@openvtc/trust-tasks 0.8.1 → 0.9.0

package/dist/policy/evaluate/0.2/payload.d.ts

@@ -134,16 +134,846 @@ export type Payload = PolicyEvaluatePayload;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/policy/evaluate/0.2#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = PolicyEvaluateResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/policy/evaluate/0.2";
+    readonly title: "Policy Evaluate — payload";
+    readonly description: "Dry-run a policy decision against a synthetic PolicyInput. Returns the policy decision plus a trace of which policy modules matched and which rules fired. Used by the policy-editor UI to verify changes before save and by admins to diagnose unexpected deny/allow outcomes.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["input"];
+    readonly properties: {
+        readonly input: {
+            readonly $ref: "#/$defs/PolicyInput";
+        };
+        readonly candidateModule: {
+            readonly type: "string";
+            readonly description: "Optional — when supplied, evaluate as if this Rego source were active (e.g. preview a pending upsert). The candidate is layered into the evaluator at the priority specified by `candidatePriority` (default 1000) for this call only.";
+        };
+        readonly candidatePriority: {
+            readonly type: "integer";
+            readonly minimum: 0;
+            readonly maximum: 1000;
+            readonly default: 1000;
+        };
+        readonly includeTrace: {
+            readonly type: "boolean";
+            readonly default: false;
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Policy Evaluate — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["decision"];
+            readonly properties: {
+                readonly decision: {
+                    readonly $ref: "#/$defs/PolicyDecision";
+                };
+                readonly matchedPolicies: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Ids (or `candidate` for the dry-run module) of the policies that returned a non-null decision, in evaluation order. The first is the winning policy.";
+                };
+                readonly trace: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly PolicyDecision: {
+            readonly title: "PolicyDecision";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["decision"];
+            readonly properties: {
+                readonly decision: {
+                    readonly type: "string";
+                    readonly enum: readonly ["allow", "deny", "requireStepUp"];
+                };
+                readonly mode: {
+                    readonly type: "string";
+                    readonly enum: readonly ["proxy", "fill"];
+                    readonly description: "When decision == \"allow\", whether the maintainer should proxy-login or release-for-fill. Default: proxy.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["method"];
+                    readonly properties: {
+                        readonly method: {
+                            readonly type: "string";
+                            readonly enum: readonly ["webauthnUv", "pushApproval", "totp"];
+                        };
+                        readonly ttlSeconds: {
+                            readonly type: "integer";
+                            readonly minimum: 1;
+                        };
+                    };
+                    readonly description: "When decision == \"require_step_up\", which method to demand.";
+                };
+                readonly ttlSecondsCap: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 86400;
+                    readonly description: "When decision == \"allow\", maximum lifetime of the issued session blob / released secret.";
+                };
+                readonly explanation: {
+                    readonly type: "string";
+                    readonly description: "Human-readable explanation for diagnostic display.";
+                };
+            };
+        };
+        readonly PolicyInput: {
+            readonly title: "PolicyInput";
+            readonly description: "The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["request", "site", "contextId", "consumer"];
+            readonly properties: {
+                readonly request: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly type: "string";
+                            readonly enum: readonly ["proxyLogin", "release", "stepUpResponse"];
+                        };
+                    };
+                };
+                readonly site: {
+                    readonly $ref: "#/$defs/SiteTarget";
+                };
+                readonly contextId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly consumer: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["did"];
+                    readonly properties: {
+                        readonly did: {
+                            readonly type: "string";
+                        };
+                        readonly kind: {
+                            readonly $ref: "#/$defs/ConsumerKind";
+                        };
+                        readonly deviceId: {
+                            readonly type: "string";
+                        };
+                        readonly lastUserVerificationAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                        };
+                        readonly networkClass: {
+                            readonly type: "string";
+                            readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                        };
+                    };
+                };
+            };
+        };
+        readonly ConsumerKind: {
+            readonly title: "ConsumerKind";
+            readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+            readonly oneOf: readonly [{
+                readonly title: "Companion";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "formFactor"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "companion";
+                    };
+                    readonly formFactor: {
+                        readonly type: "string";
+                        readonly enum: readonly ["browser", "mobile", "desktop"];
+                    };
+                };
+            }, {
+                readonly title: "Service";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "serviceKind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "service";
+                    };
+                    readonly serviceKind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["mediator", "aiAgent", "daemon"];
+                    };
+                };
+            }];
+        };
+        readonly SiteTarget: {
+            readonly title: "SiteTarget";
+            readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+            readonly oneOf: readonly [{
+                readonly title: "WebOrigin";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "origin"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webOrigin";
+                    };
+                    readonly origin: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                    };
+                };
+            }, {
+                readonly title: "Did";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "did"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "did";
+                    };
+                    readonly did: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                    };
+                };
+            }, {
+                readonly title: "IosApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "bundleId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "iosApp";
+                    };
+                    readonly bundleId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z0-9.-]+$";
+                        readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                    };
+                    readonly teamId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Z0-9]+$";
+                        readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                    };
+                };
+            }, {
+                readonly title: "AndroidApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "androidApp";
+                    };
