@openvtc/trust-tasks 0.8.2 → 0.10.0

package/dist/vault/proxy-login/0.1/payload.d.ts

@@ -160,16 +160,798 @@ export type Payload = VaultProxyLoginPayload;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vault/proxy-login/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = VaultProxyLoginResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vault/proxy-login/0.1";
+    readonly title: "Vault Proxy-Login — payload";
+    readonly description: "Consumer requests that the vault maintainer perform a login at the bound third-party site on the consumer's behalf, using the entry's secret material WITHOUT releasing it to the consumer. The maintainer returns a SessionBlob in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope) containing the resulting cookies/headers the consumer can use to operate the session — but never the long-term credential.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["entryId"];
+    readonly properties: {
+        readonly entryId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Vault entry id to log in with.";
+        };
+        readonly target: {
+            readonly $ref: "#/$defs/SiteTarget";
+            readonly description: "Optional — when an entry has multiple targets, names which one the consumer is acting against. The maintainer matches this against the entry's `targets[]`; if not supplied, the maintainer chooses the most specific target compatible with the requesting consumer's form factor (e.g. an iOS Companion gets the iOS-app target if one exists; otherwise the web-origin target).";
+        };
+        readonly consumerContext: {
+            readonly $ref: "#/$defs/ConsumerContext";
+            readonly description: "Caller's situational context — fed to the maintainer's policy engine to decide proxy vs fill, require step-up, etc. Producers populate what they can observe; fields are advisory and the maintainer MUST cross-check anything security-relevant against its own state.";
+        };
+        readonly stepUpProof: {
+            readonly $ref: "#/$defs/StepUpProof";
+            readonly description: "Optional — included on retry after a prior proxy-login attempt returned `step_up_required`.";
+        };
+        readonly nonce: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+            readonly description: "Optional caller-supplied nonce the maintainer SHOULD embed verbatim in the resulting session credential when one applies — typically the relying party's challenge for SIOPv2-shaped flows, where the SIOP id_token's `nonce` claim MUST match the RP's authorization-request `nonce` for the RP to verify the token. When omitted, the maintainer generates its own nonce; that path is appropriate for flows where the consumer doesn't need to bind the credential to an external challenge (e.g. push-mode logins that don't pre-fetch a challenge). Drivers that have no nonce concept (Password POST, OAuth refresh) ignore this field.";
+        };
+        readonly ttlSecondsHint: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly maximum: 86400;
+            readonly description: "Optional caller-preferred session TTL in seconds. The maintainer caps server-side per its policy; a higher hint MUST be silently truncated rather than rejected. Drivers that have a fixed-TTL bearer (e.g. SIOP id_tokens with their own `exp`) MUST NOT extend beyond the underlying credential's lifetime regardless of hint.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Vault Proxy-Login — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["sealedSessionBlob"];
+            readonly properties: {
+                readonly sealedSessionBlob: {
+                    readonly $ref: "#/$defs/SealedEnvelope";
+                    readonly description: "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly SealedEnvelope: {
+            readonly title: "SealedEnvelope";
+            readonly description: "Discriminated by `envelope`. Exactly one variant matches per document.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/DidcommAuthcryptEnvelope";
+            }, {
+                readonly $ref: "#/$defs/HpkeArmoredEnvelope";
+            }, {
+                readonly $ref: "#/$defs/TspMessageEnvelope";
+            }];
+        };
+        readonly TspMessageEnvelope: {
+            readonly title: "TspMessageEnvelope";
+            readonly description: "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["envelope", "message"];
+            readonly properties: {
+                readonly envelope: {
+                    readonly const: "tsp-message";
+                };
+                readonly message: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format";
+                };
+            };
+        };
+        readonly HpkeArmoredEnvelope: {
+            readonly title: "HpkeArmoredEnvelope";
+            readonly description: "OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.\n\nNo open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["envelope", "armored", "recipientKeyId"];
+            readonly properties: {
+                readonly envelope: {
+                    readonly const: "hpke-armored";
+                };
+                readonly armored: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.";
+                };
+                readonly recipientKeyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.";
+                };
+                readonly producerAssertion: {
+                    readonly type: "string";
+                    readonly enum: readonly ["did-signed", "attested", "pinned-only"];
+                    readonly default: "did-signed";
+                    readonly description: "Producer-assertion mode per the sealed-transfer framework. `did-signed` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinned-only` = OOB SHA-256 digest only (dev/test, NOT for production).";
+                };
+            };
+        };
+        readonly DidcommAuthcryptEnvelope: {
+            readonly title: "DidcommAuthcryptEnvelope";
+            readonly description: "DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.\n\nM2A is the only implementation today; this is also the canonical default for new code.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["envelope", "jwe"];
+            readonly properties: {
+                readonly envelope: {
+                    readonly const: "didcomm-authcrypt";
+                };
+                readonly jwe: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.";
+                };
+            };
+        };
+        readonly StepUpProof: {
+            readonly title: "StepUpProof";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "proof", "challengeId"];
+            readonly properties: {
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["webauthn-uv", "push-approval", "totp"];
+                };
+                readonly proof: {
+                    readonly type: "string";
+                    readonly description: "Format depends on kind: WebAuthn assertion (base64url), DIDComm approval-response message id, or 6–8-digit TOTP code.";
+                };
