@openvtc/trust-tasks 0.2.55 → 0.2.57

package/src/governance/capability/enable/0.1/payload.ts

@@ -108,9 +108,32 @@ export interface CapabilityManifest {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface GovernanceCapabilityEnableResponsePayload {
+  capability: string;
+  version?: string;
+  /**
+   * True once the capability is active for the community.
+   */
+  enabled: boolean;
+  /**
+   * When the enablement took effect, per the host clock.
+   */
+  enabledAt?: string;
+  /**
+   * Additional human-readable detail.
+   */
+  message?: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/governance/capability/enable/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GovernanceCapabilityEnablePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/governance/capability/enable/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GovernanceCapabilityEnableResponsePayload;

package/src/governance/capability/list/0.1/payload.ts

@@ -19,9 +19,106 @@ export interface GovernanceCapabilityListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface GovernanceCapabilityListResponsePayload {
+  capabilities: {
+    manifest: CapabilityManifest;
+    enabled: boolean;
+    /**
+     * When the capability was enabled, for enabled entries.
+     */
+    enabledAt?: string;
+    /**
+     * DID of the companion serving this capability, when not built in.
+     */
+    delegate?: string;
+  }[];
+  ext?: Ext;
+}
+/**
+ * The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.
+ */
+export interface CapabilityManifest {
+  /**
+   * The capability's namespace slug, e.g. `git-trust`.
+   */
+  capability: string;
+  /**
+   * Manifest/capability version, `MAJOR.MINOR`.
+   */
+  version: string;
+  /**
+   * Human-readable capability name for management surfaces.
+   */
+  title?: string;
+  /**
+   * One-paragraph description for management surfaces.
+   */
+  description?: string;
+  /**
+   * Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.
+   *
+   * @minItems 1
+   */
+  specs: [string, ...string[]];
+  /**
+   * The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.
+   */
+  vocabulary?: {
+    /**
+     * TRQP `action` values this capability owns, e.g. `git.commit.sign`.
+     *
+     * @minItems 1
+     */
+    actions: [string, ...string[]];
+    /**
+     * Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.
+     */
+    resourcePattern?: string;
+  };
+  /**
+   * Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.
+   */
+  roles?: {
+    [k: string]: string[] | undefined;
+  };
+  /**
+   * Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.
+   */
+  lifecycleHooks?: string[];
+  /**
+   * Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.
+   */
+  consentClass?: {
+    [k: string]: ("normal" | "elevated" | "destructive") | undefined;
+  };
+  /**
+   * Out-of-stack components that consume this capability's trust decisions.
+   */
+  externalAdapters?: {
+    /**
+     * Adapter type, e.g. `github-action`, `webhook`.
+     */
+    kind: string;
+    /**
+     * Where the adapter lives, e.g. a repository path or URL.
+     */
+    ref: string;
+  }[];
+  /**
+   * Spec slug of the JSON schema the per-community `config` document must validate against.
+   */
+  configSchema?: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/governance/capability/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GovernanceCapabilityListPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/governance/capability/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GovernanceCapabilityListResponsePayload;

package/src/keys/create/0.1/payload.ts

@@ -7,6 +7,18 @@
  * Algorithm to generate.
  */
 export type KeyType = "ed25519" | "x25519" | "p256";
+/**
+ * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
+ */
+export type KeyType1 = "ed25519" | "x25519" | "p256";
+/**
+ * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
+ */
+export type KeyStatus = "active" | "revoked";
+/**
+ * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.
+ */
+export type KeyOrigin = "derived" | "imported";
 
 export interface KeysCreatePayload {
   keyType: KeyType;
@@ -34,9 +46,69 @@ export interface KeysCreatePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/create request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/create/0.1#response.
+ */
+export interface KeysCreateResponsePayload {
+  key: KeyRecord;
+  ext?: Ext1;
+}
+/**
+ * The realized record, carrying the public half. The private half is never returned.
+ */
+export interface KeyRecord {
+  /**
+   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
+   */
+  keyId: string;
+  keyType: KeyType1;
+  status: KeyStatus;
+  /**
+   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
+   */
+  publicKey: string;
+  /**
+   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
+   */
+  derivationPath?: string;
+  /**
+   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
+   */
+  seedId?: number;
+  origin?: KeyOrigin;
+  /**
+   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
+   */
+  label?: string;
+  /**
+   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
+   */
+  contextId?: string;
+  /**
+   * RFC 3339 timestamp at which the key was created or imported.
+   */
+  createdAt: string;
+  /**
+   * RFC 3339 timestamp of the last change to the record (rename, revocation).
+   */
+  updatedAt?: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/create/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeyType;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/create/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysCreateResponsePayload;

