@openvtc/trust-tasks 0.8.1 → 0.9.0

package/dist/auth/step-up/approve-response/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/step-up/approve-response/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,CAAC;CACpB;AACD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,mCAAmC,CAAC;CAChD;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,wCAAwC;IACvD,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,+DAAwE,CAAC;AAEjG,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,wEAAiF,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,wCAAwC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/step-up/approve-response/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAC;IAChC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,CAAC;CACpB;AACD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,mCAAmC,CAAC;CAChD;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,wCAAwC;IACvD,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,+DAAwE,CAAC;AAEjG,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,wEAAiF,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,wCAAwC,CAAC;AAEhE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqPjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmM1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMhB,CAAC"}

package/dist/auth/step-up/approve-response/0.1/payload.js

@@ -6,16 +6,470 @@
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.1";
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/auth/step-up/approve-response/0.1",
+    "title": "Auth — Step-up Approve Response",
+    "description": "The approver's signed ratification of a step-up: subject + sessionId + challenge are echoed inside a proof-bearing document so the relying party can elevate the session.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "subject",
+        "sessionId",
+        "challenge",
+        "decision"
+    ],
+    "properties": {
+        "subject": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Echoed from the matching approve-request. The relying party verifies it equals the session's subject."
+        },
+        "sessionId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Echoed from the matching approve-request. The relying party uses it to locate the session to elevate."
+        },
+        "challenge": {
+            "type": "string",
+            "minLength": 16,
+            "description": "Echoed from the matching approve-request. The relying party verifies it equals the bound challenge."
+        },
+        "decision": {
+            "type": "string",
+            "enum": [
+                "approved",
+                "denied"
+            ],
+            "description": "`approved` elevates the session per the relying party's policy. `denied` is a signed refusal — useful for audit even though it elevates nothing."
+        },
+        "deniedReason": {
+            "type": "string",
+            "description": "Required when decision is `denied`. Human-readable rationale the user provided (or which the approver inferred)."
+        },
+        "grantedAcr": {
+            "type": "string",
+            "description": "The acr the approver believes it has cryptographically demonstrated. The relying party MAY accept this, MAY upgrade to a lower value, but MUST NOT exceed it."
+        },
+        "evidence": {
+            "$ref": "#/$defs/Evidence",
+            "description": "How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Evidence": {
+            "$anchor": "evidence",
+            "title": "Step-up Evidence",
+            "description": "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).",
+            "oneOf": [
+                {
+                    "title": "DidSigned",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "did-signed"
+                        }
+                    },
+                    "description": "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\"."
+                },
+                {
+                    "title": "WebAuthn",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "assertion"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "webauthn"
+                        },
+                        "assertion": {
+                            "$ref": "#/$defs/AssertionResponse",
+                            "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\"."
+                        }
+                    }
+                }
+            ]
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth Step-up Approve Response — relying party ack",
+            "description": "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "status"
+            ],
+            "properties": {
+                "status": {
+                    "type": "string",
+                    "enum": [
+                        "elevated",
+                        "rejected"
+                    ]
+                },
+                "session": {
+                    "$ref": "#/$defs/Session",
+                    "description": "Present when status is `elevated`. The session's updated amr/acr after the approval was applied."
+                },
+                "reason": {
+                    "type": "string",
+                    "description": "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\")."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "Session": {
+            "$anchor": "session",
+            "title": "Session",
+            "description": "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "subject",
+                "issuedAt",
+                "expiresAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied."
+                },
+                "subject": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The authenticated party's VID (typically a DID URL)."
+                },
+                "issuedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "ISO-8601 timestamp when the session was created."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after."
+                },
+                "amr": {
+                    "type": "array",
+                    "minItems": 1,
+                    "items": {
+                        "type": "string",
+                        "minLength": 1
+                    },
+                    "description": "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used."
+                },
+                "acr": {
+                    "type": "string",
+                    "description": "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor)."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext",
+                    "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+                }
+            }
+        },
+        "AssertionResponse": {
+            "$anchor": "assertionResponse",
+            "title": "AuthenticatorAssertionResponse (login)",
+            "description": "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "rawId",
+                "type",
+                "response"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string"
+                },
+                "rawId": {
+                    "type": "string"
+                },
+                "type": {
+                    "const": "public-key"
+                },
+                "response": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "clientDataJSON",
+                        "authenticatorData",
+                        "signature"
+                    ],
+                    "properties": {
+                        "clientDataJSON": {
+                            "type": "string"
+                        },
+                        "authenticatorData": {
+                            "type": "string"
+                        },
+                        "signature": {
+                            "type": "string"
+                        },
+                        "userHandle": {
+                            "type": [
+                                "string",
+                                "null"
+                            ]
+                        }
+                    }
+                },
+                "authenticatorAttachment": {
+                    "enum": [
+                        "platform",
+                        "cross-platform"
+                    ]
+                },
+                "clientExtensionResults": {
+                    "type": "object"
+                }
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Evidence": {
+            "$anchor": "evidence",
+            "title": "Step-up Evidence",
+            "description": "Tagged union over `kind` describing the cryptographic factor the approver presents to back the elevation. Pluggable so new factor kinds can be added without disturbing existing consumers (SPEC §4.5.1 ext rules apply to unknown kinds at the producer's discretion).",
+            "oneOf": [
+                {
+                    "title": "DidSigned",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "did-signed"
+                        }
+                    },
+                    "description": "The elevation is gated by the document's framework `proof` — a Data Integrity signature from a key the subject controls (SPEC §4.7). This is the default when `evidence` is omitted. `amr` reflects \"vta\"/\"did\"."