+                readonly challengeId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Maintainer-issued challenge id the proof responds to.";
+                };
+            };
+        };
+        readonly ConsumerContext: {
+            readonly title: "ConsumerContext";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly deviceId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Device-binding id assigned at registration. The maintainer cross-checks this against the authenticated transport identity.";
+                };
+                readonly lastUserVerificationAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Most recent local user-verification on the consumer device (WebAuthn UV, biometric unlock). The maintainer's policy may require this to be within N seconds.";
+                };
+                readonly networkClass: {
+                    readonly type: "string";
+                    readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                    readonly description: "Producer-supplied network classification. Advisory.";
+                };
+            };
+        };
+        readonly SiteTarget: {
+            readonly title: "SiteTarget";
+            readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+            readonly oneOf: readonly [{
+                readonly title: "WebOrigin";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "origin"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "web-origin";
+                    };
+                    readonly origin: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                    };
+                };
+            }, {
+                readonly title: "Did";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "did"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "did";
+                    };
+                    readonly did: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                    };
+                };
+            }, {
+                readonly title: "IosApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "bundleId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "ios-app";
+                    };
+                    readonly bundleId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z0-9.-]+$";
+                        readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                    };
+                    readonly teamId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Z0-9]+$";
+                        readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                    };
+                };
+            }, {
+                readonly title: "AndroidApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "android-app";
+                    };
+                    readonly packageName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                        readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                    };
+                    readonly sha256CertFingerprints: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                    };
+                };
+            }];
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Vault Proxy-Login — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["sealedSessionBlob"];
+            readonly properties: {
+                readonly sealedSessionBlob: {
+                    readonly $ref: "#/$defs/SealedEnvelope";
+                    readonly description: "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly SealedEnvelope: {
+            readonly title: "SealedEnvelope";
+            readonly description: "Discriminated by `envelope`. Exactly one variant matches per document.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/DidcommAuthcryptEnvelope";
+            }, {
+                readonly $ref: "#/$defs/HpkeArmoredEnvelope";
+            }, {
+                readonly $ref: "#/$defs/TspMessageEnvelope";
+            }];
+        };
+        readonly TspMessageEnvelope: {
+            readonly title: "TspMessageEnvelope";
+            readonly description: "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["envelope", "message"];
+            readonly properties: {
+                readonly envelope: {
+                    readonly const: "tsp-message";
+                };
+                readonly message: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format";
+                };
+            };
+        };
+        readonly HpkeArmoredEnvelope: {
+            readonly title: "HpkeArmoredEnvelope";
+            readonly description: "OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.\n\nNo open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["envelope", "armored", "recipientKeyId"];
+            readonly properties: {
+                readonly envelope: {
+                    readonly const: "hpke-armored";
+                };
+                readonly armored: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.";
+                };
+                readonly recipientKeyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.";
+                };
+                readonly producerAssertion: {
+                    readonly type: "string";
+                    readonly enum: readonly ["did-signed", "attested", "pinned-only"];
+                    readonly default: "did-signed";
+                    readonly description: "Producer-assertion mode per the sealed-transfer framework. `did-signed` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinned-only` = OOB SHA-256 digest only (dev/test, NOT for production).";
+                };
+            };
+        };
+        readonly DidcommAuthcryptEnvelope: {
+            readonly title: "DidcommAuthcryptEnvelope";
+            readonly description: "DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.\n\nM2A is the only implementation today; this is also the canonical default for new code.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["envelope", "jwe"];
+            readonly properties: {
+                readonly envelope: {
+                    readonly const: "didcomm-authcrypt";
+                };
+                readonly jwe: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.";
+                };
+            };
+        };
+        readonly StepUpProof: {
+            readonly title: "StepUpProof";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "proof", "challengeId"];
+            readonly properties: {
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["webauthn-uv", "push-approval", "totp"];
+                };
+                readonly proof: {
+                    readonly type: "string";
+                    readonly description: "Format depends on kind: WebAuthn assertion (base64url), DIDComm approval-response message id, or 6–8-digit TOTP code.";
+                };
+                readonly challengeId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Maintainer-issued challenge id the proof responds to.";
+                };
+            };
+        };
+        readonly ConsumerContext: {
+            readonly title: "ConsumerContext";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly deviceId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Device-binding id assigned at registration. The maintainer cross-checks this against the authenticated transport identity.";
