@openvtc/trust-tasks 0.8.2 → 0.10.0

package/dist/device/register/0.1/payload.d.ts

@@ -166,16 +166,861 @@ export type Payload = DeviceRegisterPayload;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/device/register/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = DeviceRegisterResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/device/register/0.1";
+    readonly title: "Device Register — payload";
+    readonly description: "Public discovery surface that wraps the maintainer's existing two-phase enrolment (provision-integration → acl/swap-key). A new Companion or Service hands the maintainer its long-term VTA-derived key, its consumer kind, display name, and an optional device attestation; the maintainer creates the DeviceBinding and returns it. Phase 1 (provision-integration) is assumed to have already happened — this task is the post-bootstrap claim step.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["consumerKind", "displayName"];
+    readonly properties: {
+        readonly consumerKind: {
+            readonly $ref: "#/$defs/ConsumerKind";
+        };
+        readonly displayName: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+        };
+        readonly platform: {
+            readonly type: "string";
+        };
+        readonly attestation: {
+            readonly $ref: "#/$defs/DeviceAttestation";
+        };
+        readonly keyCustody: {
+            readonly $ref: "#/$defs/KeyCustody";
+            readonly description: "OPTIONAL. How the device custodies its private keys (tier + algorithms). RECOMMENDED for mobile Companions. Maintainer policy input — see docs/design-notes/mobile-key-custody-profile.md.";
+        };
+        readonly hpkePublicKey: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "X25519 public key (did:key form) the maintainer will use to HPKE-seal sensitive payloads to this device (sealed secrets, session blobs, sync events). REQUIRED — every Companion/Service needs a recipient key.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Device Register — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["binding"];
+            readonly properties: {
+                readonly binding: {
+                    readonly $ref: "#/$defs/DeviceBinding";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly DeviceBinding: {
+            readonly title: "DeviceBinding";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["deviceId", "consumerKind", "displayName", "registeredAt", "consumerDid"];
+            readonly properties: {
+                readonly deviceId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.";
+                };
+                readonly consumerDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.";
+                };
+                readonly consumerKind: {
+                    readonly $ref: "#/$defs/ConsumerKind";
+                };
+                readonly displayName: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Human-readable name (e.g. \"Glenn's MacBook — Chrome\", \"iPhone 17\").";
+                };
+                readonly platform: {
+                    readonly type: "string";
+                    readonly description: "Free-form platform descriptor (e.g. \"macOS 16 / Chrome 142\", \"iOS 19.1\", \"Android 16\", \"Linux/x86_64\"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.";
+                };
+                readonly attestation: {
+                    readonly $ref: "#/$defs/DeviceAttestation";
+                };
+                readonly pushCapable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.";
+                };
+                readonly keyCustody: {
+                    readonly $ref: "#/$defs/KeyCustody";
+                    readonly description: "How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.";
+                };
+                readonly capabilities: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.";
+                };
+                readonly registeredAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly lastSeenAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Updated on every device/heartbeat and on any successful auth.";
+                };
+                readonly disabledAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.";
+                };
+                readonly wipedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly type: "string";
+            readonly enum: readonly ["vault-read", "vault-write", "proxy-login", "fill-release", "policy-admin", "device-admin", "sign", "key-mint"];
+            readonly description: "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.";
+        };
+        readonly KeyCustody: {
+            readonly title: "KeyCustody";
+            readonly description: "How a device custodies its private key material — maintainer policy input, mirroring `attestation`. See docs/design-notes/mobile-key-custody-profile.md.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["tier"];
+            readonly properties: {
+                readonly tier: {
+                    readonly type: "string";
+                    readonly enum: readonly ["hardware", "software"];
+                    readonly description: "`hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.";
+                };
+                readonly signingAlg: {
+                    readonly type: "string";
+                    readonly description: "JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).";
+                };
+                readonly keyAgreementCurve: {
+                    readonly type: "string";
+                    readonly description: "Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).";
+                };
+            };
+        };
+        readonly DeviceAttestation: {
+            readonly title: "DeviceAttestation";
+            readonly description: "Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.";
+            readonly oneOf: readonly [{
+                readonly title: "WebAuthnAttestation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "aaguid"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webauthn";
+                    };
+                    readonly aaguid: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$";
+                        readonly description: "WebAuthn Authenticator AAGUID (UUID).";
+                    };
+                    readonly attestationStatement: {
+                        readonly type: "string";
+                        readonly description: "Base64url-encoded WebAuthn attestation statement, when supplied by the platform.";
+                    };
+                };
+            }, {
+                readonly title: "AppleAppAttest";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "keyId", "attestation"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "apple-app-attest";
+                    };
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly attestation: {
