@openvtc/trust-tasks 0.24.1 → 0.25.0

package/dist/keys/sign-jws/0.1/payload.d.ts

@@ -0,0 +1,352 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-jws/0.1/payload.schema.json
+ */
+import type { Ext } from "../../../_shared/components.js";
+/**
+ * A request for a compact JWS (RFC 7515) made with a key the custodian holds. The producer supplies the protected header members it wants and the payload; the custodian sets `alg` from the key, serialises both itself, and signs the JWS signing input with no framing of its own. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export type KeysSignJWSPayload = {
+    /**
+     * Identifier of the key to sign with, as `keys/show` describes it. The key MUST be `active` and of a type with a JOSE signature algorithm.
+     */
+    keyId: string;
+    /**
+     * Protected header members the producer wants in the JWS — `typ`, `kid`, `x5c`, `cty`, or a profile's own (swiyu's `profile_version`). Member names and values are JOSE's and the profile's, carried verbatim. The custodian adds `alg` itself and refuses `alg`, `crit`, `b64`, `jwk`, `jku` and `x5u` (see the specification's Conformance section). Absent means a header of `alg` alone.
+     */
+    header?: {};
+    /**
+     * The JWS payload, as a JSON object — for an OpenID4VP request object or any other JWT, its claims set. The custodian serialises it (RFC 8785) and base64url-encodes the result. Exactly one of `payload` and `payloadBase64Url` is present.
+     */
+    payload?: {};
+    /**
+     * The JWS payload as bytes, for a payload that is not a JSON object, base64url-encoded without padding. The custodian uses this string as the payload segment unchanged, after checking it is the canonical encoding of the bytes it decodes to. Exactly one of `payload` and `payloadBase64Url` is present.
+     */
+    payloadBase64Url?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+} & {
+    [k: string]: unknown | undefined;
+};
+/**
+ * The success response to a keys/sign-jws request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-jws/0.1#response. Failures use trust-task-error, not this shape.
+ */
+export interface KeysSignJWSResponsePayload {
+    /**
+     * The key that produced the signature. Echoed so a response separated from its request is still attributable.
+     */
+    keyId: string;
+    /**
+     * The JOSE algorithm the custodian chose from the key's type and wrote into the header: `EdDSA` for `ed25519`, `ES256` for `p256`, `ES256K` for a secp256k1 key, `ML-DSA-44` and `ML-DSA-65` for `mldsa44` and `mldsa65`. Externally owned, carried verbatim.
+     */
+    alg: "EdDSA" | "ES256" | "ES256K" | "ML-DSA-44" | "ML-DSA-65";
+    /**
+     * The JWS in compact serialisation: BASE64URL(header) '.' BASE64URL(payload) '.' BASE64URL(signature), unpadded. For ECDSA the signature is the fixed-width `r || s` of RFC 7518 §3.4, not DER.
+     */
+    jws: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/keys/sign-jws/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeysSignJWSPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/sign-jws/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysSignJWSResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/keys/sign-jws/0.1";
+    readonly title: "Keys — Sign JWS — payload";
+    readonly description: "A request for a compact JWS (RFC 7515) made with a key the custodian holds. The producer supplies the protected header members it wants and the payload; the custodian sets `alg` from the key, serialises both itself, and signs the JWS signing input with no framing of its own. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["keyId"];
+    readonly oneOf: readonly [{
+        readonly required: readonly ["payload"];
+        readonly not: {
+            readonly required: readonly ["payloadBase64Url"];
+        };
+    }, {
+        readonly required: readonly ["payloadBase64Url"];
+        readonly not: {
+            readonly required: readonly ["payload"];
+        };
+    }];
+    readonly properties: {
+        readonly keyId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Identifier of the key to sign with, as `keys/show` describes it. The key MUST be `active` and of a type with a JOSE signature algorithm.";
+        };
+        readonly header: {
+            readonly type: "object";
+            readonly maxProperties: 32;
+            readonly description: "Protected header members the producer wants in the JWS — `typ`, `kid`, `x5c`, `cty`, or a profile's own (swiyu's `profile_version`). Member names and values are JOSE's and the profile's, carried verbatim. The custodian adds `alg` itself and refuses `alg`, `crit`, `b64`, `jwk`, `jku` and `x5u` (see the specification's Conformance section). Absent means a header of `alg` alone.";
+        };
+        readonly payload: {
+            readonly type: "object";
+            readonly description: "The JWS payload, as a JSON object — for an OpenID4VP request object or any other JWT, its claims set. The custodian serialises it (RFC 8785) and base64url-encodes the result. Exactly one of `payload` and `payloadBase64Url` is present.";
+        };
+        readonly payloadBase64Url: {
+            readonly type: "string";
+            readonly minLength: 2;
+            readonly pattern: "^[A-Za-z0-9_-]+$";
+            readonly description: "The JWS payload as bytes, for a payload that is not a JSON object, base64url-encoded without padding. The custodian uses this string as the payload segment unchanged, after checking it is the canonical encoding of the bytes it decodes to. Exactly one of `payload` and `payloadBase64Url` is present.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys — Sign JWS — response payload";
+            readonly description: "The success response to a keys/sign-jws request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-jws/0.1#response. Failures use trust-task-error, not this shape.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "alg", "jws"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly description: "The key that produced the signature. Echoed so a response separated from its request is still attributable.";