+                };
+                readonly lastUserVerificationAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Most recent local user-verification on the consumer device (WebAuthn UV, biometric unlock). The maintainer's policy may require this to be within N seconds.";
+                };
+                readonly networkClass: {
+                    readonly type: "string";
+                    readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                    readonly description: "Producer-supplied network classification. Advisory.";
+                };
+            };
+        };
+        readonly SiteTarget: {
+            readonly title: "SiteTarget";
+            readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+            readonly oneOf: readonly [{
+                readonly title: "WebOrigin";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "origin"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "web-origin";
+                    };
+                    readonly origin: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                    };
+                };
+            }, {
+                readonly title: "Did";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "did"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "did";
+                    };
+                    readonly did: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                    };
+                };
+            }, {
+                readonly title: "IosApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "bundleId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "ios-app";
+                    };
+                    readonly bundleId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z0-9.-]+$";
+                        readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                    };
+                    readonly teamId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Z0-9]+$";
+                        readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                    };
+                };
+            }, {
+                readonly title: "AndroidApp";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "android-app";
+                    };
+                    readonly packageName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                        readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                    };
+                    readonly sha256CertFingerprints: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                    };
+                };
+            }];
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/vault/proxy-login/0.1";
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vault/proxy-login/0.1";
+        readonly title: "Vault Proxy-Login — payload";
+        readonly description: "Consumer requests that the vault maintainer perform a login at the bound third-party site on the consumer's behalf, using the entry's secret material WITHOUT releasing it to the consumer. The maintainer returns a SessionBlob in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope) containing the resulting cookies/headers the consumer can use to operate the session — but never the long-term credential.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["entryId"];
+        readonly properties: {
+            readonly entryId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Vault entry id to log in with.";
+            };
+            readonly target: {
+                readonly $ref: "#/$defs/SiteTarget";
+                readonly description: "Optional — when an entry has multiple targets, names which one the consumer is acting against. The maintainer matches this against the entry's `targets[]`; if not supplied, the maintainer chooses the most specific target compatible with the requesting consumer's form factor (e.g. an iOS Companion gets the iOS-app target if one exists; otherwise the web-origin target).";
+            };
+            readonly consumerContext: {
+                readonly $ref: "#/$defs/ConsumerContext";
+                readonly description: "Caller's situational context — fed to the maintainer's policy engine to decide proxy vs fill, require step-up, etc. Producers populate what they can observe; fields are advisory and the maintainer MUST cross-check anything security-relevant against its own state.";
+            };
+            readonly stepUpProof: {
+                readonly $ref: "#/$defs/StepUpProof";
+                readonly description: "Optional — included on retry after a prior proxy-login attempt returned `step_up_required`.";
+            };
+            readonly nonce: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+                readonly description: "Optional caller-supplied nonce the maintainer SHOULD embed verbatim in the resulting session credential when one applies — typically the relying party's challenge for SIOPv2-shaped flows, where the SIOP id_token's `nonce` claim MUST match the RP's authorization-request `nonce` for the RP to verify the token. When omitted, the maintainer generates its own nonce; that path is appropriate for flows where the consumer doesn't need to bind the credential to an external challenge (e.g. push-mode logins that don't pre-fetch a challenge). Drivers that have no nonce concept (Password POST, OAuth refresh) ignore this field.";
+            };
+            readonly ttlSecondsHint: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly maximum: 86400;
+                readonly description: "Optional caller-preferred session TTL in seconds. The maintainer caps server-side per its policy; a higher hint MUST be silently truncated rather than rejected. Drivers that have a fixed-TTL bearer (e.g. SIOP id_tokens with their own `exp`) MUST NOT extend beyond the underlying credential's lifetime regardless of hint.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Vault Proxy-Login — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["sealedSessionBlob"];
+                readonly properties: {
+                    readonly sealedSessionBlob: {
+                        readonly $ref: "#/$defs/SealedEnvelope";
+                        readonly description: "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly SealedEnvelope: {
+                readonly title: "SealedEnvelope";
+                readonly description: "Discriminated by `envelope`. Exactly one variant matches per document.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/DidcommAuthcryptEnvelope";
+                }, {
+                    readonly $ref: "#/$defs/HpkeArmoredEnvelope";
+                }, {
+                    readonly $ref: "#/$defs/TspMessageEnvelope";
+                }];
+            };
+            readonly TspMessageEnvelope: {
+                readonly title: "TspMessageEnvelope";
+                readonly description: "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["envelope", "message"];
+                readonly properties: {
+                    readonly envelope: {