+                    readonly packageName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                        readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                    };
+                    readonly sha256CertFingerprints: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                    };
+                };
+            }];
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Policy Evaluate — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["decision"];
+            readonly properties: {
+                readonly decision: {
+                    readonly $ref: "#/$defs/PolicyDecision";
+                };
+                readonly matchedPolicies: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Ids (or `candidate` for the dry-run module) of the policies that returned a non-null decision, in evaluation order. The first is the winning policy.";
+                };
+                readonly trace: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly PolicyDecision: {
+            readonly title: "PolicyDecision";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["decision"];
+            readonly properties: {
+                readonly decision: {
+                    readonly type: "string";
+                    readonly enum: readonly ["allow", "deny", "requireStepUp"];
+                };
+                readonly mode: {
+                    readonly type: "string";
+                    readonly enum: readonly ["proxy", "fill"];
+                    readonly description: "When decision == \"allow\", whether the maintainer should proxy-login or release-for-fill. Default: proxy.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["method"];
+                    readonly properties: {
+                        readonly method: {
+                            readonly type: "string";
+                            readonly enum: readonly ["webauthnUv", "pushApproval", "totp"];
+                        };
+                        readonly ttlSeconds: {
+                            readonly type: "integer";
+                            readonly minimum: 1;
+                        };
+                    };
+                    readonly description: "When decision == \"require_step_up\", which method to demand.";
+                };
+                readonly ttlSecondsCap: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 86400;
+                    readonly description: "When decision == \"allow\", maximum lifetime of the issued session blob / released secret.";
+                };
+                readonly explanation: {
+                    readonly type: "string";
+                    readonly description: "Human-readable explanation for diagnostic display.";
+                };
+            };
+        };
+        readonly PolicyInput: {
+            readonly title: "PolicyInput";
+            readonly description: "The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["request", "site", "contextId", "consumer"];
+            readonly properties: {
+                readonly request: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly type: "string";
+                            readonly enum: readonly ["proxyLogin", "release", "stepUpResponse"];
+                        };
+                    };
+                };
+                readonly site: {
+                    readonly $ref: "#/$defs/SiteTarget";
+                };
+                readonly contextId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly consumer: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["did"];
+                    readonly properties: {
+                        readonly did: {
+                            readonly type: "string";
+                        };
+                        readonly kind: {
+                            readonly $ref: "#/$defs/ConsumerKind";
+                        };
+                        readonly deviceId: {
+                            readonly type: "string";
+                        };
+                        readonly lastUserVerificationAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                        };
+                        readonly networkClass: {
+                            readonly type: "string";
+                            readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                        };
+                    };
+                };
+            };
+        };
+        readonly ConsumerKind: {
+            readonly title: "ConsumerKind";
+            readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+            readonly oneOf: readonly [{
+                readonly title: "Companion";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "formFactor"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "companion";
+                    };
+                    readonly formFactor: {
+                        readonly type: "string";
+                        readonly enum: readonly ["browser", "mobile", "desktop"];
+                    };
+                };
+            }, {
+                readonly title: "Service";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "serviceKind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "service";
+                    };
+                    readonly serviceKind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["mediator", "aiAgent", "daemon"];
+                    };
+                };
+            }];
+        };
+        readonly SiteTarget: {
+            readonly title: "SiteTarget";
+            readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+            readonly oneOf: readonly [{
+                readonly title: "WebOrigin";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "origin"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webOrigin";
+                    };
+                    readonly origin: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                    };
+                };
+            }, {
+                readonly title: "Did";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "did"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "did";
+                    };
+                    readonly did: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                    };
+                };
+            }, {
+                readonly title: "IosApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "bundleId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "iosApp";
+                    };
+                    readonly bundleId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z0-9.-]+$";
+                        readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                    };
+                    readonly teamId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Z0-9]+$";
+                        readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                    };
+                };
+            }, {
+                readonly title: "AndroidApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "androidApp";
+                    };
+                    readonly packageName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                        readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                    };
+                    readonly sha256CertFingerprints: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                    };
+                };
+            }];
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/policy/evaluate/0.2";
     readonly isBearer: false;
     readonly isProofRequired: false;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/policy/evaluate/0.2";
+        readonly title: "Policy Evaluate — payload";
+        readonly description: "Dry-run a policy decision against a synthetic PolicyInput. Returns the policy decision plus a trace of which policy modules matched and which rules fired. Used by the policy-editor UI to verify changes before save and by admins to diagnose unexpected deny/allow outcomes.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["input"];
+        readonly properties: {
+            readonly input: {
+                readonly $ref: "#/$defs/PolicyInput";
+            };
+            readonly candidateModule: {
+                readonly type: "string";
+                readonly description: "Optional — when supplied, evaluate as if this Rego source were active (e.g. preview a pending upsert). The candidate is layered into the evaluator at the priority specified by `candidatePriority` (default 1000) for this call only.";