+                        readonly type: "string";
+                    };
+                };
+            }, {
+                readonly title: "PlayIntegrity";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "token"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "play-integrity";
+                    };
+                    readonly token: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            }, {
+                readonly title: "Tpm";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "quote"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "tpm";
+                    };
+                    readonly quote: {
+                        readonly type: "string";
+                    };
+                };
+            }, {
+                readonly title: "NitroEnclave";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "quote"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "nitro-enclave";
+                    };
+                    readonly quote: {
+                        readonly type: "string";
+                    };
+                };
+            }, {
+                readonly title: "NoAttestation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "none";
+                    };
+                };
+                readonly description: "No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).";
+            }];
+        };
+        readonly ConsumerKind: {
+            readonly title: "ConsumerKind";
+            readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+            readonly oneOf: readonly [{
+                readonly title: "Companion";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "formFactor"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "companion";
+                    };
+                    readonly formFactor: {
+                        readonly type: "string";
+                        readonly enum: readonly ["browser", "mobile", "desktop"];
+                    };
+                };
+            }, {
+                readonly title: "Service";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "serviceKind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "service";
+                    };
+                    readonly serviceKind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["mediator", "ai-agent", "daemon"];
+                    };
+                };
+            }];
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Device Register — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["binding"];
+            readonly properties: {
+                readonly binding: {
+                    readonly $ref: "#/$defs/DeviceBinding";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly DeviceBinding: {
+            readonly title: "DeviceBinding";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["deviceId", "consumerKind", "displayName", "registeredAt", "consumerDid"];
+            readonly properties: {
+                readonly deviceId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.";
+                };
+                readonly consumerDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.";
+                };
+                readonly consumerKind: {
+                    readonly $ref: "#/$defs/ConsumerKind";
+                };
+                readonly displayName: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Human-readable name (e.g. \"Glenn's MacBook — Chrome\", \"iPhone 17\").";
+                };
+                readonly platform: {
+                    readonly type: "string";
+                    readonly description: "Free-form platform descriptor (e.g. \"macOS 16 / Chrome 142\", \"iOS 19.1\", \"Android 16\", \"Linux/x86_64\"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.";
+                };
+                readonly attestation: {
+                    readonly $ref: "#/$defs/DeviceAttestation";
+                };
+                readonly pushCapable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.";
+                };
+                readonly keyCustody: {
+                    readonly $ref: "#/$defs/KeyCustody";
+                    readonly description: "How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.";
+                };
+                readonly capabilities: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.";
+                };
+                readonly registeredAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly lastSeenAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Updated on every device/heartbeat and on any successful auth.";
+                };
+                readonly disabledAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.";
+                };
+                readonly wipedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly type: "string";
+            readonly enum: readonly ["vault-read", "vault-write", "proxy-login", "fill-release", "policy-admin", "device-admin", "sign", "key-mint"];
+            readonly description: "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.";
+        };
+        readonly KeyCustody: {
+            readonly title: "KeyCustody";
+            readonly description: "How a device custodies its private key material — maintainer policy input, mirroring `attestation`. See docs/design-notes/mobile-key-custody-profile.md.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["tier"];
+            readonly properties: {
+                readonly tier: {
+                    readonly type: "string";
+                    readonly enum: readonly ["hardware", "software"];
+                    readonly description: "`hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.";
+                };
+                readonly signingAlg: {
+                    readonly type: "string";
+                    readonly description: "JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).";
+                };
+                readonly keyAgreementCurve: {
+                    readonly type: "string";
+                    readonly description: "Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).";
+                };
+            };
+        };
+        readonly DeviceAttestation: {
+            readonly title: "DeviceAttestation";
+            readonly description: "Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.";
+            readonly oneOf: readonly [{
+                readonly title: "WebAuthnAttestation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "aaguid"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "webauthn";
+                    };
+                    readonly aaguid: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$";
+                        readonly description: "WebAuthn Authenticator AAGUID (UUID).";
+                    };
+                    readonly attestationStatement: {
+                        readonly type: "string";
