@openvtc/trust-tasks 0.8.2 → 0.9.0

package/dist/auth/passkey/enroll/start/0.2/payload.d.ts

@@ -114,16 +114,631 @@ export type Payload = AuthPasskeyEnrollStart;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = AuthPasskeyEnrollStartResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2";
+    readonly title: "Auth — Passkey Enroll (start)";
+    readonly description: "Ask the auth service to begin a WebAuthn registration ceremony. The response carries PublicKeyCredentialCreationOptions; the producer hands them to `navigator.credentials.create({ publicKey: ... })`.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly deviceLabel: {
+            readonly type: "string";
+            readonly description: "Operator-facing label for the credential (e.g. \"Alice's MacBook\"). Surfaced in the credential list for later management.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Passkey Enroll Start — response payload";
+            readonly description: "Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["enrollmentId", "options"];
+            readonly properties: {
+                readonly enrollmentId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.";
+                };
+                readonly options: {
+                    readonly $ref: "#/$defs/CredentialCreationOptions";
+                    readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                };
+                readonly uvOptions: {
+                    readonly $ref: "#/$defs/CredentialRequestOptions";
+                    readonly description: "New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+        readonly CredentialCreationOptions: {
+            readonly $anchor: "credentialCreationOptions";
+            readonly title: "PublicKeyCredentialCreationOptions";
+            readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+            readonly properties: {
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly rp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                };
+                readonly user: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name", "displayName"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly displayName: {
+                            readonly type: "string";
+                        };
+                    };
+                };
+                readonly pubKeyCredParams: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["type", "alg"];
+                        readonly properties: {
+                            readonly type: {
+                                readonly const: "public-key";
+                            };
+                            readonly alg: {
+                                readonly type: "integer";
+                                readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                            };
+                        };
+                    };
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly excludeCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly authenticatorSelection: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly properties: {
+                        readonly authenticatorAttachment: {
+                            readonly enum: readonly ["platform", "cross-platform"];
+                        };
+                        readonly requireResidentKey: {
+                            readonly type: "boolean";
+                        };
+                        readonly residentKey: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                        readonly userVerification: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                    };
+                };
+                readonly attestation: {
+                    readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Auth Passkey Enroll Start — response payload";
+            readonly description: "Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["enrollmentId", "options"];
+            readonly properties: {
+                readonly enrollmentId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.";
+                };
+                readonly options: {
+                    readonly $ref: "#/$defs/CredentialCreationOptions";
+                    readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                };
+                readonly uvOptions: {
+                    readonly $ref: "#/$defs/CredentialRequestOptions";
+                    readonly description: "New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CredentialRequestOptions: {
+            readonly $anchor: "credentialRequestOptions";
+            readonly title: "PublicKeyCredentialRequestOptions";
+            readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge"];
+            readonly properties: {
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly rpId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly userVerification: {
+                    readonly enum: readonly ["discouraged", "preferred", "required"];
+                };
+            };
+        };
+        readonly CredentialDescriptor: {
+            readonly $anchor: "credentialDescriptor";
+            readonly title: "PublicKeyCredentialDescriptor";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "id"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "public-key";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded credential id.";
+                };
+                readonly transports: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                    };
+                };
+            };
+        };
+        readonly CredentialCreationOptions: {
+            readonly $anchor: "credentialCreationOptions";
+            readonly title: "PublicKeyCredentialCreationOptions";
+            readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+            readonly properties: {
+                readonly challenge: {
+                    readonly type: "string";
+                    readonly description: "base64url-encoded one-time nonce.";
+                };
+                readonly rp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                };
+                readonly user: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["id", "name", "displayName"];
+                    readonly properties: {
+                        readonly id: {
+                            readonly type: "string";
+                            readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                        };
+                        readonly name: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly displayName: {
+                            readonly type: "string";
+                        };
+                    };
+                };
+                readonly pubKeyCredParams: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["type", "alg"];
+                        readonly properties: {
+                            readonly type: {
+                                readonly const: "public-key";
+                            };
+                            readonly alg: {
+                                readonly type: "integer";
+                                readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                            };
+                        };
+                    };
+                };
+                readonly timeout: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly excludeCredentials: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CredentialDescriptor";
+                    };
+                };
+                readonly authenticatorSelection: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly properties: {
+                        readonly authenticatorAttachment: {
+                            readonly enum: readonly ["platform", "cross-platform"];
+                        };
+                        readonly requireResidentKey: {
+                            readonly type: "boolean";
+                        };
+                        readonly residentKey: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                        readonly userVerification: {
+                            readonly enum: readonly ["discouraged", "preferred", "required"];
+                        };
+                    };
+                };
+                readonly attestation: {
+                    readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                };
+            };
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2";
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2";
+        readonly title: "Auth — Passkey Enroll (start)";
+        readonly description: "Ask the auth service to begin a WebAuthn registration ceremony. The response carries PublicKeyCredentialCreationOptions; the producer hands them to `navigator.credentials.create({ publicKey: ... })`.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly deviceLabel: {
