@openvtc/trust-tasks 0.2.50 → 0.2.52

package/dist/keys/rename/0.1/payload.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/rename/0.1/payload.schema.json
+ */
+/**
+ * Change a key's identifier. The key material is untouched — only the name it is addressed by changes.
+ */
+export interface KeysRenamePayload {
+    /**
+     * The identifier the key is addressed by today.
+     */
+    keyId: string;
+    /**
+     * The identifier it should be addressed by afterwards. MUST NOT collide with an existing record.
+     */
+    newKeyId: string;
+    ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/keys/rename/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/rename/0.1#response";
+//# sourceMappingURL=payload.d.ts.map

package/dist/keys/rename/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/rename/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC"}

package/dist/keys/rename/0.1/payload.js

@@ -0,0 +1,9 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/rename/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1#response";
+//# sourceMappingURL=payload.js.map

package/dist/keys/rename/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/rename/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6CAAsD,CAAC;AAE/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sDAA+D,CAAC"}

package/dist/keys/revoke/0.1/payload.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/revoke/0.1/payload.schema.json
+ */
+/**
+ * Retire a key from further use. The record is retained so historic signatures stay attributable; this is not a delete.
+ */
+export interface KeysRevokePayload {
+    /**
+     * Identifier of the key to retire.
+     */
+    keyId: string;
+    /**
+     * Optional human-readable rationale, recorded with the revocation.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/keys/revoke/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/revoke/0.1#response";
+//# sourceMappingURL=payload.d.ts.map

package/dist/keys/revoke/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/revoke/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC"}

package/dist/keys/revoke/0.1/payload.js

@@ -0,0 +1,9 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/revoke/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/revoke/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/revoke/0.1#response";
+//# sourceMappingURL=payload.js.map

package/dist/keys/revoke/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/revoke/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6CAAsD,CAAC;AAE/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sDAA+D,CAAC"}

package/dist/keys/show/0.1/payload.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/show/0.1/payload.schema.json
+ */
+export interface KeysShowPayload {
+    /**
+     * Identifier of the key to read.
+     */
+    keyId: string;
+    ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/keys/show/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/show/0.1#response";
+//# sourceMappingURL=payload.d.ts.map

package/dist/keys/show/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oDAA6D,CAAC"}

package/dist/keys/show/0.1/payload.js

@@ -0,0 +1,9 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/show/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/show/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/show/0.1#response";
+//# sourceMappingURL=payload.js.map

package/dist/keys/show/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAA6D,CAAC"}

package/dist/keys/sign/0.1/payload.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign/0.1/payload.schema.json
+ */
+/**
+ * Signature algorithm to use. MUST be compatible with the named key's `keyType`.
+ */
+export type SignAlgorithm = "EdDSA" | "ES256";
+export interface KeysSignPayload {
+    /**
+     * Identifier of the key to sign with. The key MUST be `active`. Which keys a producer may name is the whole of this task's authorization story — the maintainer signs the bytes it is given without inspecting them.
+     */
+    keyId: string;
+    /**
+     * The exact bytes to sign, base64url-encoded without padding. The maintainer signs these bytes verbatim: it does not parse, canonicalize, or wrap them.
+     */
+    payload: string;
+    algorithm: SignAlgorithm;
+    ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/keys/sign/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/sign/0.1#response";
+//# sourceMappingURL=payload.d.ts.map

package/dist/keys/sign/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/sign/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,CAAC;AAE9C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,aAAa,CAAC;IACzB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oDAA6D,CAAC"}

package/dist/keys/sign/0.1/payload.js

@@ -0,0 +1,9 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/sign/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/sign/0.1#response";
+//# sourceMappingURL=payload.js.map

package/dist/keys/sign/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/sign/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAA6D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.2.50",
+  "version": "0.2.52",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/acl/grant/0.1/payload.ts

