@openvtc/trust-tasks 0.23.6 → 0.23.7

package/dist/keys/sign-sshsig/0.1/payload.js

@@ -0,0 +1,196 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-sshsig/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/sign-sshsig/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/sign-sshsig/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/keys/sign-sshsig/0.1",
+    "title": "Keys — Sign SSHSIG — payload",
+    "description": "A request for an SSHSIG signature (the OpenSSH `PROTOCOL.sshsig` format git uses for SSH commit signing) over a message digest, made with a key the custodian holds. The producer supplies the digest and the namespace; the custodian builds the signed-data structure itself. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "keyId",
+        "algorithm",
+        "namespace",
+        "hashAlgorithm",
+        "messageHash"
+    ],
+    "properties": {
+        "keyId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Identifier of the key to sign with. The key MUST be `active`."
+        },
+        "algorithm": {
+            "type": "string",
+            "enum": [
+                "EdDSA",
+                "ES256"
+            ],
+            "description": "Signature algorithm, as a JOSE identifier: `EdDSA` with an `ed25519` key (SSH key type `ssh-ed25519`), `ES256` with a `p256` key (`ecdsa-sha2-nistp256`). These are the custodian-held key types SSHSIG defines a signature for. MUST be compatible with the named key's `keyType`. Closed: an unrecognised algorithm is refused, never substituted."
+        },
+        "namespace": {
+            "type": "string",
+            "pattern": "^[!-~]{1,128}$",
+            "description": "The SSHSIG namespace the signature is bound to — `git` for a git commit or tag, `file` for `ssh-keygen -Y sign` over a file. Printable ASCII without spaces. A signature made under one namespace does not verify under another, so the custodian MAY restrict which namespaces a producer may name."
+        },
+        "hashAlgorithm": {
+            "type": "string",
+            "enum": [
+                "sha256",
+                "sha512"
+            ],
+            "description": "The digest algorithm the producer applied to the message, in the SSHSIG spelling (externally owned, carried verbatim). It is written into the signed data, so the verifier recomputes the digest with the same algorithm."
+        },
+        "messageHash": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]+$",
+            "minLength": 43,
+            "maxLength": 86,
+            "description": "The digest of the message, `H(message)` in `PROTOCOL.sshsig`, base64url-encoded without padding: 32 bytes (43 characters) for `sha256`, 64 bytes (86 characters) for `sha512`. The custodian never sees the message itself."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext",
+            "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Keys — Sign SSHSIG — response payload",
+            "description": "The success response to a keys/sign-sshsig request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-sshsig/0.1#response. Failures use trust-task-error, not this shape.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "algorithm",
+                "signature"
+            ],
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+                },
+                "algorithm": {
+                    "type": "string",
+                    "enum": [
+                        "EdDSA",
+                        "ES256"
+                    ],
+                    "description": "The algorithm the signature was made with — the one the request named."
+                },
+                "signature": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_-]+$",
+                    "description": "The raw signature over the SSHSIG signed data, base64url-encoded without padding: 64 bytes for `EdDSA`; for `ES256`, the 64-byte JOSE `r || s` form, which the producer re-encodes as the two SSH `mpint`s when it assembles the SSHSIG blob."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Keys — Sign SSHSIG — response payload",
+            "description": "The success response to a keys/sign-sshsig request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-sshsig/0.1#response. Failures use trust-task-error, not this shape.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "algorithm",
+                "signature"
+            ],
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+                },
+                "algorithm": {
+                    "type": "string",
+                    "enum": [
+                        "EdDSA",
+                        "ES256"
+                    ],
+                    "description": "The algorithm the signature was made with — the one the request named."
+                },
+                "signature": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_-]+$",
+                    "description": "The raw signature over the SSHSIG signed data, base64url-encoded without padding: 64 bytes for `EdDSA`; for `ES256`, the 64-byte JOSE `r || s` form, which the producer re-encodes as the two SSH `mpint`s when it assembles the SSHSIG blob."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/keys/sign-sshsig/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/sign-sshsig/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,kDAA2D,CAAC;AAKpF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,2DAAoE,CAAC;AAKtG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,kDAAkD;IACzD,OAAO,EAAE,8BAA8B;IACvC,aAAa,EAAE,8YAA8Y;IAC7Z,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,OAAO;QACP,WAAW;QACX,WAAW;QACX,eAAe;QACf,aAAa;KACd;IACD,YAAY,EAAE;QACZ,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,+DAA+D;SAC/E;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,OAAO;gBACP,OAAO;aACR;YACD,aAAa,EAAE,sVAAsV;SACtW;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,sSAAsS;SACtT;QACD,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,QAAQ;aACT;YACD,aAAa,EAAE,2NAA2N;SAC3O;QACD,aAAa,EAAE;YACb,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,kBAAkB;YAC7B,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,6NAA6N;SAC7O;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,8MAA8M;YAC7N,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,6GAA6G;iBAC7H;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,OAAO;wBACP,OAAO;qBACR;oBACD,aAAa,EAAE,wEAAwE;iBACxF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,kBAAkB;oBAC7B,aAAa,EAAE,+OAA+O;iBAC/P;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,8MAA8M;YAC7N,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,6GAA6G;iBAC7H;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,OAAO;wBACP,OAAO;qBACR;oBACD,aAAa,EAAE,wEAAwE;iBACxF;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,kBAAkB;oBAC7B,aAAa,EAAE,+OAA+O;iBAC/P;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.23.6",
+  "version": "0.23.7",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_shared/components.ts