+                        readonly description: "Base64url-encoded WebAuthn attestation statement, when supplied by the platform.";
+                    };
+                };
+            }, {
+                readonly title: "AppleAppAttest";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "keyId", "attestation"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "apple-app-attest";
+                    };
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly attestation: {
+                        readonly type: "string";
+                    };
+                };
+            }, {
+                readonly title: "PlayIntegrity";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "token"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "play-integrity";
+                    };
+                    readonly token: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            }, {
+                readonly title: "Tpm";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "quote"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "tpm";
+                    };
+                    readonly quote: {
+                        readonly type: "string";
+                    };
+                };
+            }, {
+                readonly title: "NitroEnclave";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "quote"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "nitro-enclave";
+                    };
+                    readonly quote: {
+                        readonly type: "string";
+                    };
+                };
+            }, {
+                readonly title: "NoAttestation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "none";
+                    };
+                };
+                readonly description: "No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).";
+            }];
+        };
+        readonly ConsumerKind: {
+            readonly title: "ConsumerKind";
+            readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+            readonly oneOf: readonly [{
+                readonly title: "Companion";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "formFactor"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "companion";
+                    };
+                    readonly formFactor: {
+                        readonly type: "string";
+                        readonly enum: readonly ["browser", "mobile", "desktop"];
+                    };
+                };
+            }, {
+                readonly title: "Service";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "serviceKind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "service";
+                    };
+                    readonly serviceKind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["mediator", "ai-agent", "daemon"];
+                    };
+                };
+            }];
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/device/register/0.1";
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/device/register/0.1";
+        readonly title: "Device Register — payload";
+        readonly description: "Public discovery surface that wraps the maintainer's existing two-phase enrolment (provision-integration → acl/swap-key). A new Companion or Service hands the maintainer its long-term VTA-derived key, its consumer kind, display name, and an optional device attestation; the maintainer creates the DeviceBinding and returns it. Phase 1 (provision-integration) is assumed to have already happened — this task is the post-bootstrap claim step.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["consumerKind", "displayName"];
+        readonly properties: {
+            readonly consumerKind: {
+                readonly $ref: "#/$defs/ConsumerKind";
+            };
+            readonly displayName: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+            };
+            readonly platform: {
+                readonly type: "string";
+            };
+            readonly attestation: {
+                readonly $ref: "#/$defs/DeviceAttestation";
+            };
+            readonly keyCustody: {
+                readonly $ref: "#/$defs/KeyCustody";
+                readonly description: "OPTIONAL. How the device custodies its private keys (tier + algorithms). RECOMMENDED for mobile Companions. Maintainer policy input — see docs/design-notes/mobile-key-custody-profile.md.";
+            };
+            readonly hpkePublicKey: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "X25519 public key (did:key form) the maintainer will use to HPKE-seal sensitive payloads to this device (sealed secrets, session blobs, sync events). REQUIRED — every Companion/Service needs a recipient key.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Device Register — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["binding"];
+                readonly properties: {
+                    readonly binding: {
+                        readonly $ref: "#/$defs/DeviceBinding";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly DeviceBinding: {
+                readonly title: "DeviceBinding";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["deviceId", "consumerKind", "displayName", "registeredAt", "consumerDid"];
+                readonly properties: {
+                    readonly deviceId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.";
+                    };
+                    readonly consumerDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.";
+                    };
+                    readonly consumerKind: {
+                        readonly $ref: "#/$defs/ConsumerKind";
+                    };
+                    readonly displayName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Human-readable name (e.g. \"Glenn's MacBook — Chrome\", \"iPhone 17\").";
+                    };
+                    readonly platform: {
+                        readonly type: "string";
+                        readonly description: "Free-form platform descriptor (e.g. \"macOS 16 / Chrome 142\", \"iOS 19.1\", \"Android 16\", \"Linux/x86_64\"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.";
+                    };
+                    readonly attestation: {
+                        readonly $ref: "#/$defs/DeviceAttestation";
+                    };
+                    readonly pushCapable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.";
+                    };
+                    readonly keyCustody: {
+                        readonly $ref: "#/$defs/KeyCustody";
+                        readonly description: "How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.";
+                    };
+                    readonly capabilities: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Capability";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.";
+                    };
