List, -12 is posted. It resolves the unknown-fields question I asked about earlier, following Iman's framing:
- Authorization fields are closed — verifiers reject unknown top-level fields rather than silently allowing. - metadata is the defined extension point — unknown fields there are ignored, decision unchanged. - oneTimeUse: true fails closed without a durable consumption store. The reference implementation (receipt-interop, now on npm as well as GitHub) implements all three cases, with one conformance vector per case. 45/45 vectors green. Thanks to Iman for the sharp read — the oneTimeUse case caught a real gap where the library was silently accepting. Ryan _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