@@ -108,7 +108,8 @@ export type Capability_DeviceV0_1 =
   | "memory-write"
   | "room-present"
   | "room-open"
-  | "key-export";
+  | "key-export"
+  | "sign-sshsig";
 /**
  * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything.
  */
@@ -127,7 +128,8 @@ export type Capability_DeviceV0_2 =
   | "memoryWrite"
   | "roomPresent"
   | "roomOpen"
-  | "keyExport";
+  | "keyExport"
+  | "signSshsig";
 /**
  * Number of chunks in the bundle, equal to ceil(expectedSizeBytes / chunkSize). Bounded at 4096 so that the manifest itself — one digest per chunk — fits in the single document that carries it under the same message-size reasoning as a chunk.
  */

package/src/device/list/0.1/payload.ts

@@ -248,7 +248,8 @@ export const PAYLOAD_SCHEMA = {
         "memory-write",
         "room-present",
         "room-open",
-        "key-export"
+        "key-export",
+        "sign-sshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -587,7 +588,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memory-write",
         "room-present",
         "room-open",
-        "key-export"
+        "key-export",
+        "sign-sshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/list/0.2/payload.ts

@@ -248,7 +248,8 @@ export const PAYLOAD_SCHEMA = {
         "memoryWrite",
         "roomPresent",
         "roomOpen",
-        "keyExport"
+        "keyExport",
+        "signSshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -587,7 +588,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memoryWrite",
         "roomPresent",
         "roomOpen",
-        "keyExport"
+        "keyExport",
+        "signSshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/register/0.1/payload.ts

@@ -216,7 +216,8 @@ export const PAYLOAD_SCHEMA = {
         "memory-write",
         "room-present",
         "room-open",
-        "key-export"
+        "key-export",
+        "sign-sshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -545,7 +546,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memory-write",
         "room-present",
         "room-open",
-        "key-export"
+        "key-export",
+        "sign-sshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/register/0.2/payload.ts

@@ -216,7 +216,8 @@ export const PAYLOAD_SCHEMA = {
         "memoryWrite",
         "roomPresent",
         "roomOpen",
-        "keyExport"
+        "keyExport",
+        "signSshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -545,7 +546,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "memoryWrite",
         "roomPresent",
         "roomOpen",
-        "keyExport"
+        "keyExport",
+        "signSshsig"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/index.ts

@@ -279,6 +279,7 @@ export * as KeysRename_v0_1 from "./keys/rename/0.1/payload.js";
 export * as KeysRevoke_v0_1 from "./keys/revoke/0.1/payload.js";
 export * as KeysSetExportability_v0_1 from "./keys/set-exportability/0.1/payload.js";
 export * as KeysShow_v0_1 from "./keys/show/0.1/payload.js";
+export * as KeysSignSshsig_v0_1 from "./keys/sign-sshsig/0.1/payload.js";
 export * as KeysSign_v0_1 from "./keys/sign/0.1/payload.js";
 export * as MediatorOpsShared_v0_1 from "./messaging/_shared/0.1/mediator-ops.js";
 export * as MessagingShared_v0_1 from "./messaging/_shared/0.1/messaging.js";