+                    readonly registeredAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly lastSeenAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Updated on every device/heartbeat and on any successful auth.";
+                    };
+                    readonly disabledAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.";
+                    };
+                    readonly wipedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly type: "string";
+                readonly enum: readonly ["vault-read", "vault-write", "proxy-login", "fill-release", "policy-admin", "device-admin", "sign", "key-mint"];
+                readonly description: "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.";
+            };
+            readonly KeyCustody: {
+                readonly title: "KeyCustody";
+                readonly description: "How a device custodies its private key material — maintainer policy input, mirroring `attestation`. See docs/design-notes/mobile-key-custody-profile.md.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["tier"];
+                readonly properties: {
+                    readonly tier: {
+                        readonly type: "string";
+                        readonly enum: readonly ["hardware", "software"];
+                        readonly description: "`hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.";
+                    };
+                    readonly signingAlg: {
+                        readonly type: "string";
+                        readonly description: "JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).";
+                    };
+                    readonly keyAgreementCurve: {
+                        readonly type: "string";
+                        readonly description: "Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).";
+                    };
+                };
+            };
+            readonly DeviceAttestation: {
+                readonly title: "DeviceAttestation";
+                readonly description: "Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebAuthnAttestation";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "aaguid"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webauthn";
+                        };
+                        readonly aaguid: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$";
+                            readonly description: "WebAuthn Authenticator AAGUID (UUID).";
+                        };
+                        readonly attestationStatement: {
+                            readonly type: "string";
+                            readonly description: "Base64url-encoded WebAuthn attestation statement, when supplied by the platform.";
+                        };
+                    };
+                }, {
+                    readonly title: "AppleAppAttest";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "keyId", "attestation"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "apple-app-attest";
+                        };
+                        readonly keyId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly attestation: {
+                            readonly type: "string";
+                        };
+                    };
+                }, {
+                    readonly title: "PlayIntegrity";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "token"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "play-integrity";
+                        };
+                        readonly token: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                }, {
+                    readonly title: "Tpm";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "quote"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "tpm";
+                        };
+                        readonly quote: {
+                            readonly type: "string";
+                        };
+                    };
+                }, {
+                    readonly title: "NitroEnclave";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "quote"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "nitro-enclave";
+                        };
+                        readonly quote: {
+                            readonly type: "string";
+                        };
+                    };
+                }, {
+                    readonly title: "NoAttestation";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "none";
+                        };
+                    };
+                    readonly description: "No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).";
+                }];
+            };
+            readonly ConsumerKind: {
+                readonly title: "ConsumerKind";
+                readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+                readonly oneOf: readonly [{
+                    readonly title: "Companion";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "formFactor"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "companion";
+                        };
+                        readonly formFactor: {
+                            readonly type: "string";
+                            readonly enum: readonly ["browser", "mobile", "desktop"];
+                        };
+                    };
+                }, {
+                    readonly title: "Service";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "serviceKind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "service";
+                        };
+                        readonly serviceKind: {
+                            readonly type: "string";
+                            readonly enum: readonly ["mediator", "ai-agent", "daemon"];
+                        };
+                    };
+                }];
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -187,5 +1032,261 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Device Register — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["binding"];
+                readonly properties: {
+                    readonly binding: {
+                        readonly $ref: "#/$defs/DeviceBinding";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly DeviceBinding: {
+                readonly title: "DeviceBinding";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["deviceId", "consumerKind", "displayName", "registeredAt", "consumerDid"];
+                readonly properties: {
+                    readonly deviceId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.";
+                    };
+                    readonly consumerDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.";
+                    };
+                    readonly consumerKind: {
+                        readonly $ref: "#/$defs/ConsumerKind";
+                    };
+                    readonly displayName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Human-readable name (e.g. \"Glenn's MacBook — Chrome\", \"iPhone 17\").";
+                    };
+                    readonly platform: {
