bound to. Failures use trust-task-error, not this shape.";
337
+ readonly properties: {
338
+ readonly request: {
339
+ readonly type: "object";
340
+ readonly description: "A complete auth/step-up/approve-request/0.5 Trust Task document, issued and signed by the relying party, whose recipient is the step-up's subject and whose payload is the request the operation's producer received inline — the same challenge, boundTo, accepts and approvers. The agent verifies it as a document in its own right — envelope, proof and payload against that specification's schema — over the members exactly as received: its proof covers every member, so it is deliberately an open object here rather than a typed one a binding could narrow.";
341
+ };
342
+ readonly operation: {
343
+ readonly $ref: "#/$defs/Operation";
344
+ };
345
+ readonly ext: {
346
+ readonly $ref: "#/$defs/Ext";
347
+ };
348
+ };
349
+ };
350
+ readonly Ext: {
351
+ readonly title: "Ext";
352
+ readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
353
+ readonly type: "object";
354
+ readonly minProperties: 1;
355
+ readonly additionalProperties: true;
356
+ readonly propertyNames: {
357
+ readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
358
+ };
359
+ };
360
+ };
361
+ };
362
+ };
363
+ /**
364
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
365
+ * tracks the *issuer* party's requirement because a response swaps the
366
+ * parties (§7.3 item 5).
367
+ */
368
+ export declare const RESPONSE_SPEC: {
369
+ readonly typeUri: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1#response";
370
+ readonly isBearer: false;
371
+ readonly isProofRequired: true;
372
+ readonly isRecipientRequired: true;
373
+ readonly isIssuedAtRequired: true;
374
+ readonly payloadSchema: {
375
+ readonly $schema: "https://json-schema.org/draft/2020-12/schema";
376
+ readonly $ref: "#/$defs/Response";
377
+ readonly $defs: {
378
+ readonly Handle: {
379
+ readonly title: "Handle";
380
+ readonly description: "A single-use reference to one pending step-up, minted by the relying party with at least 128 bits of entropy and carried as base64url without padding. It names the request; it is not the request's challenge, and knowing it authorizes nothing but this one read.";
381
+ readonly type: "string";
382
+ readonly pattern: "^[A-Za-z0-9_-]{22,86}$";
383
+ };
384
+ readonly Handoff: {
385
+ readonly title: "Handoff";
386
+ readonly description: "What a relying party MAY carry as `details.stepUpHandoff` beside an inline `details.stepUpRequest` (auth/step-up/approve-request/0.5, Inline delivery), so that a producer which cannot obtain the evidence itself can hand the step-up to the subject's approver agent. Not a payload of this task: defined here so producers and consumers share one shape.";
387
+ readonly type: "object";
388
+ readonly additionalProperties: false;
389
+ readonly required: readonly ["handle", "expiresAt", "show"];
390
+ readonly properties: {
391
+ readonly handle: {
392
+ readonly $ref: "#/$defs/Handle";
393
+ };
394
+ readonly expiresAt: {
395
+ readonly type: "string";
396
+ readonly format: "date-time";
397
+ readonly description: "The instant after which the relying party answers the handle with `notFound`: no later than the pending step-up's own expiry.";
398
+ };
399
+ readonly show: {
400
+ readonly type: "string";
401
+ readonly const: "https://trusttasks.org/spec/auth/step-up/requests/show/0.1";
402
+ readonly description: "The Type URI the approver's agent sends with the handle.";
403
+ };
404
+ };
405
+ };
406
+ readonly Operation: {
407
+ readonly title: "Operation";
408
+ readonly description: "The operation the step-up is bound to, exactly as the relying party received it.";
409
+ readonly type: "object";
410
+ readonly additionalProperties: false;
411
+ readonly required: readonly ["type", "payload"];
412
+ readonly properties: {
413
+ readonly type: {
414
+ readonly type: "string";
415
+ readonly minLength: 1;
416
+ readonly maxLength: 2048;
417
+ readonly description: "The operation's Type URI, as the document the relying party refused named it.";
418
+ };
419
+ readonly payload: {
420
+ readonly type: "object";
421
+ readonly description: "The operation's payload, member for member as received, so that the approver's agent can show it and — where it knows how the relying party derives `boundTo` — recompute the binding.";
422
+ };
423
+ };
424
+ };
425
+ readonly Response: {
426
+ readonly $anchor: "response";
427
+ readonly title: "Auth — Step-up Request Show — response payload";
428
+ readonly type: "object";
429
+ readonly additionalProperties: false;
430
+ readonly required: readonly ["request", "operation"];
431
+ readonly description: "The pending step-up and the operation it is bound to. Failures use trust-task-error, not this shape.";
432
+ readonly properties: {
433
+ readonly request: {
434
+ readonly type: "object";
435
+ readonly description: "A complete auth/step-up/approve-request/0.5 Trust Task document, issued and signed by the relying party, whose recipient is the step-up's subject and whose payload is the request the operation's producer received inline — the same challenge, boundTo, accepts and approvers. The agent verifies it as a document in its own right — envelope, proof and payload against that specification's schema — over the members exactly as received: its proof covers every member, so it is deliberately an open object here rather than a typed one a binding could narrow.";
436
+ };
437
+ readonly operation: {
438
+ readonly $ref: "#/$defs/Operation";
439
+ };
440
+ readonly ext: {
441
+ readonly $ref: "#/$defs/Ext";
442
+ };
443
+ };
444
+ };
445
+ readonly Ext: {
446
+ readonly title: "Ext";
447
+ readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
448
+ readonly type: "object";
449
+ readonly minProperties: 1;
450
+ readonly additionalProperties: true;
451
+ readonly propertyNames: {
452
+ readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
453
+ };
454
+ };
455
+ };
456
+ };
457
+ };
458
+ //# sourceMappingURL=payload.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/auth/step-up/requests/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sCAAsC,CAAC;AAGhE;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC;AAE5B;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,oCAAoC;IACnD;;OAEG;IACH,OAAO,EAAE,EAAE,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,EAAE,CAAC;CACb;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,CAAC;AAEpB,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F;;;;;GAKG;AACH,eAAO,MAAM,OAAO,EAAE,MAAM,GAAG,IAAW,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,GAAG,IAAW,CAAC;AAE/C,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAEnD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC;AAEhH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2GjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4F1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}