@openvtc/trust-tasks 0.22.4 → 0.22.6

package/dist/vtc/schemas/accepts/show/0.2/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/vtc/schemas/accepts/show/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,0DAAmE,CAAC;AAK5F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mEAA4E,CAAC;AAK9G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,0DAA0D;IACjE,OAAO,EAAE,wCAAwC;IACjD,aAAa,EAAE,uGAAuG;IACtH,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,IAAI;KACL;IACD,YAAY,EAAE;QACZ,IAAI,EAAE;YACJ,MAAM,EAAE,4BAA4B;SACrC;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,iDAAiD;YAC1D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,0BAA0B;iBACnC;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,kBAAkB,EAAE;YAClB,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,WAAW;gBACX,WAAW;gBACX,cAAc;aACf;YACD,mBAAmB,EAAE;gBACnB,OAAO,EAAE;oBACP,mBAAmB;iBACpB;gBACD,mBAAmB,EAAE;oBACnB,OAAO;iBACR;aACF;YACD,aAAa,EAAE,8bAA8b;YAC7c,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,4BAA4B;iBACrC;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,2GAA2G;iBAC3H;gBACD,mBAAmB,EAAE;oBACnB,MAAM,EAAE,2BAA2B;oBACnC,aAAa,EAAE,kEAAkE;iBAClF;gBACD,oBAAoB,EAAE;oBACpB,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,iQAAiQ;iBACjR;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,8BAA8B;iBACvC;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,6BAA6B;iBACtC;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,kFAAkF;iBAClG;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,sDAAsD;iBACtE;aACF;SACF;QACD,qBAAqB,EAAE;YACrB,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,IAAI;YAC5B,UAAU,EAAE;gBACV,SAAS;gBACT,eAAe;gBACf,eAAe;gBACf,iBAAiB;gBACjB,iBAAiB;aAClB;YACD,aAAa,EAAE,i6BAAi6B;YACh7B,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,qCAAqC;oBAChD,aAAa,EAAE,kFAAkF;iBAClG;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,2XAA2X;iBAC3Y;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,gGAAgG;iBAChH;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE;wBACf,MAAM,EAAE,uBAAuB;qBAChC;oBACD,sBAAsB,EAAE;wBACtB,MAAM,EAAE,SAAS;wBACjB,SAAS,EAAE,CAAC;qBACb;oBACD,aAAa,EAAE,uJAAuJ;iBACvK;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,uBAAuB;qBAChC;oBACD,aAAa,EAAE,wCAAwC;iBACxD;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,8BAA8B;qBACvC;oBACD,aAAa,EAAE,2OAA2O;iBAC3P;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,yKAAyK;iBACzL;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,qHAAqH;iBACrI;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,GAAG;4BAChB,SAAS,EAAE,0BAA0B;4BACrC,aAAa,EAAE,qUAAqU;yBACrV;qBACF;oBACD,aAAa,EAAE,4CAA4C;iBAC5D;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,YAAY,EAAE;wBACZ,2BAA2B,EAAE;4BAC3B,MAAM,EAAE,QAAQ;4BAChB,eAAe,EAAE;gCACf,MAAM,EAAE,6BAA6B;6BACtC;4BACD,sBAAsB,EAAE;gCACtB,MAAM,EAAE,SAAS;gCACjB,SAAS,EAAE,CAAC;6BACb;4BACD,aAAa,EAAE,gHAAgH;yBAChI;wBACD,qCAAqC,EAAE;4BACrC,MAAM,EAAE,SAAS;4BACjB,aAAa,EAAE,6IAA6I;yBAC7J;qBACF;oBACD,aAAa,EAAE,yFAAyF;iBACzG;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,UAAU;wBACV,UAAU;wBACV,MAAM;qBACP;oBACD,aAAa,EAAE,4LAA4L;iBAC5M;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,mBAAmB,EAAE;oBACnB,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,wBAAwB,EAAE;oBACxB,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,WAAW;oBACtB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,wGAAwG;iBACxH;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;iBAC9B;aACF;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,6GAA6G;YACxH,aAAa,EAAE,oQAAoQ;SACpR;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,m/BAAm/B;YAClgC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,mCAAmC;aAC/C;YACD,UAAU,EAAE;gBACV;oBACE,4BAA4B;iBAC7B;aACF;SACF;QACD,qBAAqB,EAAE;YACrB,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,MAAM;gBACN,oBAAoB;gBACpB,cAAc;gBACd,QAAQ;gBACR,eAAe;aAChB;YACD,aAAa,EAAE,uPAAuP;SACvQ;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,sBAAsB,EAAE;YACtB,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,iiBAAiiB;SACjjB;QACD,eAAe,EAAE;YACf,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,UAAU;gBACV,OAAO;gBACP,mBAAmB;aACpB;YACD,aAAa,EAAE,udAAud;SACve;QACD,sBAAsB,EAAE;YACtB,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,4aAA4a;SAC5b;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,KAAK;gBACL,WAAW;gBACX,YAAY;aACb;YACD,aAAa,EAAE,oeAAoe;SACpf;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,0UAA0U;SAC1V;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,QAAQ;aACT;YACD,aAAa,EAAE,qVAAqV;SACrW;QACD,oBAAoB,EAAE;YACpB,OAAO,EAAE,oBAAoB;YAC7B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,uUAAuU;SACvV;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,iDAAiD;YAC1D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,0BAA0B;iBACnC;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,kBAAkB,EAAE;YAClB,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,WAAW;gBACX,WAAW;gBACX,cAAc;aACf;YACD,mBAAmB,EAAE;gBACnB,OAAO,EAAE;oBACP,mBAAmB;iBACpB;gBACD,mBAAmB,EAAE;oBACnB,OAAO;iBACR;aACF;YACD,aAAa,EAAE,8bAA8b;YAC7c,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,4BAA4B;iBACrC;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,2GAA2G;iBAC3H;gBACD,mBAAmB,EAAE;oBACnB,MAAM,EAAE,2BAA2B;oBACnC,aAAa,EAAE,kEAAkE;iBAClF;gBACD,oBAAoB,EAAE;oBACpB,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,iQAAiQ;iBACjR;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,8BAA8B;iBACvC;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,6BAA6B;iBACtC;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,kFAAkF;iBAClG;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,sDAAsD;iBACtE;aACF;SACF;QACD,qBAAqB,EAAE;YACrB,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,IAAI;YAC5B,UAAU,EAAE;gBACV,SAAS;gBACT,eAAe;gBACf,eAAe;gBACf,iBAAiB;gBACjB,iBAAiB;aAClB;YACD,aAAa,EAAE,i6BAAi6B;YACh7B,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,qCAAqC;oBAChD,aAAa,EAAE,kFAAkF;iBAClG;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,2XAA2X;iBAC3Y;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,gGAAgG;iBAChH;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE;wBACf,MAAM,EAAE,uBAAuB;qBAChC;oBACD,sBAAsB,EAAE;wBACtB,MAAM,EAAE,SAAS;wBACjB,SAAS,EAAE,CAAC;qBACb;oBACD,aAAa,EAAE,uJAAuJ;iBACvK;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,uBAAuB;qBAChC;oBACD,aAAa,EAAE,wCAAwC;iBACxD;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,8BAA8B;qBACvC;oBACD,aAAa,EAAE,2OAA2O;iBAC3P;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,yKAAyK;iBACzL;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;oBACD,aAAa,EAAE,qHAAqH;iBACrI;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;4BACd,WAAW,EAAE,GAAG;4BAChB,SAAS,EAAE,0BAA0B;4BACrC,aAAa,EAAE,qUAAqU;yBACrV;qBACF;oBACD,aAAa,EAAE,4CAA4C;iBAC5D;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,YAAY,EAAE;wBACZ,2BAA2B,EAAE;4BAC3B,MAAM,EAAE,QAAQ;4BAChB,eAAe,EAAE;gCACf,MAAM,EAAE,6BAA6B;6BACtC;4BACD,sBAAsB,EAAE;gCACtB,MAAM,EAAE,SAAS;gCACjB,SAAS,EAAE,CAAC;6BACb;4BACD,aAAa,EAAE,gHAAgH;yBAChI;wBACD,qCAAqC,EAAE;4BACrC,MAAM,EAAE,SAAS;4BACjB,aAAa,EAAE,6IAA6I;yBAC7J;qBACF;oBACD,aAAa,EAAE,yFAAyF;iBACzG;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,UAAU;wBACV,UAAU;wBACV,MAAM;qBACP;oBACD,aAAa,EAAE,4LAA4L;iBAC5M;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,mBAAmB,EAAE;oBACnB,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,wBAAwB,EAAE;oBACxB,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,WAAW;oBACtB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,wGAAwG;iBACxH;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;iBAC9B;aACF;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,6GAA6G;YACxH,aAAa,EAAE,oQAAoQ;SACpR;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