+                },
+                {
+                    "title": "WebAuthn",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "assertion"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "webauthn"
+                        },
+                        "assertion": {
+                            "$ref": "#/$defs/AssertionResponse",
+                            "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects \"passkey\"."
+                        }
+                    }
+                }
+            ]
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth Step-up Approve Response — relying party ack",
+            "description": "Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "status"
+            ],
+            "properties": {
+                "status": {
+                    "type": "string",
+                    "enum": [
+                        "elevated",
+                        "rejected"
+                    ]
+                },
+                "session": {
+                    "$ref": "#/$defs/Session",
+                    "description": "Present when status is `elevated`. The session's updated amr/acr after the approval was applied."
+                },
+                "reason": {
+                    "type": "string",
+                    "description": "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\")."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "Session": {
+            "$anchor": "session",
+            "title": "Session",
+            "description": "A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "subject",
+                "issuedAt",
+                "expiresAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied."
+                },
+                "subject": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The authenticated party's VID (typically a DID URL)."
+                },
+                "issuedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "ISO-8601 timestamp when the session was created."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after."
+                },
+                "amr": {
+                    "type": "array",
+                    "minItems": 1,
+                    "items": {
+                        "type": "string",
+                        "minLength": 1
+                    },
+                    "description": "Authentication Methods References per [RFC 8176]. Typical values: \"did\" (challenge-response), \"passkey\" (WebAuthn), \"vta\" (verifiable-trust agent approval). Multi-factor sessions list every method used."
+                },
+                "acr": {
+                    "type": "string",
+                    "description": "Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is \"aal1\" (single-factor DID auth), \"aal2\" (a second possession-or-biometric factor confirmed), and \"aal3\" (hardware-bound second factor)."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext",
+                    "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+                }
+            }
+        },
+        "AssertionResponse": {
+            "$anchor": "assertionResponse",
+            "title": "AuthenticatorAssertionResponse (login)",
+            "description": "The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "rawId",
+                "type",
+                "response"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string"
+                },
+                "rawId": {
+                    "type": "string"
+                },
+                "type": {
+                    "const": "public-key"
+                },
+                "response": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "clientDataJSON",
+                        "authenticatorData",
+                        "signature"
+                    ],
+                    "properties": {
+                        "clientDataJSON": {
+                            "type": "string"
+                        },
+                        "authenticatorData": {
+                            "type": "string"
+                        },
+                        "signature": {
+                            "type": "string"
+                        },
+                        "userHandle": {
+                            "type": [
+                                "string",
+                                "null"
+                            ]
+                        }
+                    }
+                },
+                "authenticatorAttachment": {
+                    "enum": [
+                        "platform",
+                        "cross-platform"
+                    ]
+                },
+                "clientExtensionResults": {
+                    "type": "object"
+                }
+            }
+        }
+    }
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
     typeUri: TYPE_URI,
     isBearer: false,
     isProofRequired: false,
     isRecipientRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -27,5 +481,6 @@ export const RESPONSE_SPEC = {
     isBearer: false,
     isProofRequired: false,
     isRecipientRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 };
 //# sourceMappingURL=payload.js.map