+            };
+            readonly candidatePriority: {
+                readonly type: "integer";
+                readonly minimum: 0;
+                readonly maximum: 1000;
+                readonly default: 1000;
+            };
+            readonly includeTrace: {
+                readonly type: "boolean";
+                readonly default: false;
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Policy Evaluate — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["decision"];
+                readonly properties: {
+                    readonly decision: {
+                        readonly $ref: "#/$defs/PolicyDecision";
+                    };
+                    readonly matchedPolicies: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Ids (or `candidate` for the dry-run module) of the policies that returned a non-null decision, in evaluation order. The first is the winning policy.";
+                    };
+                    readonly trace: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly PolicyDecision: {
+                readonly title: "PolicyDecision";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["decision"];
+                readonly properties: {
+                    readonly decision: {
+                        readonly type: "string";
+                        readonly enum: readonly ["allow", "deny", "requireStepUp"];
+                    };
+                    readonly mode: {
+                        readonly type: "string";
+                        readonly enum: readonly ["proxy", "fill"];
+                        readonly description: "When decision == \"allow\", whether the maintainer should proxy-login or release-for-fill. Default: proxy.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["method"];
+                        readonly properties: {
+                            readonly method: {
+                                readonly type: "string";
+                                readonly enum: readonly ["webauthnUv", "pushApproval", "totp"];
+                            };
+                            readonly ttlSeconds: {
+                                readonly type: "integer";
+                                readonly minimum: 1;
+                            };
+                        };
+                        readonly description: "When decision == \"require_step_up\", which method to demand.";
+                    };
+                    readonly ttlSecondsCap: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 86400;
+                        readonly description: "When decision == \"allow\", maximum lifetime of the issued session blob / released secret.";
+                    };
+                    readonly explanation: {
+                        readonly type: "string";
+                        readonly description: "Human-readable explanation for diagnostic display.";
+                    };
+                };
+            };
+            readonly PolicyInput: {
+                readonly title: "PolicyInput";
+                readonly description: "The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["request", "site", "contextId", "consumer"];
+                readonly properties: {
+                    readonly request: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kind"];
+                        readonly properties: {
+                            readonly kind: {
+                                readonly type: "string";
+                                readonly enum: readonly ["proxyLogin", "release", "stepUpResponse"];
+                            };
+                        };
+                    };
+                    readonly site: {
+                        readonly $ref: "#/$defs/SiteTarget";
+                    };
+                    readonly contextId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly consumer: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["did"];
+                        readonly properties: {
+                            readonly did: {
+                                readonly type: "string";
+                            };
+                            readonly kind: {
+                                readonly $ref: "#/$defs/ConsumerKind";
+                            };
+                            readonly deviceId: {
+                                readonly type: "string";
+                            };
+                            readonly lastUserVerificationAt: {
+                                readonly type: "string";
+                                readonly format: "date-time";
+                            };
+                            readonly networkClass: {
+                                readonly type: "string";
+                                readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                            };
+                        };
+                    };
+                };
+            };
+            readonly ConsumerKind: {
+                readonly title: "ConsumerKind";
+                readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+                readonly oneOf: readonly [{
+                    readonly title: "Companion";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "formFactor"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "companion";
+                        };
+                        readonly formFactor: {
+                            readonly type: "string";
+                            readonly enum: readonly ["browser", "mobile", "desktop"];
+                        };
+                    };
+                }, {
+                    readonly title: "Service";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "serviceKind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "service";
+                        };
+                        readonly serviceKind: {
+                            readonly type: "string";
+                            readonly enum: readonly ["mediator", "aiAgent", "daemon"];
+                        };
+                    };
+                }];
+            };
+            readonly SiteTarget: {
+                readonly title: "SiteTarget";
+                readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebOrigin";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "origin"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webOrigin";
+                        };
+                        readonly origin: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                            readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                        };
+                    };
+                }, {
+                    readonly title: "Did";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "did"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "did";
+                        };
+                        readonly did: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                        };
+                    };
+                }, {
+                    readonly title: "IosApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "bundleId"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "iosApp";
+                        };
+                        readonly bundleId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z0-9.-]+$";
+                            readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                        };
+                        readonly teamId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Z0-9]+$";
+                            readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                        };
+                    };
+                }, {
+                    readonly title: "AndroidApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "androidApp";
+                        };
+                        readonly packageName: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                            readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                        };
+                        readonly sha256CertFingerprints: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                            };
+                            readonly uniqueItems: true;