,m/BAAm/B;YAClgC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,mCAAmC;aAC/C;YACD,UAAU,EAAE;gBACV;oBACE,4BAA4B;iBAC7B;aACF;SACF;QACD,qBAAqB,EAAE;YACrB,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,MAAM;gBACN,oBAAoB;gBACpB,cAAc;gBACd,QAAQ;gBACR,eAAe;aAChB;YACD,aAAa,EAAE,uPAAuP;SACvQ;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,29BAA29B;YAC1+B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,iDAAiD;SAC7D;QACD,sBAAsB,EAAE;YACtB,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,iiBAAiiB;SACjjB;QACD,eAAe,EAAE;YACf,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,UAAU;gBACV,OAAO;gBACP,mBAAmB;aACpB;YACD,aAAa,EAAE,udAAud;SACve;QACD,sBAAsB,EAAE;YACtB,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,4aAA4a;SAC5b;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,KAAK;gBACL,WAAW;gBACX,YAAY;aACb;YACD,aAAa,EAAE,oeAAoe;SACpf;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,0UAA0U;SAC1V;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,WAAW;gBACX,QAAQ;aACT;YACD,aAAa,EAAE,qVAAqV;SACrW;QACD,oBAAoB,EAAE;YACpB,OAAO,EAAE,oBAAoB;YAC7B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,uUAAuU;SACvV;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.22.4",
+  "version": "0.22.6",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_shared/components.ts

@@ -20,6 +20,10 @@ export type AcceptsCriterionId = string;
  * The account's role at the mediator. `standard` is an ordinary served account; `admin`/`rootAdmin` may administer other accounts; `mediator` is the mediator's own account. Only a rootAdmin may assign or modify the rootAdmin role.
  */
 export type AccountType = "standard" | "admin" | "rootAdmin" | "mediator";
+/**
+ * How the community decides a submission that meets the criterion. `automatic`: it admits the applicant without a person deciding. `review`: it refers the submission to an administrator, who admits or rejects it; meeting the criterion never admits by itself. Which a criterion uses is the community's policy; this definition prefers neither.
+ */
+export type Admission = "automatic" | "review";
 /**
  * How often this room intends to write an `EpochAnchor`. **A statement of intent, not a schedule anything enforces** — nothing in this family can make an owner anchor.
  *
@@ -136,6 +140,10 @@ export type CountryCode = string;
  * Stable identifier for an issued credential — the handle for revocation and audit. Opaque to the holder: it MUST be echoed verbatim when revoking and MUST NOT be parsed.
  */
 export type CredentialId = string;
+/**
+ * Whose credentials meet the criterion's `query`. `community`: only credentials this community issued. `recognised`: credentials this community issued, or issued by a community it recognises (vtc/recognition/check). `any`: any issuer whose credential verifies — the query's own constraints, including DCQL `trusted_authorities`, are then all that limits it. A credential that does not verify (signature, validity window, revocation) never meets a criterion, whichever value is chosen.
+ */
+export type CredentialIssuers = "any" | "community" | "recognised";
 /**
  * A credential type URI — the W3C `type` value or the SD-JWT-VC `vct` a credential of this type carries. The registry's primary key, compared as an exact string after surrounding whitespace is trimmed. Bounded at 512 bytes because it keys the community's storage.
  */
@@ -143,7 +151,11 @@ export type CredentialTypeUri = string;
 /**
  * Plain-language summary of the criterion, written by the registering administrator. Published to prospective applicants in the join manifest, and used as the `purpose` of the credential-exchange/query a join sends when it is present — so it is read by applicants and their agents, not only by administrators. Untrusted as a statement of the rule: where it and `query` or `vetting` disagree, those govern.