@@ -27,6 +27,10 @@ export interface AclEntry {
    * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
    */
   scopes?: string[];
+  /**
+   * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+   */
+  allowedKeys?: string[] | null;
   /**
    * Optional human-readable label.
    */

package/src/acl/update/0.1/payload.ts

@@ -4,7 +4,7 @@
  */
 
 /**
- * Amend the non-role attributes of an existing ACL entry: its label, scopes, expiry, step-up requirement, or approve-authority. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap.
+ * Amend the non-role attributes of an existing ACL entry: its label, scopes, allowed keys, expiry, step-up requirement, or approve-authority. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap.
  */
 export interface ACLUpdatePayload {
   /**
@@ -19,6 +19,10 @@ export interface ACLUpdatePayload {
    * Replacement scope set, applied wholesale rather than merged — a caller that means to add one sends the full intended set. NARROWING THE SET IS A REVOCATION and a consumer MUST refuse it here, directing the caller to acl/revoke, so that every removal of authority passes through the task that is audited and reasoned as a revocation.
    */
   scopes?: string[];
+  /**
+   * Replacement key filter, applied wholesale rather than merged (the entry's allowedKeys becomes exactly this value). Omitted leaves the filter unchanged. Explicit `null` REMOVES the filter — the subject may once again reach every key within its scopes, a privilege increase a consumer SHOULD gate like clearing `expiresAt`. An EMPTY ARRAY sets the filter to no keys at all — the narrowest grant, not a wildcard. A replacement that narrows the previous filter IS a privilege reduction: unlike `scopes` (whose narrowing is refused here and routed to acl/revoke) it is accepted, because acl/revoke/0.1 cannot express a per-key reduction — but the consumer MUST audit it as a reduction and apply it to the subject's live sessions rather than letting the wider set survive until a credential expires.
+   */
+  allowedKeys?: string[] | null;
   /**
    * Replacement expiry. Explicit `null` makes the entry permanent — a privilege increase, which a consumer SHOULD gate at least as strictly as the original grant.
    */

package/src/index.ts

@@ -122,6 +122,17 @@ export * as GovernanceShared_v0_1 from "./governance/_shared/0.1/governance";
 export * as GovernanceCapabilityDisable_v0_1 from "./governance/capability/disable/0.1/payload";
 export * as GovernanceCapabilityEnable_v0_1 from "./governance/capability/enable/0.1/payload";
 export * as GovernanceCapabilityList_v0_1 from "./governance/capability/list/0.1/payload";
+export * as KeyRecordShared_v0_1 from "./keys/_shared/0.1/key-record";
+export * as SignAlgorithmShared_v0_1 from "./keys/_shared/0.1/sign-algorithm";
+export * as KeysCreate_v0_1 from "./keys/create/0.1/payload";
+export * as KeysDeriveAndSignDocument_v0_1 from "./keys/derive-and-sign-document/0.1/payload";
+export * as KeysDeriveAndSign_v0_1 from "./keys/derive-and-sign/0.1/payload";
+export * as KeysImport_v0_1 from "./keys/import/0.1/payload";
+export * as KeysList_v0_1 from "./keys/list/0.1/payload";
+export * as KeysRename_v0_1 from "./keys/rename/0.1/payload";
+export * as KeysRevoke_v0_1 from "./keys/revoke/0.1/payload";
+export * as KeysShow_v0_1 from "./keys/show/0.1/payload";
+export * as KeysSign_v0_1 from "./keys/sign/0.1/payload";
 export * as MessagingShared_v0_1 from "./messaging/_shared/0.1/messaging";
 export * as MessagingAccessListAdd_v0_1 from "./messaging/access-list/add/0.1/payload";
 export * as MessagingAccessListClear_v0_1 from "./messaging/access-list/clear/0.1/payload";

package/src/keys/_shared/0.1/key-record.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/_shared/0.1/key-record.schema.json
+ */
+
+/**
+ * Canonical KeyRecord $def referenced by every keys/* specification, alongside the KeyType, KeyStatus and KeyOrigin enumerations. Not itself a Trust Task specification (the `_shared` folder is skipped by the registry build and the codegen).
+ */
+export interface KeyRecordSharedDefinitionForTheKeysSpecFamily {
+  [k: string]: unknown | undefined;
+}