+                        readonly const: "tsp-message";
+                    };
+                    readonly message: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format";
+                    };
+                };
+            };
+            readonly HpkeArmoredEnvelope: {
+                readonly title: "HpkeArmoredEnvelope";
+                readonly description: "OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.\n\nNo open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["envelope", "armored", "recipientKeyId"];
+                readonly properties: {
+                    readonly envelope: {
+                        readonly const: "hpke-armored";
+                    };
+                    readonly armored: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.";
+                    };
+                    readonly recipientKeyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.";
+                    };
+                    readonly producerAssertion: {
+                        readonly type: "string";
+                        readonly enum: readonly ["did-signed", "attested", "pinned-only"];
+                        readonly default: "did-signed";
+                        readonly description: "Producer-assertion mode per the sealed-transfer framework. `did-signed` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinned-only` = OOB SHA-256 digest only (dev/test, NOT for production).";
+                    };
+                };
+            };
+            readonly DidcommAuthcryptEnvelope: {
+                readonly title: "DidcommAuthcryptEnvelope";
+                readonly description: "DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.\n\nM2A is the only implementation today; this is also the canonical default for new code.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["envelope", "jwe"];
+                readonly properties: {
+                    readonly envelope: {
+                        readonly const: "didcomm-authcrypt";
+                    };
+                    readonly jwe: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.";
+                    };
+                };
+            };
+            readonly StepUpProof: {
+                readonly title: "StepUpProof";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "proof", "challengeId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["webauthn-uv", "push-approval", "totp"];
+                    };
+                    readonly proof: {
+                        readonly type: "string";
+                        readonly description: "Format depends on kind: WebAuthn assertion (base64url), DIDComm approval-response message id, or 6–8-digit TOTP code.";
+                    };
+                    readonly challengeId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Maintainer-issued challenge id the proof responds to.";
+                    };
+                };
+            };
+            readonly ConsumerContext: {
+                readonly title: "ConsumerContext";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly deviceId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Device-binding id assigned at registration. The maintainer cross-checks this against the authenticated transport identity.";
+                    };
+                    readonly lastUserVerificationAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Most recent local user-verification on the consumer device (WebAuthn UV, biometric unlock). The maintainer's policy may require this to be within N seconds.";
+                    };
+                    readonly networkClass: {
+                        readonly type: "string";
+                        readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                        readonly description: "Producer-supplied network classification. Advisory.";
+                    };
+                };
+            };
+            readonly SiteTarget: {
+                readonly title: "SiteTarget";
+                readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebOrigin";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "origin"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "web-origin";
+                        };
+                        readonly origin: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                            readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                        };
+                    };
+                }, {
+                    readonly title: "Did";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "did"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "did";
+                        };
+                        readonly did: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                        };
+                    };
+                }, {
+                    readonly title: "IosApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "bundleId"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "ios-app";
+                        };
+                        readonly bundleId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z0-9.-]+$";
+                            readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                        };
+                        readonly teamId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Z0-9]+$";
+                            readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                        };
+                    };
+                }, {
+                    readonly title: "AndroidApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "android-app";
+                        };
+                        readonly packageName: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                            readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                        };
+                        readonly sha256CertFingerprints: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                            };
+                            readonly uniqueItems: true;
+                            readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                        };
+                    };
+                }];
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -181,5 +963,236 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Vault Proxy-Login — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["sealedSessionBlob"];
+                readonly properties: {
+                    readonly sealedSessionBlob: {
+                        readonly $ref: "#/$defs/SealedEnvelope";
+                        readonly description: "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly SealedEnvelope: {
+                readonly title: "SealedEnvelope";
+                readonly description: "Discriminated by `envelope`. Exactly one variant matches per document.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/DidcommAuthcryptEnvelope";
+                }, {
+                    readonly $ref: "#/$defs/HpkeArmoredEnvelope";
+                }, {
+                    readonly $ref: "#/$defs/TspMessageEnvelope";
+                }];
+            };