+                };
+                readonly alg: {
+                    readonly type: "string";
+                    readonly enum: readonly ["EdDSA", "ES256", "ES256K", "ML-DSA-44", "ML-DSA-65"];
+                    readonly description: "The JOSE algorithm the custodian chose from the key's type and wrote into the header: `EdDSA` for `ed25519`, `ES256` for `p256`, `ES256K` for a secp256k1 key, `ML-DSA-44` and `ML-DSA-65` for `mldsa44` and `mldsa65`. Externally owned, carried verbatim.";
+                };
+                readonly jws: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$";
+                    readonly description: "The JWS in compact serialisation: BASE64URL(header) '.' BASE64URL(payload) '.' BASE64URL(signature), unpadded. For ECDSA the signature is the fixed-width `r || s` of RFC 7518 §3.4, not DER.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys — Sign JWS — response payload";
+            readonly description: "The success response to a keys/sign-jws request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-jws/0.1#response. Failures use trust-task-error, not this shape.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "alg", "jws"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly description: "The key that produced the signature. Echoed so a response separated from its request is still attributable.";
+                };
+                readonly alg: {
+                    readonly type: "string";
+                    readonly enum: readonly ["EdDSA", "ES256", "ES256K", "ML-DSA-44", "ML-DSA-65"];
+                    readonly description: "The JOSE algorithm the custodian chose from the key's type and wrote into the header: `EdDSA` for `ed25519`, `ES256` for `p256`, `ES256K` for a secp256k1 key, `ML-DSA-44` and `ML-DSA-65` for `mldsa44` and `mldsa65`. Externally owned, carried verbatim.";
+                };
+                readonly jws: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$";
+                    readonly description: "The JWS in compact serialisation: BASE64URL(header) '.' BASE64URL(payload) '.' BASE64URL(signature), unpadded. For ECDSA the signature is the fixed-width `r || s` of RFC 7518 §3.4, not DER.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/keys/sign-jws/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/keys/sign-jws/0.1";
+        readonly title: "Keys — Sign JWS — payload";
+        readonly description: "A request for a compact JWS (RFC 7515) made with a key the custodian holds. The producer supplies the protected header members it wants and the payload; the custodian sets `alg` from the key, serialises both itself, and signs the JWS signing input with no framing of its own. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["keyId"];
+        readonly oneOf: readonly [{
+            readonly required: readonly ["payload"];
+            readonly not: {
+                readonly required: readonly ["payloadBase64Url"];
+            };
+        }, {
+            readonly required: readonly ["payloadBase64Url"];
+            readonly not: {
+                readonly required: readonly ["payload"];
+            };
+        }];
+        readonly properties: {
+            readonly keyId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Identifier of the key to sign with, as `keys/show` describes it. The key MUST be `active` and of a type with a JOSE signature algorithm.";
+            };
+            readonly header: {
+                readonly type: "object";
+                readonly maxProperties: 32;
+                readonly description: "Protected header members the producer wants in the JWS — `typ`, `kid`, `x5c`, `cty`, or a profile's own (swiyu's `profile_version`). Member names and values are JOSE's and the profile's, carried verbatim. The custodian adds `alg` itself and refuses `alg`, `crit`, `b64`, `jwk`, `jku` and `x5u` (see the specification's Conformance section). Absent means a header of `alg` alone.";
+            };
+            readonly payload: {
+                readonly type: "object";
+                readonly description: "The JWS payload, as a JSON object — for an OpenID4VP request object or any other JWT, its claims set. The custodian serialises it (RFC 8785) and base64url-encodes the result. Exactly one of `payload` and `payloadBase64Url` is present.";
+            };
+            readonly payloadBase64Url: {
+                readonly type: "string";
+                readonly minLength: 2;
+                readonly pattern: "^[A-Za-z0-9_-]+$";
+                readonly description: "The JWS payload as bytes, for a payload that is not a JSON object, base64url-encoded without padding. The custodian uses this string as the payload segment unchanged, after checking it is the canonical encoding of the bytes it decodes to. Exactly one of `payload` and `payloadBase64Url` is present.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys — Sign JWS — response payload";
+                readonly description: "The success response to a keys/sign-jws request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-jws/0.1#response. Failures use trust-task-error, not this shape.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "alg", "jws"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly description: "The key that produced the signature. Echoed so a response separated from its request is still attributable.";
+                    };
+                    readonly alg: {
+                        readonly type: "string";
+                        readonly enum: readonly ["EdDSA", "ES256", "ES256K", "ML-DSA-44", "ML-DSA-65"];
+                        readonly description: "The JOSE algorithm the custodian chose from the key's type and wrote into the header: `EdDSA` for `ed25519`, `ES256` for `p256`, `ES256K` for a secp256k1 key, `ML-DSA-44` and `ML-DSA-65` for `mldsa44` and `mldsa65`. Externally owned, carried verbatim.";