  */
-export type CriterionDescription = string;
+export type CriterionDescription_VtcV0_1 = string;
+/**
+ * Plain-language summary of the criterion, written by the registering administrator. Published to prospective applicants in the join manifest, and used as the `purpose` of the credential-exchange/query a join sends when the criterion has a `query` — so it is read by applicants and their agents, not only by administrators. Untrusted as a statement of the rule: where it and the criterion's other members disagree, those govern.
+ */
+export type CriterionDescription_VtcV0_2 = string;
 /**
  * The root of the room's record tree — a host's commitment to *which records the room holds*, as distinct from what any one of them says.
  *
@@ -1006,10 +1018,39 @@ export type WorldColour = "slate" | "indigo" | "teal" | "moss" | "sand" | "clay"
 /**
  * A named required-evidence criterion: the DCQL query a ceremony runs to decide whether a holder's presented credentials satisfy the community, and the peer identity vetting it requires. What vtc/join-requests/manifest/0.2 publishes to applicants as a `Criterion` is derived from this.
  */
-export interface AcceptsCriterion {
+export interface AcceptsCriterion_VtcV0_1 {
   id: AcceptsCriterionId;
   query: DcqlQuery;
-  description?: CriterionDescription;
+  description?: CriterionDescription_VtcV0_1;
+  vetting?: VettingRequirements;
+  /**
+   * When this criterion was last registered. Registering an existing id replaces it.
+   */
+  createdAt: string;
+  /**
+   * The administrator who last registered the criterion.
+   */
+  createdByDid: string;
+}
+/**
+ * One way into the community: what an applicant must present, and how a submission that presents it is decided. Every requirement it states must be met; requirements it does not state are not requirements. A criterion stating none is met by every submission. A community's criteria are alternatives: a submission is decided under the one it names. What vtc/join-requests/manifest/0.3 publishes to applicants as a `Criterion` is derived from this.
+ */
+export interface AcceptsCriterion_VtcV0_2 {
+  id: AcceptsCriterionId;
+  admission: Admission;
+  /**
+   * The credentials an applicant must present, as a DCQL query. Absent: the criterion requires no credential.
+   */
+  query?: DcqlQuery;
+  /**
+   * Whose credentials meet `query`. Present exactly when `query` is.
+   */
+  credentialIssuers?: CredentialIssuers;
+  /**
+   * True: a submission meets the criterion only when it carries a valid, unconsumed invitation credential this community issued to the applicant. Absent or false: an invitation plays no part in meeting this criterion (another criterion may still require one).
+   */
+  invitationRequired?: boolean;
+  description?: CriterionDescription_VtcV0_2;
   vetting?: VettingRequirements;
   /**
    * When this criterion was last registered. Registering an existing id replaces it.

package/src/auth/signing-key/authorize/0.1/payload.ts

@@ -0,0 +1,141 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/signing-key/authorize/0.1/payload.schema.json
+ */
+
+import type { DeviceLabel, Ext, SigningKeyDid, SigningKeyScope } from "../../../../_shared/components.js";
+
+
+/**
+ * The terms of one signing-key enrolment, signed by the identity the key will act for. Exactly the payload of the auth/signing-key/enroll/0.2 document that carries this one as its `authorization`, with that member removed; the consumer compares the two and refuses any difference. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthSigningKeyAuthorizePayload {
+  signingKeyDid: SigningKeyDid;
+  /**
+   * The identity authorizing the delegation. Equal to the document's `issuer`: the identity signs for itself.
+   */
+  identityDid: string;
+  scope: SigningKeyScope;
+  deviceLabel?: DeviceLabel;
+  /**
+   * The lifetime the enrolment requests, as in auth/signing-key/enroll/0.2.
+   */
+  expiresAt?: string;
+  /**
+   * The identity's active key the enrolment replaces, as in auth/signing-key/enroll/0.2. Signed here so an authorization to add a key cannot be reused to remove one.
+   */
+  replaces?: SigningKeyDid;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeviceLabel, Ext, SigningKeyDid, SigningKeyScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/authorize/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSigningKeyAuthorizePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/signing-key/authorize/0.1",
+  "title": "Auth — Signing Key Authorize — payload",
+  "description": "The terms of one signing-key enrolment, signed by the identity the key will act for. Exactly the payload of the auth/signing-key/enroll/0.2 document that carries this one as its `authorization`, with that member removed; the consumer compares the two and refuses any difference. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "signingKeyDid",
+    "identityDid",
+    "scope"
+  ],
+  "properties": {
+    "signingKeyDid": {
+      "$ref": "#/$defs/SigningKeyDid"
+    },
+    "identityDid": {
+      "type": "string",
+      "pattern": "^did:",
+      "minLength": 5,
+      "maxLength": 2048,
+      "description": "The identity authorizing the delegation. Equal to the document's `issuer`: the identity signs for itself."
+    },
+    "scope": {
+      "$ref": "#/$defs/SigningKeyScope"
+    },
+    "deviceLabel": {
+      "$ref": "#/$defs/DeviceLabel"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "The lifetime the enrolment requests, as in auth/signing-key/enroll/0.2."
+    },
+    "replaces": {
+      "$ref": "#/$defs/SigningKeyDid",
+      "description": "The identity's active key the enrolment replaces, as in auth/signing-key/enroll/0.2. Signed here so an authorization to add a key cannot be reused to remove one."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;

package/src/auth/signing-key/enroll/0.2/payload.ts

@@ -0,0 +1,365 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/signing-key/enroll/0.2/payload.schema.json
+ */
+
+import type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope } from "../../../../_shared/components.js";
+
+
+/**
+ * A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires — an operation-bound step-up, or the identity's own signed `authorization` — never by the key's own signature. Optionally replaces one of the identity's active keys in the same step. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface AuthSigningKeyEnrollPayload {
+  signingKeyDid: SigningKeyDid;
+  /**
+   * The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization).
+   */
+  identityDid: string;
+  scope: SigningKeyScope;
+  deviceLabel?: DeviceLabel;
+  /**
+   * A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task.
+   */
+  expiresAt?: string;
+  /**
+   * An active delegation of the same identity to revoke in the same step as this enrolment. For a holder at the consumer's cap on active keys, whose other keys live on devices it no longer has: one authorized enrolment swaps a key out rather than needing a working key to revoke one first. Covered by the authority evidence like every other member, so evidence for adding a key cannot be reused to remove one.
+   */
+  replaces?: SigningKeyDid;
+  /**
+   * A complete, signed auth/signing-key/authorize/0.1 Trust Task document by which `identityDid` itself authorizes this enrolment: its payload is this payload with `authorization` removed. When present and valid it is the authority evidence of control over `identityDid`, in place of an operation-bound step-up. The consumer verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over the members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow.
+   */
+  authorization?: {};
+  ext?: Ext;
+}
+/**
+ * The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.
+ */
+export interface AuthSigningKeyEnrollResponsePayload {
+  signingKey: SigningKey;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeviceLabel, Ext, SigningKey, SigningKeyDid, SigningKeyScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/enroll/0.2" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSigningKeyEnrollPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/signing-key/enroll/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthSigningKeyEnrollResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/signing-key/enroll/0.2",
+  "title": "Auth — Signing Key Enroll — payload",
+  "description": "A freshly generated key asks to be enrolled as a signing-key delegation of an identity: documents it signs will be authorized by that identity's standing. The document is issued and proved by the key being enrolled, which is the proof that the enrolling party holds it; the identity it will act for is named in the payload and is established by the authority evidence the consumer requires — an operation-bound step-up, or the identity's own signed `authorization` — never by the key's own signature. Optionally replaces one of the identity's active keys in the same step. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "signingKeyDid",
+    "identityDid",
+    "scope"
+  ],
+  "properties": {
+    "signingKeyDid": {
+      "$ref": "#/$defs/SigningKeyDid"
+    },
+    "identityDid": {
+      "type": "string",
+      "pattern": "^did:",
+      "minLength": 5,
+      "maxLength": 2048,
+      "description": "The identity the key will act for — the DID whose standing a document signed by the key is authorized by. Naming it is not claiming it: the consumer establishes that the enrolling party controls this identity from separate authority evidence (Authorization)."
