@openvtc/trust-tasks 0.21.11 → 0.21.13

package/src/auth/signing-key/enroll/0.1/payload.ts

@@ -0,0 +1,349 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/signing-key/enroll/0.1/payload.schema.json
+ */
+
+import type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope } from "../../../../_shared/components.js";
+
+
+/**
+ * A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires, never by the key's own signature. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthSigningKeyEnrollPayload {
+  signingKeyDid: SigningKeyDid;
+  /**
+   * The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization).
+   */
+  identityDid: string;
+  scope: SigningKeyScope;
+  deviceLabel?: DeviceLabel;
+  /**
+   * A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task.
+   */
+  expiresAt?: string;
+  ext?: Ext;
+}
+/**
+ * The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.
+ */
+export interface AuthSigningKeyEnrollResponsePayload {
+  signingKey: SigningKey;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/enroll/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSigningKeyEnrollPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/enroll/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthSigningKeyEnrollResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/signing-key/enroll/0.1",
+  "title": "Auth — Signing Key Enroll — payload",
+  "description": "A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires, never by the key's own signature. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "signingKeyDid",
+    "identityDid",
+    "scope"
+  ],
+  "properties": {
+    "signingKeyDid": {
+      "$ref": "#/$defs/SigningKeyDid"
+    },
+    "identityDid": {
+      "type": "string",
+      "pattern": "^did:",
+      "minLength": 5,
+      "maxLength": 2048,
+      "description": "The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization)."
+    },
+    "scope": {
+      "$ref": "#/$defs/SigningKeyScope"
+    },
+    "deviceLabel": {
+      "$ref": "#/$defs/DeviceLabel"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key Enroll — response payload",
+      "description": "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKey"
+      ],
+      "properties": {
+        "signingKey": {
+          "$ref": "#/$defs/SigningKey"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key Enroll — response payload",
+      "description": "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKey"
+      ],
+      "properties": {
+        "signingKey": {
+          "$ref": "#/$defs/SigningKey"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/auth/signing-key/list/0.1/payload.ts

@@ -0,0 +1,323 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/signing-key/list/0.1/payload.schema.json
+ */
+
+import type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope } from "../../../../_shared/components.js";
+
+
+/**
+ * An identity lists its own signing-key delegations. The payload names no subject: the identity listed is the one the document's proof resolves to, so a caller cannot ask for somebody else's. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface AuthSigningKeyListPayload {
+  ext?: Ext;
+}
+/**
+ * Every delegation enrolled for the caller's identity, newest first, revoked ones included.
+ */
+export interface AuthSigningKeyListResponsePayload {
+  /**
+   * @maxItems 256
+   */
+  signingKeys: SigningKey[];
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/list/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSigningKeyListPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthSigningKeyListResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/signing-key/list/0.1",
+  "title": "Auth — Signing Key List — payload",
+  "description": "An identity lists its own signing-key delegations. The payload names no subject: the identity listed is the one the document's proof resolves to, so a caller cannot ask for somebody else's. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key List — response payload",
+      "description": "Every delegation enrolled for the caller's identity, newest first, revoked ones included.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeys"
+      ],
+      "properties": {
+        "signingKeys": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/SigningKey"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key List — response payload",
+      "description": "Every delegation enrolled for the caller's identity, newest first, revoked ones included.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeys"
+      ],
+      "properties": {
+        "signingKeys": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/SigningKey"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;