package/src/keys/_shared/0.1/sign-algorithm.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/_shared/0.1/sign-algorithm.schema.json
+ */
+
+/**
+ * Canonical SignAlgorithm $def, shared by every keys/* specification that produces a signature. Not itself a Trust Task specification (the `_shared` folder is skipped by the registry build and the codegen).
+ */
+export interface SignAlgorithmSharedDefinitionForTheKeysSpecFamily {
+  [k: string]: unknown | undefined;
+}

package/src/keys/create/0.1/payload.ts

@@ -0,0 +1,38 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/create/0.1/payload.schema.json
+ */
+
+/**
+ * Algorithm to generate.
+ */
+export type KeyType = "ed25519" | "x25519" | "p256";
+
+export interface KeysCreatePayload {
+  keyType: KeyType;
+  /**
+   * Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian.
+   */
+  derivationPath?: string;
+  /**
+   * Optional human-readable label for the resulting record.
+   */
+  label?: string;
+  /**
+   * Scope to file the key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.
+   */
+  contextId?: string;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/create/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/create/0.1#response" as const;

package/src/keys/derive-and-sign/0.1/payload.ts

@@ -0,0 +1,42 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/derive-and-sign/0.1/payload.schema.json
+ */
+
+/**
+ * Algorithm to derive. MUST be one that can sign.
+ */
+export type KeyType = "ed25519" | "x25519" | "p256";
+/**
+ * Signature algorithm. MUST be compatible with the derived key's type.
+ */
+export type SignAlgorithm = "EdDSA" | "ES256";
+
+/**
+ * Derive a key at a path and sign with it in one step, without adding a stored key record.
+ */
+export interface KeysDeriveAndSignPayload {
+  keyType: KeyType;
+  /**
+   * Hierarchical-deterministic path to derive at. The same path against the same seed always yields the same key, which is what makes this reproducible rather than ephemeral.
+   */
+  derivationPath: string;
+  /**
+   * The exact bytes to sign, base64url-encoded without padding. Signed verbatim — not parsed, canonicalized or wrapped.
+   */
+  payload: string;
+  algorithm: SignAlgorithm;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign/0.1#response" as const;

package/src/keys/derive-and-sign-document/0.1/payload.ts

@@ -0,0 +1,41 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/derive-and-sign-document/0.1/payload.schema.json
+ */
+
+/**
+ * Algorithm to derive. MUST be one that can sign.
+ */
+export type KeyType = "ed25519" | "x25519" | "p256";
+
+/**
+ * Derive a key at a path and return the supplied JSON document with a Data Integrity proof grafted on. Unlike keys/derive-and-sign, the custodian canonicalizes the document itself.
+ */
+export interface KeysDeriveAndSignDocumentPayload {
+  keyType: KeyType;
+  /**
+   * Hierarchical-deterministic path to derive at.
+   */
+  derivationPath: string;
+  /**
+   * The JSON document to sign. Any `proof` member present is stripped before canonicalization — the custodian signs the document's content, never a previous signature over it.
+   */
+  document: {};
+  /**
+   * Proof purpose to record in the generated proof. Absent means `assertionMethod`.
+   */
+  proofPurpose?: string;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign-document/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign-document/0.1#response" as const;