+                readonly type: "string";
+                readonly description: "Operator-facing label for the credential (e.g. \"Alice's MacBook\"). Surfaced in the credential list for later management.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Passkey Enroll Start — response payload";
+                readonly description: "Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["enrollmentId", "options"];
+                readonly properties: {
+                    readonly enrollmentId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.";
+                    };
+                    readonly options: {
+                        readonly $ref: "#/$defs/CredentialCreationOptions";
+                        readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                    };
+                    readonly uvOptions: {
+                        readonly $ref: "#/$defs/CredentialRequestOptions";
+                        readonly description: "New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+            readonly CredentialCreationOptions: {
+                readonly $anchor: "credentialCreationOptions";
+                readonly title: "PublicKeyCredentialCreationOptions";
+                readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+                readonly properties: {
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly rp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    };
+                    readonly user: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name", "displayName"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly displayName: {
+                                readonly type: "string";
+                            };
+                        };
+                    };
+                    readonly pubKeyCredParams: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["type", "alg"];
+                            readonly properties: {
+                                readonly type: {
+                                    readonly const: "public-key";
+                                };
+                                readonly alg: {
+                                    readonly type: "integer";
+                                    readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                                };
+                            };
+                        };
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly excludeCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly authenticatorSelection: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly authenticatorAttachment: {
+                                readonly enum: readonly ["platform", "cross-platform"];
+                            };
+                            readonly requireResidentKey: {
+                                readonly type: "boolean";
+                            };
+                            readonly residentKey: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                            readonly userVerification: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                        };
+                    };
+                    readonly attestation: {
+                        readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                    };
+                };
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -135,5 +750,197 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Auth Passkey Enroll Start — response payload";
+                readonly description: "Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["enrollmentId", "options"];
+                readonly properties: {
+                    readonly enrollmentId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.";
+                    };
+                    readonly options: {
+                        readonly $ref: "#/$defs/CredentialCreationOptions";
+                        readonly description: "PublicKeyCredentialCreationOptions for navigator.credentials.create.";
+                    };
+                    readonly uvOptions: {
+                        readonly $ref: "#/$defs/CredentialRequestOptions";
+                        readonly description: "New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CredentialRequestOptions: {
+                readonly $anchor: "credentialRequestOptions";
+                readonly title: "PublicKeyCredentialRequestOptions";
+                readonly description: "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge"];
+                readonly properties: {
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rpId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly allowCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly userVerification: {
+                        readonly enum: readonly ["discouraged", "preferred", "required"];
+                    };
+                };
+            };
+            readonly CredentialDescriptor: {
+                readonly $anchor: "credentialDescriptor";
+                readonly title: "PublicKeyCredentialDescriptor";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "id"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "public-key";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded credential id.";
+                    };
+                    readonly transports: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly enum: readonly ["usb", "nfc", "ble", "internal", "hybrid"];
+                        };
+                    };
+                };
+            };
+            readonly CredentialCreationOptions: {
+                readonly $anchor: "credentialCreationOptions";
+                readonly title: "PublicKeyCredentialCreationOptions";
+                readonly description: "Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["challenge", "rp", "user", "pubKeyCredParams"];
+                readonly properties: {
+                    readonly challenge: {
+                        readonly type: "string";
+                        readonly description: "base64url-encoded one-time nonce.";
+                    };
+                    readonly rp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    };
+                    readonly user: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["id", "name", "displayName"];
+                        readonly properties: {
+                            readonly id: {
+                                readonly type: "string";
+                                readonly description: "base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.";
+                            };
+                            readonly name: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly displayName: {
+                                readonly type: "string";
+                            };
+                        };
+                    };
+                    readonly pubKeyCredParams: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["type", "alg"];
+                            readonly properties: {
+                                readonly type: {
+                                    readonly const: "public-key";
+                                };
+                                readonly alg: {
+                                    readonly type: "integer";
+                                    readonly description: "COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).";
+                                };
+                            };
+                        };
+                    };
+                    readonly timeout: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly excludeCredentials: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CredentialDescriptor";
+                        };
+                    };
+                    readonly authenticatorSelection: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly authenticatorAttachment: {
+                                readonly enum: readonly ["platform", "cross-platform"];
+                            };
+                            readonly requireResidentKey: {
+                                readonly type: "boolean";
+                            };
+                            readonly residentKey: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                            readonly userVerification: {
+                                readonly enum: readonly ["discouraged", "preferred", "required"];
+                            };
+                        };
+                    };
+                    readonly attestation: {
+                        readonly enum: readonly ["none", "indirect", "direct", "enterprise"];
+                    };
+                };
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map