+                        readonly type: "string";
+                        readonly description: "Free-form platform descriptor (e.g. \"macOS 16 / Chrome 142\", \"iOS 19.1\", \"Android 16\", \"Linux/x86_64\"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.";
+                    };
+                    readonly attestation: {
+                        readonly $ref: "#/$defs/DeviceAttestation";
+                    };
+                    readonly pushCapable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.";
+                    };
+                    readonly keyCustody: {
+                        readonly $ref: "#/$defs/KeyCustody";
+                        readonly description: "How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.";
+                    };
+                    readonly capabilities: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/Capability";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.";
+                    };
+                    readonly registeredAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly lastSeenAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Updated on every device/heartbeat and on any successful auth.";
+                    };
+                    readonly disabledAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.";
+                    };
+                    readonly wipedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly type: "string";
+                readonly enum: readonly ["vault-read", "vault-write", "proxy-login", "fill-release", "policy-admin", "device-admin", "sign", "key-mint"];
+                readonly description: "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.";
+            };
+            readonly KeyCustody: {
+                readonly title: "KeyCustody";
+                readonly description: "How a device custodies its private key material — maintainer policy input, mirroring `attestation`. See docs/design-notes/mobile-key-custody-profile.md.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["tier"];
+                readonly properties: {
+                    readonly tier: {
+                        readonly type: "string";
+                        readonly enum: readonly ["hardware", "software"];
+                        readonly description: "`hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.";
+                    };
+                    readonly signingAlg: {
+                        readonly type: "string";
+                        readonly description: "JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).";
+                    };
+                    readonly keyAgreementCurve: {
+                        readonly type: "string";
+                        readonly description: "Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).";
+                    };
+                };
+            };
+            readonly DeviceAttestation: {
+                readonly title: "DeviceAttestation";
+                readonly description: "Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.";
+                readonly oneOf: readonly [{
+                    readonly title: "WebAuthnAttestation";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "aaguid"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "webauthn";
+                        };
+                        readonly aaguid: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$";
+                            readonly description: "WebAuthn Authenticator AAGUID (UUID).";
+                        };
+                        readonly attestationStatement: {
+                            readonly type: "string";
+                            readonly description: "Base64url-encoded WebAuthn attestation statement, when supplied by the platform.";
+                        };
+                    };
+                }, {
+                    readonly title: "AppleAppAttest";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "keyId", "attestation"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "apple-app-attest";
+                        };
+                        readonly keyId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly attestation: {
+                            readonly type: "string";
+                        };
+                    };
+                }, {
+                    readonly title: "PlayIntegrity";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "token"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "play-integrity";
+                        };
+                        readonly token: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                }, {
+                    readonly title: "Tpm";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "quote"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "tpm";
+                        };
+                        readonly quote: {
+                            readonly type: "string";
+                        };
+                    };
+                }, {
+                    readonly title: "NitroEnclave";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "quote"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "nitro-enclave";
+                        };
+                        readonly quote: {
+                            readonly type: "string";
+                        };
+                    };
+                }, {
+                    readonly title: "NoAttestation";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "none";
+                        };
+                    };
+                    readonly description: "No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).";
+                }];
+            };
+            readonly ConsumerKind: {
+                readonly title: "ConsumerKind";
+                readonly description: "Discriminator: is this consumer a user-driven Companion or a headless Service?";
+                readonly oneOf: readonly [{
+                    readonly title: "Companion";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "formFactor"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "companion";
+                        };
+                        readonly formFactor: {
+                            readonly type: "string";
+                            readonly enum: readonly ["browser", "mobile", "desktop"];
+                        };
+                    };
+                }, {
+                    readonly title: "Service";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "serviceKind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "service";
+                        };
+                        readonly serviceKind: {
+                            readonly type: "string";
+                            readonly enum: readonly ["mediator", "ai-agent", "daemon"];
+                        };
+                    };
+                }];
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map