package/src/keys/derive-and-sign/0.1/payload.ts

@@ -11,6 +11,10 @@ export type KeyType = "ed25519" | "x25519" | "p256";
  * Signature algorithm. MUST be compatible with the derived key's type.
  */
 export type SignAlgorithm = "EdDSA" | "ES256";
+/**
+ * `EdDSA` pairs with an `ed25519` key; `ES256` pairs with a `p256` key. An `x25519` key performs key agreement and can sign nothing, so no algorithm here is valid for one. The enumeration is closed: an unrecognised algorithm is refused rather than silently substituted with a supported one.
+ */
+export type SignAlgorithm1 = "EdDSA" | "ES256";
 
 /**
  * Derive a key at a path and sign with it in one step, without adding a stored key record.
@@ -34,9 +38,36 @@ export interface KeysDeriveAndSignPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/derive-and-sign request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/derive-and-sign/0.1#response.
+ */
+export interface KeysDeriveAndSignResponsePayload {
+  /**
+   * Public half of the derived key, multibase-encoded — so the producer learns the identity it just signed as, which it could not otherwise know for a key that was never stored.
+   */
+  publicKey: string;
+  /**
+   * Signature bytes, base64url-encoded without padding.
+   */
+  signature: string;
+  algorithm: SignAlgorithm1;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeyType;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysDeriveAndSignResponsePayload;

package/src/keys/derive-and-sign-document/0.1/payload.ts

@@ -33,9 +33,35 @@ export interface KeysDeriveAndSignDocumentPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/derive-and-sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/derive-and-sign-document/0.1#response.
+ */
+export interface KeysDeriveAndSignDocumentResponsePayload {
+  /**
+   * The `did:key` of the derived signer — the identity the document was signed as, and the DID a verifier resolves the proof's verification method against.
+   */
+  signerDid: string;
+  /**
+   * The document with the Data Integrity `proof` grafted on.
+   */
+  document: {};
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign-document/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeyType;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign-document/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysDeriveAndSignDocumentResponsePayload;

package/src/keys/import/0.1/payload.ts

@@ -36,6 +36,18 @@ export type KeysImportPayload = {
  * Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.
  */
 export type KeyType = "ed25519" | "x25519" | "p256";
+/**
+ * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
+ */
+export type KeyType1 = "ed25519" | "x25519" | "p256";
+/**
+ * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
+ */
+export type KeyStatus = "active" | "revoked";
+/**
+ * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.
+ */
+export type KeyOrigin = "derived" | "imported";
 
 /**
  * Ecosystem-defined extension members per SPEC.md §4.5.1.
@@ -43,9 +55,69 @@ export type KeyType = "ed25519" | "x25519" | "p256";
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/import request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/import/0.1#response.
+ */
+export interface KeysImportResponsePayload {
+  key: KeyRecord;
+  ext?: Ext1;
+}
+/**
+ * The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.
+ */
+export interface KeyRecord {
+  /**
+   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
+   */
+  keyId: string;
+  keyType: KeyType1;
+  status: KeyStatus;
+  /**
+   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
+   */
+  publicKey: string;
+  /**
+   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
+   */
+  derivationPath?: string;
+  /**
+   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
+   */
+  seedId?: number;
+  origin?: KeyOrigin;
+  /**
+   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
+   */
+  label?: string;
+  /**
+   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
+   */
+  contextId?: string;
+  /**
+   * RFC 3339 timestamp at which the key was created or imported.
+   */
+  createdAt: string;
+  /**
+   * RFC 3339 timestamp of the last change to the record (rename, revocation).
+   */
+  updatedAt?: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/import/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeysImportPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/import/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysImportResponsePayload;

package/src/keys/list/0.1/payload.ts

@@ -7,6 +7,18 @@
  * Return only keys in this lifecycle state. Omitted returns every state, including revoked keys.
  */
 export type KeyStatus = "active" | "revoked";
+/**
+ * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
+ */
+export type KeyType = "ed25519" | "x25519" | "p256";
+/**
+ * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
+ */
+export type KeyStatus1 = "active" | "revoked";
+/**
+ * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.
+ */
+export type KeyOrigin = "derived" | "imported";
 