+            readonly TspMessageEnvelope: {
+                readonly title: "TspMessageEnvelope";
+                readonly description: "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["envelope", "message"];
+                readonly properties: {
+                    readonly envelope: {
+                        readonly const: "tsp-message";
+                    };
+                    readonly message: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format";
+                    };
+                };
+            };
+            readonly HpkeArmoredEnvelope: {
+                readonly title: "HpkeArmoredEnvelope";
+                readonly description: "OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.\n\nNo open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["envelope", "armored", "recipientKeyId"];
+                readonly properties: {
+                    readonly envelope: {
+                        readonly const: "hpke-armored";
+                    };
+                    readonly armored: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.";
+                    };
+                    readonly recipientKeyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.";
+                    };
+                    readonly producerAssertion: {
+                        readonly type: "string";
+                        readonly enum: readonly ["did-signed", "attested", "pinned-only"];
+                        readonly default: "did-signed";
+                        readonly description: "Producer-assertion mode per the sealed-transfer framework. `did-signed` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinned-only` = OOB SHA-256 digest only (dev/test, NOT for production).";
+                    };
+                };
+            };
+            readonly DidcommAuthcryptEnvelope: {
+                readonly title: "DidcommAuthcryptEnvelope";
+                readonly description: "DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.\n\nM2A is the only implementation today; this is also the canonical default for new code.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["envelope", "jwe"];
+                readonly properties: {
+                    readonly envelope: {
+                        readonly const: "didcomm-authcrypt";
+                    };
+                    readonly jwe: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.";
+                    };
+                };
+            };
+            readonly StepUpProof: {
+                readonly title: "StepUpProof";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "proof", "challengeId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["webauthn-uv", "push-approval", "totp"];
+                    };
+                    readonly proof: {
+                        readonly type: "string";
+                        readonly description: "Format depends on kind: WebAuthn assertion (base64url), DIDComm approval-response message id, or 6–8-digit TOTP code.";
+                    };
+                    readonly challengeId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Maintainer-issued challenge id the proof responds to.";
+                    };
+                };
+            };
+            readonly ConsumerContext: {
+                readonly title: "ConsumerContext";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly deviceId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Device-binding id assigned at registration. The maintainer cross-checks this against the authenticated transport identity.";
+                    };
+                    readonly lastUserVerificationAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Most recent local user-verification on the consumer device (WebAuthn UV, biometric unlock). The maintainer's policy may require this to be within N seconds.";
+                    };
+                    readonly networkClass: {
+                        readonly type: "string";
+                        readonly enum: readonly ["unknown", "home", "corp", "public", "vpn"];
+                        readonly description: "Producer-supplied network classification. Advisory.";
+                    };
+                };
+            };
+            readonly SiteTarget: {
+                readonly title: "SiteTarget";
+                readonly description: "A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebOrigin";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "origin"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "web-origin";
+                        };
+                        readonly origin: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                            readonly description: "Web origin per RFC 6454 (scheme + host + optional port), e.g. \"https://github.com\". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.";
+                        };
+                    };
+                }, {
+                    readonly title: "Did";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "did"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "did";
+                        };
+                        readonly did: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.";
+                        };
+                    };
+                }, {
+                    readonly title: "IosApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "bundleId"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "ios-app";
+                        };
+                        readonly bundleId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z0-9.-]+$";
+                            readonly description: "iOS bundle identifier in reverse-DNS form (e.g. \"com.github.stwalkerster.codehub\"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).";
+                        };
+                        readonly teamId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Z0-9]+$";
+                            readonly description: "Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.";
+                        };
+                    };
+                }, {
+                    readonly title: "AndroidApp";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "packageName", "sha256CertFingerprints"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "android-app";
+                        };
+                        readonly packageName: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly pattern: "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$";
+                            readonly description: "Android package name in reverse-DNS form (e.g. \"com.github.android\").";
+                        };
+                        readonly sha256CertFingerprints: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly pattern: "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$";
+                            };
+                            readonly uniqueItems: true;
+                            readonly description: "SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).";
+                        };
+                    };
+                }];
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map