package/dist/auth/step-up/approve-response/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/auth/step-up/approve-response/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyHH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,+DAAwE,CAAC;AAKjG,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wEAAiF,CAAC;AAKnH;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/auth/step-up/approve-response/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyHH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,+DAAwE,CAAC;AAKjG,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wEAAiF,CAAC;AAKnH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,+DAA+D;IACtE,OAAO,EAAE,iCAAiC;IAC1C,aAAa,EAAE,2KAA2K;IAC1L,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;QACT,WAAW;QACX,WAAW;QACX,UAAU;KACX;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,uGAAuG;SACvH;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,uGAAuG;SACvH;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,qGAAqG;SACrH;QACD,UAAU,EAAE;YACV,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,UAAU;gBACV,QAAQ;aACT;YACD,aAAa,EAAE,kJAAkJ;SAClK;QACD,cAAc,EAAE;YACd,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,kHAAkH;SAClI;QACD,YAAY,EAAE;YACZ,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,+JAA+J;SAC/K;QACD,UAAU,EAAE;YACV,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,qWAAqW;SACrX;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,kBAAkB;YAC3B,aAAa,EAAE,yQAAyQ;YACxR,OAAO,EAAE;gBACP;oBACE,OAAO,EAAE,WAAW;oBACpB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,YAAY;yBACtB;qBACF;oBACD,aAAa,EAAE,sNAAsN;iBACtO;gBACD;oBACE,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,UAAU;yBACpB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,2BAA2B;4BACnC,aAAa,EAAE,oXAAoX;yBACpY;qBACF;iBACF;aACF;SACF;QACD,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,mDAAmD;YAC5D,aAAa,EAAE,iMAAiM;YAChN,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,UAAU;wBACV,UAAU;qBACX;iBACF;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;oBACzB,aAAa,EAAE,kGAAkG;iBAClH;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kHAAkH;iBAClI;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,SAAS,EAAE;YACT,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,wLAAwL;YACvM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,sJAAsJ;iBACtK;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,sDAAsD;iBACtE;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,kDAAkD;iBAClE;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iIAAiI;iBACjJ;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,WAAW,EAAE,CAAC;qBACf;oBACD,aAAa,EAAE,kNAAkN;iBAClO;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mQAAmQ;iBACnR;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;oBACrB,aAAa,EAAE,yDAAyD;iBACzE;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAE,wCAAwC;YACjD,aAAa,EAAE,0GAA0G;YACzH,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,OAAO;gBACP,MAAM;gBACN,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;iBACjB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;iBACjB;gBACD,MAAM,EAAE;oBACN,OAAO,EAAE,YAAY;iBACtB;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,gBAAgB;wBAChB,mBAAmB;wBACnB,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,gBAAgB,EAAE;4BAChB,MAAM,EAAE,QAAQ;yBACjB;wBACD,mBAAmB,EAAE;4BACnB,MAAM,EAAE,QAAQ;yBACjB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;yBACjB;wBACD,YAAY,EAAE;4BACZ,MAAM,EAAE;gCACN,QAAQ;gCACR,MAAM;6BACP;yBACF;qBACF;iBACF;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE;wBACN,UAAU;wBACV,gBAAgB;qBACjB;iBACF;gBACD,wBAAwB,EAAE;oBACxB,MAAM,EAAE,QAAQ;iBACjB;aACF;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,kBAAkB;YAC3B,aAAa,EAAE,yQAAyQ;YACxR,OAAO,EAAE;gBACP;oBACE,OAAO,EAAE,WAAW;oBACpB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,YAAY;yBACtB;qBACF;oBACD,aAAa,EAAE,sNAAsN;iBACtO;gBACD;oBACE,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,UAAU;yBACpB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,2BAA2B;4BACnC,aAAa,EAAE,oXAAoX;yBACpY;qBACF;iBACF;aACF;SACF;QACD,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,mDAAmD;YAC5D,aAAa,EAAE,iMAAiM;YAChN,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,UAAU;wBACV,UAAU;qBACX;iBACF;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;oBACzB,aAAa,EAAE,kGAAkG;iBAClH;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kHAAkH;iBAClI;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,SAAS,EAAE;YACT,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,wLAAwL;YACvM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,sJAAsJ;iBACtK;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,sDAAsD;iBACtE;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,kDAAkD;iBAClE;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iIAAiI;iBACjJ;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,WAAW,EAAE,CAAC;qBACf;oBACD,aAAa,EAAE,kNAAkN;iBAClO;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mQAAmQ;iBACnR;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;oBACrB,aAAa,EAAE,yDAAyD;iBACzE;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAE,wCAAwC;YACjD,aAAa,EAAE,0GAA0G;YACzH,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,OAAO;gBACP,MAAM;gBACN,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;iBACjB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;iBACjB;gBACD,MAAM,EAAE;oBACN,OAAO,EAAE,YAAY;iBACtB;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,gBAAgB;wBAChB,mBAAmB;wBACnB,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,gBAAgB,EAAE;4BAChB,MAAM,EAAE,QAAQ;yBACjB;wBACD,mBAAmB,EAAE;4BACnB,MAAM,EAAE,QAAQ;yBACjB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;yBACjB;wBACD,YAAY,EAAE;4BACZ,MAAM,EAAE;gCACN,QAAQ;gCACR,MAAM;6BACP;yBACF;qBACF;iBACF;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE;wBACN,UAAU;wBACV,gBAAgB;qBACjB;iBACF;gBACD,wBAAwB,EAAE;oBACxB,MAAM,EAAE,QAAQ;iBACjB;aACF;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}