package/src/keys/sign-sshsig/0.1/payload.ts

@@ -0,0 +1,261 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-sshsig/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../_shared/components.js";
+
+
+/**
+ * A request for an SSHSIG signature (the OpenSSH `PROTOCOL.sshsig` format git uses for SSH commit signing) over a message digest, made with a key the custodian holds. The producer supplies the digest and the namespace; the custodian builds the signed-data structure itself. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface KeysSignSSHSIGPayload {
+  /**
+   * Identifier of the key to sign with. The key MUST be `active`.
+   */
+  keyId: string;
+  /**
+   * Signature algorithm, as a JOSE identifier: `EdDSA` with an `ed25519` key (SSH key type `ssh-ed25519`), `ES256` with a `p256` key (`ecdsa-sha2-nistp256`). These are the custodian-held key types SSHSIG defines a signature for. MUST be compatible with the named key's `keyType`. Closed: an unrecognised algorithm is refused, never substituted.
+   */
+  algorithm: "EdDSA" | "ES256";
+  /**
+   * The SSHSIG namespace the signature is bound to — `git` for a git commit or tag, `file` for `ssh-keygen -Y sign` over a file. Printable ASCII without spaces. A signature made under one namespace does not verify under another, so the custodian MAY restrict which namespaces a producer may name.
+   */
+  namespace: string;
+  /**
+   * The digest algorithm the producer applied to the message, in the SSHSIG spelling (externally owned, carried verbatim). It is written into the signed data, so the verifier recomputes the digest with the same algorithm.
+   */
+  hashAlgorithm: "sha256" | "sha512";
+  /**
+   * The digest of the message, `H(message)` in `PROTOCOL.sshsig`, base64url-encoded without padding: 32 bytes (43 characters) for `sha256`, 64 bytes (86 characters) for `sha512`. The custodian never sees the message itself.
+   */
+  messageHash: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The success response to a keys/sign-sshsig request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-sshsig/0.1#response. Failures use trust-task-error, not this shape.
+ */
+export interface KeysSignSSHSIGResponsePayload {
+  /**
+   * The key that produced the signature. Echoed so a response separated from its request is still attributable.
+   */
+  keyId: string;
+  /**
+   * The algorithm the signature was made with — the one the request named.
+   */
+  algorithm: "EdDSA" | "ES256";
+  /**
+   * The raw signature over the SSHSIG signed data, base64url-encoded without padding: 64 bytes for `EdDSA`; for `ES256`, the 64-byte JOSE `r || s` form, which the producer re-encodes as the two SSH `mpint`s when it assembles the SSHSIG blob.
+   */
+  signature: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/sign-sshsig/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeysSignSSHSIGPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/sign-sshsig/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysSignSSHSIGResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/keys/sign-sshsig/0.1",
+  "title": "Keys — Sign SSHSIG — payload",
+  "description": "A request for an SSHSIG signature (the OpenSSH `PROTOCOL.sshsig` format git uses for SSH commit signing) over a message digest, made with a key the custodian holds. The producer supplies the digest and the namespace; the custodian builds the signed-data structure itself. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "keyId",
+    "algorithm",
+    "namespace",
+    "hashAlgorithm",
+    "messageHash"
+  ],
+  "properties": {
+    "keyId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Identifier of the key to sign with. The key MUST be `active`."
+    },
+    "algorithm": {
+      "type": "string",
+      "enum": [
+        "EdDSA",
+        "ES256"
+      ],
+      "description": "Signature algorithm, as a JOSE identifier: `EdDSA` with an `ed25519` key (SSH key type `ssh-ed25519`), `ES256` with a `p256` key (`ecdsa-sha2-nistp256`). These are the custodian-held key types SSHSIG defines a signature for. MUST be compatible with the named key's `keyType`. Closed: an unrecognised algorithm is refused, never substituted."
+    },
+    "namespace": {
+      "type": "string",
+      "pattern": "^[!-~]{1,128}$",
+      "description": "The SSHSIG namespace the signature is bound to — `git` for a git commit or tag, `file` for `ssh-keygen -Y sign` over a file. Printable ASCII without spaces. A signature made under one namespace does not verify under another, so the custodian MAY restrict which namespaces a producer may name."
+    },
+    "hashAlgorithm": {
+      "type": "string",
+      "enum": [
+        "sha256",
+        "sha512"
+      ],
+      "description": "The digest algorithm the producer applied to the message, in the SSHSIG spelling (externally owned, carried verbatim). It is written into the signed data, so the verifier recomputes the digest with the same algorithm."
+    },
+    "messageHash": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]+$",
+      "minLength": 43,
+      "maxLength": 86,
+      "description": "The digest of the message, `H(message)` in `PROTOCOL.sshsig`, base64url-encoded without padding: 32 bytes (43 characters) for `sha256`, 64 bytes (86 characters) for `sha512`. The custodian never sees the message itself."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Keys — Sign SSHSIG — response payload",
+      "description": "The success response to a keys/sign-sshsig request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-sshsig/0.1#response. Failures use trust-task-error, not this shape.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "algorithm",
+        "signature"
+      ],
+      "properties": {
+        "keyId": {
+          "type": "string",
+          "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+        },
+        "algorithm": {
+          "type": "string",
+          "enum": [
+            "EdDSA",
+            "ES256"
+          ],
+          "description": "The algorithm the signature was made with — the one the request named."
+        },
+        "signature": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]+$",
+          "description": "The raw signature over the SSHSIG signed data, base64url-encoded without padding: 64 bytes for `EdDSA`; for `ES256`, the 64-byte JOSE `r || s` form, which the producer re-encodes as the two SSH `mpint`s when it assembles the SSHSIG blob."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Keys — Sign SSHSIG — response payload",
+      "description": "The success response to a keys/sign-sshsig request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-sshsig/0.1#response. Failures use trust-task-error, not this shape.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "algorithm",
+        "signature"
+      ],
+      "properties": {
+        "keyId": {
+          "type": "string",
+          "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+        },
+        "algorithm": {
+          "type": "string",
+          "enum": [
+            "EdDSA",
+            "ES256"
+          ],
+          "description": "The algorithm the signature was made with — the one the request named."
+        },
+        "signature": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]+$",
+          "description": "The raw signature over the SSHSIG signed data, base64url-encoded without padding: 64 bytes for `EdDSA`; for `ES256`, the 64-byte JOSE `r || s` form, which the producer re-encodes as the two SSH `mpint`s when it assembles the SSHSIG blob."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;