+    },
+    "scope": {
+      "$ref": "#/$defs/SigningKeyScope"
+    },
+    "deviceLabel": {
+      "$ref": "#/$defs/DeviceLabel"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "A requested lifetime for the delegation. The consumer sets the delegation's actual expiry — no later than this, and no later than its own cap — and returns it; absent means the consumer's default lifetime. MUST be in the future when the consumer executes the task."
+    },
+    "replaces": {
+      "$ref": "#/$defs/SigningKeyDid",
+      "description": "An active delegation of the same identity to revoke in the same step as this enrolment. For a holder at the consumer's cap on active keys, whose other keys live on devices it no longer has: one authorized enrolment swaps a key out rather than needing a working key to revoke one first. Covered by the authority evidence like every other member, so evidence for adding a key cannot be reused to remove one."
+    },
+    "authorization": {
+      "type": "object",
+      "description": "A complete, signed auth/signing-key/authorize/0.1 Trust Task document by which `identityDid` itself authorizes this enrolment: its payload is this payload with `authorization` removed. When present and valid it is the authority evidence of control over `identityDid`, in place of an operation-bound step-up. The consumer verifies it as a document in its own right — envelope, proof and payload against that specification's schemas — and over the members exactly as received: its proof covers every member, including ones this schema does not name, so it is deliberately an open object here rather than a typed one a binding could narrow."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key Enroll — response payload",
+      "description": "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKey"
+      ],
+      "properties": {
+        "signingKey": {
+          "$ref": "#/$defs/SigningKey"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth — Signing Key Enroll — response payload",
+      "description": "The delegation as stored. From this point a document the key signs is authorized by the identity's standing, read at execution time.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKey"
+      ],
+      "properties": {
+        "signingKey": {
+          "$ref": "#/$defs/SigningKey"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SigningKey": {
+      "title": "SigningKey",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signingKeyDid",
+        "identityDid",
+        "scope",
+        "createdAt",
+        "expiresAt",
+        "active"
+      ],
+      "description": "One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.",
+      "properties": {
+        "signingKeyDid": {
+          "$ref": "#/$defs/SigningKeyDid"
+        },
+        "identityDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "minLength": 5,
+          "maxLength": 2048,
+          "description": "The identity the key acts for. Included so a holder need not infer it."
+        },
+        "scope": {
+          "$ref": "#/$defs/SigningKeyScope"
+        },
+        "deviceLabel": {
+          "$ref": "#/$defs/DeviceLabel"
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was enrolled."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation stops authorizing documents. Always present: the consumer sets it at enrolment and caps it at its own maximum lifetime, whatever the producer asked for, so no delegation outlives the consumer's policy."
+        },
+        "lastUsedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation last authorized a document, as far as the consumer recorded. A usability signal for choosing which key to revoke, recorded best-effort; its absence does not mean the key was never used."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the delegation was revoked. A revoked delegation authorizes nothing and its key cannot be enrolled again."
+        },
+        "active": {
+          "type": "boolean",
+          "description": "Whether the delegation authorizes documents right now: not revoked and not past `expiresAt`. Computed by the consumer with the predicate its verifier applies, so a holder does not re-implement it and disagree."
+        }
+      }
+    },
+    "DeviceLabel": {
+      "title": "DeviceLabel",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "A human-readable name for where the key lives, chosen by the enrolling identity — e.g. `Work laptop — Chrome`. Read by that identity and by administrators deciding which key to revoke; retained with the delegation. Free text authored by the enrolling identity, untrusted, and attributed to it wherever it is rendered. Absent rather than invented when none was chosen: an invented label is indistinguishable from a chosen one to somebody deciding which key to revoke."
+    },
+    "SigningKeyScope": {
+      "title": "SigningKeyScope",
+      "type": "string",
+      "enum": [
+        "console"
+      ],
+      "description": "What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values."
+    },
+    "SigningKeyDid": {
+      "title": "SigningKeyDid",
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 256,
+      "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]+$",
+      "description": "The delegated key, as a `did:key` — an Ed25519 multikey (`z6Mk…`) derived from the public half of a keypair the holder generated for itself, typically a non-extractable browser key. `did:key` only, because its document is a function of the key and resolves with no network: a key whose DID document could be rewritten after enrolment is not the key that was enrolled."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;