 export interface KeysListPayload {
   status?: KeyStatus;
@@ -30,9 +42,81 @@ export interface KeysListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/list request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/list/0.1#response.
+ */
+export interface KeysListResponsePayload {
+  /**
+   * The page of records, in the custodian's own order.
+   */
+  keys: KeyRecord[];
+  /**
+   * How many records matched the filters in total. Required so a short page is never mistaken for the end of the set — the failure that makes a key audit or rotation sweep look complete when it is not.
+   */
+  total: number;
+  /**
+   * The offset this page starts at.
+   */
+  offset: number;
+  /**
+   * The page size actually applied, which MAY be smaller than the one requested.
+   */
+  limit: number;
+  ext?: Ext1;
+}
+export interface KeyRecord {
+  /**
+   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
+   */
+  keyId: string;
+  keyType: KeyType;
+  status: KeyStatus1;
+  /**
+   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
+   */
+  publicKey: string;
+  /**
+   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
+   */
+  derivationPath?: string;
+  /**
+   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
+   */
+  seedId?: number;
+  origin?: KeyOrigin;
+  /**
+   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
+   */
+  label?: string;
+  /**
+   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
+   */
+  contextId?: string;
+  /**
+   * RFC 3339 timestamp at which the key was created or imported.
+   */
+  createdAt: string;
+  /**
+   * RFC 3339 timestamp of the last change to the record (rename, revocation).
+   */
+  updatedAt?: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeyStatus;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysListResponsePayload;

package/src/keys/rename/0.1/payload.ts

@@ -23,9 +23,35 @@ export interface KeysRenamePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/rename request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/rename/0.1#response.
+ */
+export interface KeysRenameResponsePayload {
+  /**
+   * The identifier now in effect — the request's `newKeyId`.
+   */
+  keyId: string;
+  /**
+   * RFC 3339 timestamp of the rename.
+   */
+  updatedAt: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeysRenamePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysRenameResponsePayload;

package/src/keys/revoke/0.1/payload.ts

@@ -3,6 +3,11 @@
  * Source: specs/keys/revoke/0.1/payload.schema.json
  */
 
+/**
+ * The lifecycle state now in effect — `revoked` on success. Returned rather than assumed so a caller reading only the response can see the realized state.
+ */
+export type KeyStatus = "active" | "revoked";
+
 /**
  * Retire a key from further use. The record is retained so historic signatures stay attributable; this is not a delete.
  */
@@ -23,9 +28,36 @@ export interface KeysRevokePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/revoke request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/revoke/0.1#response.
+ */
+export interface KeysRevokeResponsePayload {
+  /**
+   * The key that was retired.
+   */
+  keyId: string;
+  status: KeyStatus;
+  /**
+   * RFC 3339 timestamp of the revocation. The boundary between signatures made while the key was valid and requests refused afterwards.
+   */
+  updatedAt: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/revoke/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeyStatus;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/revoke/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysRevokeResponsePayload;

package/src/keys/show/0.1/payload.ts

@@ -3,6 +3,19 @@
  * Source: specs/keys/show/0.1/payload.schema.json
  */
 
+/**
+ * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
+ */
+export type KeyType = "ed25519" | "x25519" | "p256";
+/**
+ * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
+ */
+export type KeyStatus = "active" | "revoked";
+/**
+ * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.
+ */
+export type KeyOrigin = "derived" | "imported";
+
 export interface KeysShowPayload {
   /**
    * Identifier of the key to read.
@@ -16,9 +29,69 @@ export interface KeysShowPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response to a keys/show request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/show/0.1#response.
+ */
+export interface KeysShowResponsePayload {
+  /**
+   * The record the custodian holds, or null where it holds none for this identifier. 'No such key' is a successful answer, not an error.
+   */
+  key: KeyRecord | null;
+  ext?: Ext1;
+}
+export interface KeyRecord {
+  /**
+   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
+   */
+  keyId: string;
+  keyType: KeyType;
+  status: KeyStatus;
+  /**
+   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
+   */
+  publicKey: string;
+  /**
+   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
+   */
+  derivationPath?: string;
+  /**
+   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
+   */
+  seedId?: number;
+  origin?: KeyOrigin;
+  /**
+   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
+   */
+  label?: string;
+  /**
+   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
+   */
+  contextId?: string;
+  /**
+   * RFC 3339 timestamp at which the key was created or imported.
+   */
+  createdAt: string;
+  /**
+   * RFC 3339 timestamp of the last change to the record (rename, revocation).
+   */
+  updatedAt?: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/show/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeyType;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/show/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysShowResponsePayload;