@openvtc/trust-tasks 0.8.1 → 0.9.0

package/dist/credential-exchange/pending/list/0.1/payload.js

@@ -6,16 +6,273 @@
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/list/0.1";
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/list/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/credential-exchange/pending/list/0.1",
+    "title": "Credential Exchange Pending List — payload",
+    "description": "List the presentation requests this holder deferred for consent and that can still be acted on. Takes no parameters: the caller's authenticated identity is the scope, and a holder agent answers only for its own wallet.",
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Credential Exchange Pending List — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "pending"
+            ],
+            "properties": {
+                "pending": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DeferredPresentation"
+                    },
+                    "description": "The actionable deferrals. A consumer MUST omit records that are already terminal or past their `expiresAt` — they cannot be approved, so listing them would offer the approver a decision that is guaranteed to fail. An empty array means nothing is awaiting a decision."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "DeferredPresentation": {
+            "$anchor": "deferredPresentation",
+            "title": "DeferredPresentation",
+            "description": "One presentation request awaiting the holder's decision, as the approver sees it.\n\nThis is deliberately **not** the stored record. A consumer also retains the original DCQL query so an approval can re-present byte-faithfully against the verifier's original nonce; that is machinery, not a decision input, and is not exposed here. What is exposed is exactly what an approver needs to answer \"should I disclose this\": who is asking, why, and precisely which claims of which held credentials would leave the wallet.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "verifierDid",
+                "requested",
+                "purpose",
+                "createdAt",
+                "expiresAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Approval handle for this deferral — the value `pending/approve` and `pending/deny` act on."
+                },
+                "verifierDid": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The verifier that asked. An approved presentation binds to this audience, so approving is a decision about *this* party and not a standing permission."
+                },
+                "requested": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RequestedCredential"
+                    },
+                    "description": "Every held credential the query would disclose, resolved against what the holder actually holds. This is the authorization surface: the approver is consenting to these claims leaving the wallet, not to the query in the abstract."
+                },
+                "purpose": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The verifier's stated reason, carried through from the query. Purpose binding: an approver decides against a stated why, never a bare request."
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the deferral was recorded."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "After this the deferral is stale and approval MUST refuse — the verifier's nonce is no longer fresh, so any presentation minted against it would fail the verifier's own replay check."
+                }
+            }
+        },
+        "RequestedCredential": {
+            "$anchor": "requestedCredential",
+            "title": "RequestedCredential",
+            "description": "One held credential a deferred query asked for, and the claims of it that would be disclosed.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "credentialQueryId",
+                "credentialId",
+                "claims"
+            ],
+            "properties": {
+                "credentialQueryId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The DCQL `credential_query_id` this held credential satisfied."
+                },
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The held credential that would satisfy it."
+                },
+                "claims": {
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "minLength": 1
+                    },
+                    "description": "The claims the query asks to disclose from this credential. An empty array means the query matched the credential without naming claims — a consumer SHOULD treat that as a request for the whole credential and present it to the approver as such."
+                }
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Credential Exchange Pending List — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "pending"
+            ],
+            "properties": {
+                "pending": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DeferredPresentation"
+                    },
+                    "description": "The actionable deferrals. A consumer MUST omit records that are already terminal or past their `expiresAt` — they cannot be approved, so listing them would offer the approver a decision that is guaranteed to fail. An empty array means nothing is awaiting a decision."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "DeferredPresentation": {
+            "$anchor": "deferredPresentation",
+            "title": "DeferredPresentation",
+            "description": "One presentation request awaiting the holder's decision, as the approver sees it.\n\nThis is deliberately **not** the stored record. A consumer also retains the original DCQL query so an approval can re-present byte-faithfully against the verifier's original nonce; that is machinery, not a decision input, and is not exposed here. What is exposed is exactly what an approver needs to answer \"should I disclose this\": who is asking, why, and precisely which claims of which held credentials would leave the wallet.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "verifierDid",
+                "requested",
+                "purpose",
+                "createdAt",
+                "expiresAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Approval handle for this deferral — the value `pending/approve` and `pending/deny` act on."
+                },
+                "verifierDid": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The verifier that asked. An approved presentation binds to this audience, so approving is a decision about *this* party and not a standing permission."
+                },
+                "requested": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RequestedCredential"
+                    },
+                    "description": "Every held credential the query would disclose, resolved against what the holder actually holds. This is the authorization surface: the approver is consenting to these claims leaving the wallet, not to the query in the abstract."
+                },
+                "purpose": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The verifier's stated reason, carried through from the query. Purpose binding: an approver decides against a stated why, never a bare request."
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the deferral was recorded."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "After this the deferral is stale and approval MUST refuse — the verifier's nonce is no longer fresh, so any presentation minted against it would fail the verifier's own replay check."
+                }
+            }
+        },
+        "RequestedCredential": {
+            "$anchor": "requestedCredential",
+            "title": "RequestedCredential",
+            "description": "One held credential a deferred query asked for, and the claims of it that would be disclosed.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "credentialQueryId",
+                "credentialId",
+                "claims"
+            ],
+            "properties": {
+                "credentialQueryId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The DCQL `credential_query_id` this held credential satisfied."
+                },
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The held credential that would satisfy it."
+                },
+                "claims": {
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "minLength": 1
+                    },
+                    "description": "The claims the query asks to disclose from this credential. An empty array means the query matched the credential without naming claims — a consumer SHOULD treat that as a request for the whole credential and present it to the approver as such."
+                }
+            }
+        }
+    }
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
     typeUri: TYPE_URI,
     isBearer: false,
     isProofRequired: true,
     isRecipientRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -27,5 +284,6 @@ export const RESPONSE_SPEC = {
     isBearer: false,
     isProofRequired: true,
     isRecipientRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 };
 //# sourceMappingURL=payload.js.map

package/dist/credential-exchange/pending/list/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/credential-exchange/pending/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAsEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,kEAA2E,CAAC;AAKpG,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,2EAAoF,CAAC;AAKtH;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/credential-exchange/pending/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAsEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,kEAA2E,CAAC;AAKpG,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,2EAAoF,CAAC;AAKtH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,kEAAkE;IACzE,OAAO,EAAE,4CAA4C;IACrD,aAAa,EAAE,4NAA4N;IAC3O,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,YAAY,EAAE;QACZ,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,qDAAqD;YAC9D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,8BAA8B;qBACvC;oBACD,aAAa,EAAE,4QAA4Q;iBAC5R;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,sBAAsB,EAAE;YACtB,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,sBAAsB;YAC/B,aAAa,EAAE,sgBAAsgB;YACrhB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,aAAa;gBACb,WAAW;gBACX,SAAS;gBACT,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4FAA4F;iBAC5G;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,wJAAwJ;iBACxK;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,6BAA6B;qBACtC;oBACD,aAAa,EAAE,sOAAsO;iBACtP;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,gJAAgJ;iBAChK;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iCAAiC;iBACjD;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,wLAAwL;iBACxM;aACF;SACF;QACD,qBAAqB,EAAE;YACrB,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,qBAAqB;YAC9B,aAAa,EAAE,+FAA+F;YAC9G,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,mBAAmB;gBACnB,cAAc;gBACd,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,mBAAmB,EAAE;oBACnB,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,gEAAgE;iBAChF;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4CAA4C;iBAC5D;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,WAAW,EAAE,CAAC;qBACf;oBACD,aAAa,EAAE,sPAAsP;iBACtQ;aACF;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,qDAAqD;YAC9D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,8BAA8B;qBACvC;oBACD,aAAa,EAAE,4QAA4Q;iBAC5R;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,sBAAsB,EAAE;YACtB,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,sBAAsB;YAC/B,aAAa,EAAE,sgBAAsgB;YACrhB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,aAAa;gBACb,WAAW;gBACX,SAAS;gBACT,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4FAA4F;iBAC5G;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,wJAAwJ;iBACxK;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,6BAA6B;qBACtC;oBACD,aAAa,EAAE,sOAAsO;iBACtP;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,gJAAgJ;iBAChK;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iCAAiC;iBACjD;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,wLAAwL;iBACxM;aACF;SACF;QACD,qBAAqB,EAAE;YACrB,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,qBAAqB;YAC9B,aAAa,EAAE,+FAA+F;YAC9G,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,mBAAmB;gBACnB,cAAc;gBACd,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,mBAAmB,EAAE;oBACnB,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,gEAAgE;iBAChF;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4CAA4C;iBAC5D;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,WAAW,EAAE,CAAC;qBACf;oBACD,aAAa,EAAE,sPAAsP;iBACtQ;aACF;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/dist/credential-exchange/present/0.1/payload.d.ts

@@ -22,15 +22,85 @@ export interface Ext {
 export declare const TYPE_URI: "https://trusttasks.org/spec/credential-exchange/present/0.1";
 /** Stable alias for this specification's request payload shape. */
 export type Payload = CredentialExchangePresentPayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/credential-exchange/present/0.1";
+    readonly title: "Credential Exchange Present — payload";
+    readonly description: "Holder to verifier: an OID4VP vp_token carrying the selectively-disclosed, holder-bound presentation. Replies on the query thread.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["vp_token"];
+    readonly properties: {
+        readonly vp_token: {
+            readonly type: readonly ["string", "object"];
+            readonly description: "The OID4VP `vp_token`, format-agnostic by design. A JSON **string** is an SD-JWT-VC presentation: the consented disclosures plus a mandatory key-binding JWT over the verifier's nonce and audience. A JSON **object** is a W3C Data-Integrity VP whose proof carries the same nonce and domain. A consumer selects the verification path from the value's type rather than a separate format discriminator, so a new credential format needs no new member here. snake_case is OID4VP's own name for this field.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/credential-exchange/present/0.1";
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/credential-exchange/present/0.1";
+        readonly title: "Credential Exchange Present — payload";
+        readonly description: "Holder to verifier: an OID4VP vp_token carrying the selectively-disclosed, holder-bound presentation. Replies on the query thread.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["vp_token"];
+        readonly properties: {
+            readonly vp_token: {
+                readonly type: readonly ["string", "object"];
+                readonly description: "The OID4VP `vp_token`, format-agnostic by design. A JSON **string** is an SD-JWT-VC presentation: the consented disclosures plus a mandatory key-binding JWT over the verifier's nonce and audience. A JSON **object** is a W3C Data-Integrity VP whose proof carries the same nonce and domain. A consumer selects the verification path from the value's type rather than a separate format discriminator, so a new credential format needs no new member here. snake_case is OID4VP's own name for this field.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map

package/dist/credential-exchange/present/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/credential-exchange/present/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6DAAsE,CAAC;AAE/F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/credential-exchange/present/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6DAAsE,CAAC;AAE/F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCjB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC"}

package/dist/credential-exchange/present/0.1/payload.js

@@ -4,15 +4,61 @@
  */
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/present/0.1";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/credential-exchange/present/0.1",
+    "title": "Credential Exchange Present — payload",
+    "description": "Holder to verifier: an OID4VP vp_token carrying the selectively-disclosed, holder-bound presentation. Replies on the query thread.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "vp_token"
+    ],
+    "properties": {
+        "vp_token": {
+            "type": [
+                "string",
+                "object"
+            ],
+            "description": "The OID4VP `vp_token`, format-agnostic by design. A JSON **string** is an SD-JWT-VC presentation: the consented disclosures plus a mandatory key-binding JWT over the verifier's nonce and audience. A JSON **object** is a W3C Data-Integrity VP whose proof carries the same nonce and domain. A consumer selects the verification path from the value's type rather than a separate format discriminator, so a new credential format needs no new member here. snake_case is OID4VP's own name for this field."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
     typeUri: TYPE_URI,
     isBearer: false,
     isProofRequired: true,
     isRecipientRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
 };
 //# sourceMappingURL=payload.js.map

package/dist/credential-exchange/present/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/credential-exchange/present/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6DAAsE,CAAC;AAK/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/credential-exchange/present/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6DAAsE,CAAC;AAK/F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,6DAA6D;IACpE,OAAO,EAAE,uCAAuC;IAChD,aAAa,EAAE,oIAAoI;IACnJ,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,UAAU;KACX;IACD,YAAY,EAAE;QACZ,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;aACT;YACD,aAAa,EAAE,mfAAmf;SACngB;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC"}

package/dist/credential-exchange/query/0.1/payload.d.ts

@@ -30,15 +30,105 @@ export interface Ext {
 export declare const TYPE_URI: "https://trusttasks.org/spec/credential-exchange/query/0.1";
 /** Stable alias for this specification's request payload shape. */
 export type Payload = CredentialExchangeQueryPayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/credential-exchange/query/0.1";
+    readonly title: "Credential Exchange Query — payload";
+    readonly description: "Verifier to holder: an OID4VP DCQL query, a freshness nonce, and a mandatory stated purpose. The holder answers with credential-exchange/present, or defers for consent.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["dcql_query", "nonce", "purpose"];
+    readonly properties: {
+        readonly dcql_query: {
+            readonly type: "object";
+            readonly description: "An OID4VP DCQL query object, carried verbatim: per-credential `format` selector, `meta` type discriminator (`vct_values` for SD-JWT-VC, `type_values` for W3C), and requested `claims`. Defined by OpenID for Verifiable Presentations and not re-specified here. snake_case member names are DCQL's own.";
+        };
+        readonly nonce: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Verifier freshness value, bound into the resulting presentation so it cannot be replayed to another verifier or at another time.";
+        };
+        readonly purpose: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The verifier's stated reason for asking, shown to the holder. REQUIRED and never empty: purpose binding means a verifier cannot ask for a credential without saying why, and a holder cannot be asked to consent to an unstated use.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/credential-exchange/query/0.1";
     readonly isBearer: false;
     readonly isProofRequired: false;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/credential-exchange/query/0.1";
+        readonly title: "Credential Exchange Query — payload";
+        readonly description: "Verifier to holder: an OID4VP DCQL query, a freshness nonce, and a mandatory stated purpose. The holder answers with credential-exchange/present, or defers for consent.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["dcql_query", "nonce", "purpose"];
+        readonly properties: {
+            readonly dcql_query: {
+                readonly type: "object";
+                readonly description: "An OID4VP DCQL query object, carried verbatim: per-credential `format` selector, `meta` type discriminator (`vct_values` for SD-JWT-VC, `type_values` for W3C), and requested `claims`. Defined by OpenID for Verifiable Presentations and not re-specified here. snake_case member names are DCQL's own.";
+            };
+            readonly nonce: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Verifier freshness value, bound into the resulting presentation so it cannot be replayed to another verifier or at another time.";
+            };
+            readonly purpose: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The verifier's stated reason for asking, shown to the holder. REQUIRED and never empty: purpose binding means a verifier cannot ask for a credential without saying why, and a holder cannot be asked to consent to an unstated use.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map

package/dist/credential-exchange/query/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/credential-exchange/query/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/credential-exchange/query/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CjB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC"}

package/dist/credential-exchange/query/0.1/payload.js

@@ -4,15 +4,70 @@
  */
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/query/0.1";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/credential-exchange/query/0.1",
+    "title": "Credential Exchange Query — payload",
+    "description": "Verifier to holder: an OID4VP DCQL query, a freshness nonce, and a mandatory stated purpose. The holder answers with credential-exchange/present, or defers for consent.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "dcql_query",
+        "nonce",
+        "purpose"
+    ],
+    "properties": {
+        "dcql_query": {
+            "type": "object",
+            "description": "An OID4VP DCQL query object, carried verbatim: per-credential `format` selector, `meta` type discriminator (`vct_values` for SD-JWT-VC, `type_values` for W3C), and requested `claims`. Defined by OpenID for Verifiable Presentations and not re-specified here. snake_case member names are DCQL's own."
+        },
+        "nonce": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Verifier freshness value, bound into the resulting presentation so it cannot be replayed to another verifier or at another time."
+        },
+        "purpose": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The verifier's stated reason for asking, shown to the holder. REQUIRED and never empty: purpose binding means a verifier cannot ask for a credential without saying why, and a holder cannot be asked to consent to an unstated use."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
     typeUri: TYPE_URI,
     isBearer: false,
     isProofRequired: false,
     isRecipientRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
 };
 //# sourceMappingURL=payload.js.map