package/src/keys/import/0.1/payload.ts

@@ -0,0 +1,51 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/import/0.1/payload.schema.json
+ */
+
+/**
+ * Hand an externally-created private key to a custodian. Exactly one carrier member MUST be present; the choice of carrier is a confidentiality decision, not a formatting one.
+ */
+export type KeysImportPayload = {
+  keyType: KeyType;
+  /**
+   * The private key inside an armored sealed-transfer bundle, encrypted to the custodian's own public key. The only carrier that keeps the key confidential from every intermediary, including a transport terminator, so it is the one to prefer.
+   */
+  privateKeySealed?: string;
+  /**
+   * The private key as a JWE compact serialization, encrypted to the custodian. Equivalent in intent to `privateKeySealed`; retained for producers that already speak JOSE.
+   */
+  privateKeyJwe?: string;
+  /**
+   * The raw private key, multibase-encoded and NOT encrypted to the custodian. Admissible **only** where the transport itself provides end-to-end confidentiality between producer and custodian. A custodian reachable over a transport that terminates anywhere in between (TLS at a load balancer, for instance) MUST refuse this member — see the specification's Security section.
+   */
+  privateKeyMultibase?: string;
+  /**
+   * Optional human-readable label for the resulting record.
+   */
+  label?: string;
+  /**
+   * Scope to file the imported key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.
+   */
+  contextId?: string;
+  ext?: Ext;
+} & {
+  [k: string]: unknown | undefined;
+};
+/**
+ * Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.
+ */
+export type KeyType = "ed25519" | "x25519" | "p256";
+
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/import/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/import/0.1#response" as const;

package/src/keys/list/0.1/payload.ts

@@ -0,0 +1,38 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/list/0.1/payload.schema.json
+ */
+
+/**
+ * Return only keys in this lifecycle state. Omitted returns every state, including revoked keys.
+ */
+export type KeyStatus = "active" | "revoked";
+
+export interface KeysListPayload {
+  status?: KeyStatus;
+  /**
+   * Return only keys filed under this scope.
+   */
+  contextId?: string;
+  /**
+   * Zero-based index of the first record to return.
+   */
+  offset?: number;
+  /**
+   * Maximum records to return. The custodian MAY return fewer and MAY impose its own ceiling; `total` says how many matched.
+   */
+  limit?: number;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/list/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/list/0.1#response" as const;

package/src/keys/rename/0.1/payload.ts

@@ -0,0 +1,31 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/rename/0.1/payload.schema.json
+ */
+
+/**
+ * Change a key's identifier. The key material is untouched — only the name it is addressed by changes.
+ */
+export interface KeysRenamePayload {
+  /**
+   * The identifier the key is addressed by today.
+   */
+  keyId: string;
+  /**
+   * The identifier it should be addressed by afterwards. MUST NOT collide with an existing record.
+   */
+  newKeyId: string;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1#response" as const;

package/src/keys/revoke/0.1/payload.ts

@@ -0,0 +1,31 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/revoke/0.1/payload.schema.json
+ */
+
+/**
+ * Retire a key from further use. The record is retained so historic signatures stay attributable; this is not a delete.
+ */
+export interface KeysRevokePayload {
+  /**
+   * Identifier of the key to retire.
+   */
+  keyId: string;
+  /**
+   * Optional human-readable rationale, recorded with the revocation.
+   */
+  reason?: string;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/revoke/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/revoke/0.1#response" as const;

package/src/keys/show/0.1/payload.ts

@@ -0,0 +1,24 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/show/0.1/payload.schema.json
+ */
+
+export interface KeysShowPayload {
+  /**
+   * Identifier of the key to read.
+   */
+  keyId: string;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/show/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/show/0.1#response" as const;

package/src/keys/sign/0.1/payload.ts

@@ -0,0 +1,34 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign/0.1/payload.schema.json
+ */
+
+/**
+ * Signature algorithm to use. MUST be compatible with the named key's `keyType`.
+ */
+export type SignAlgorithm = "EdDSA" | "ES256";
+
+export interface KeysSignPayload {
+  /**
+   * Identifier of the key to sign with. The key MUST be `active`. Which keys a producer may name is the whole of this task's authorization story — the maintainer signs the bytes it is given without inspecting them.
+   */
+  keyId: string;
+  /**
+   * The exact bytes to sign, base64url-encoded without padding. The maintainer signs these bytes verbatim: it does not parse, canonicalize, or wrap them.
+   */
+  payload: string;
+  algorithm: SignAlgorithm;
+  ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/sign/0.1" as const;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/sign/0.1#response" as const;