+                            readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                        };
+                    };
+                }];
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -155,5 +985,260 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: false;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Policy Evaluate — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["decision"];
+                readonly properties: {
+                    readonly decision: {
+                        readonly $ref: "#/$defs/PolicyDecision";
+                    };
+                    readonly matchedPolicies: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Ids (or `candidate` for the dry-run module) of the policies that returned a non-null decision, in evaluation order. The first is the winning policy.";
+                    };
+                    readonly trace: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly PolicyDecision: {
+                readonly title: "PolicyDecision";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["decision"];
+                readonly properties: {
+                    readonly decision: {
+                        readonly type: "string";
+                        readonly enum: readonly ["allow", "deny", "requireStepUp"];
+                    };
+                    readonly mode: {
+                        readonly type: "string";
+                        readonly enum: readonly ["proxy", "fill"];
+                        readonly description: "When decision == \"allow\", whether the maintainer should proxy-login or release-for-fill. Default: proxy.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["method"];
+                        readonly properties: {
+                            readonly method: {
+                                readonly type: "string";
+                                readonly enum: readonly ["webauthnUv", "pushApproval", "totp"];
+                            };
+                            readonly ttlSeconds: {
+                                readonly type: "integer";
+                                readonly minimum: 1;
+                            };
+                        };
+                        readonly description: "When decision == \"require_step_up\", which method to demand.";
+                    };
+                    readonly ttlSecondsCap: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 86400;
+                        readonly description: "When decision == \"allow\", maximum lifetime of the issued session blob / released secret.";
+                    };
+                    readonly explanation: {
+                        readonly type: "string";
+                        readonly description: "Human-readable explanation for diagnostic display.";
+                    };
+                };
+            };
+            readonly PolicyInput: {
+                readonly title: "PolicyInput";
+                readonly description: "The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["request", "site", "contextId", "consumer"];
+                readonly properties: {
+                    readonly request: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kind"];
+                        readonly properties: {
+                            readonly kind: {
+                                readonly type: "string";
+                                readonly enum: readonly ["proxyLogin", "release", "stepUpResponse"];
+                            };
+                        };
+                    };
+                    readonly site: {
+                        readonly $ref: "#/$defs/SiteTarget";
+                    };
+                    readonly contextId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly consumer: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["did"];
+                        readonly properties: {
+                            readonly did: {
+                                readonly type: "string";
+                            };
+                            readonly kind: {
+                                readonly $ref: "#/$defs/ConsumerKind";
+                            };
+                            readonly deviceId: {
+                                readonly type: "string";
+                            };
+                            readonly lastUserVerificationAt: {
+                                readonly type: "string";
+                                readonly format: "date-time";
+                            };
+                            readonly networkClass: {
+                                readonly type: "string";
+                                readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                            };
+                        };
+                    };
+                };
+            };
+            readonly ConsumerKind: {
+                readonly title: "ConsumerKind";
+                readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+                readonly oneOf: readonly [{
+                    readonly title: "Companion";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "formFactor"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "companion";
+                        };
+                        readonly formFactor: {
+                            readonly type: "string";
+                            readonly enum: readonly ["browser", "mobile", "desktop"];
+                        };
+                    };
+                }, {
+                    readonly title: "Service";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "serviceKind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "service";
+                        };
+                        readonly serviceKind: {
+                            readonly type: "string";
+                            readonly enum: readonly ["mediator", "aiAgent", "daemon"];
+                        };
+                    };
+                }];
+            };
+            readonly SiteTarget: {
+                readonly title: "SiteTarget";
+                readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebOrigin";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "origin"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webOrigin";
+                        };
+                        readonly origin: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                            readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                        };
+                    };
+                }, {
+                    readonly title: "Did";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "did"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "did";
+                        };
+                        readonly did: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                        };
+                    };
+                }, {
+                    readonly title: "IosApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "bundleId"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "iosApp";
+                        };
+                        readonly bundleId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z0-9.-]+$";
+                            readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                        };
+                        readonly teamId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Z0-9]+$";
+                            readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                        };
+                    };
+                }, {
+                    readonly title: "AndroidApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "androidApp";
+                        };
+                        readonly packageName: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                            readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                        };
+                        readonly sha256CertFingerprints: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                            };
+                            readonly uniqueItems: true;
+                            readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                        };
+                    };
+                }];
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map