+                    };
+                    readonly jws: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$";
+                        readonly description: "The JWS in compact serialisation: BASE64URL(header) '.' BASE64URL(payload) '.' BASE64URL(signature), unpadded. For ECDSA the signature is the fixed-width `r || s` of RFC 7518 §3.4, not DER.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/keys/sign-jws/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys — Sign JWS — response payload";
+                readonly description: "The success response to a keys/sign-jws request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-jws/0.1#response. Failures use trust-task-error, not this shape.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "alg", "jws"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly description: "The key that produced the signature. Echoed so a response separated from its request is still attributable.";
+                    };
+                    readonly alg: {
+                        readonly type: "string";
+                        readonly enum: readonly ["EdDSA", "ES256", "ES256K", "ML-DSA-44", "ML-DSA-65"];
+                        readonly description: "The JOSE algorithm the custodian chose from the key's type and wrote into the header: `EdDSA` for `ed25519`, `ES256` for `p256`, `ES256K` for a secp256k1 key, `ML-DSA-44` and `ML-DSA-65` for `mldsa44` and `mldsa65`. Externally owned, carried verbatim.";
+                    };
+                    readonly jws: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$";
+                        readonly description: "The JWS in compact serialisation: BASE64URL(header) '.' BASE64URL(payload) '.' BASE64URL(signature), unpadded. For ECDSA the signature is the fixed-width `r || s` of RFC 7518 §3.4, not DER.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/keys/sign-jws/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/sign-jws/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gCAAgC,CAAC;AAG1D;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,CAAC;IACZ;;OAEG;IACH,OAAO,CAAC,EAAE,EAAE,CAAC;IACb;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX,GAAG;IACF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;IAC9D;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,CAAC;AAEpB,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,+CAAwD,CAAC;AAEjF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEzC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,wDAAiE,CAAC;AAEnG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2GjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoD1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/keys/sign-jws/0.1/payload.js

@@ -0,0 +1,207 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-jws/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/sign-jws/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/sign-jws/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/keys/sign-jws/0.1",
+    "title": "Keys — Sign JWS — payload",
+    "description": "A request for a compact JWS (RFC 7515) made with a key the custodian holds. The producer supplies the protected header members it wants and the payload; the custodian sets `alg` from the key, serialises both itself, and signs the JWS signing input with no framing of its own. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "keyId"
+    ],
+    "oneOf": [
+        {
+            "required": [
+                "payload"
+            ],
+            "not": {
+                "required": [
+                    "payloadBase64Url"
+                ]
+            }
+        },
+        {
+            "required": [
+                "payloadBase64Url"
+            ],
+            "not": {
+                "required": [
+                    "payload"
+                ]
+            }
+        }
+    ],
+    "properties": {
+        "keyId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Identifier of the key to sign with, as `keys/show` describes it. The key MUST be `active` and of a type with a JOSE signature algorithm."
+        },
+        "header": {
+            "type": "object",
+            "maxProperties": 32,
+            "description": "Protected header members the producer wants in the JWS — `typ`, `kid`, `x5c`, `cty`, or a profile's own (swiyu's `profile_version`). Member names and values are JOSE's and the profile's, carried verbatim. The custodian adds `alg` itself and refuses `alg`, `crit`, `b64`, `jwk`, `jku` and `x5u` (see the specification's Conformance section). Absent means a header of `alg` alone."
+        },
+        "payload": {
+            "type": "object",
+            "description": "The JWS payload, as a JSON object — for an OpenID4VP request object or any other JWT, its claims set. The custodian serialises it (RFC 8785) and base64url-encodes the result. Exactly one of `payload` and `payloadBase64Url` is present."
+        },
+        "payloadBase64Url": {
+            "type": "string",
+            "minLength": 2,
+            "pattern": "^[A-Za-z0-9_-]+$",
+            "description": "The JWS payload as bytes, for a payload that is not a JSON object, base64url-encoded without padding. The custodian uses this string as the payload segment unchanged, after checking it is the canonical encoding of the bytes it decodes to. Exactly one of `payload` and `payloadBase64Url` is present."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext",
+            "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Keys — Sign JWS — response payload",
+            "description": "The success response to a keys/sign-jws request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-jws/0.1#response. Failures use trust-task-error, not this shape.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "alg",
+                "jws"
+            ],
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+                },
+                "alg": {
+                    "type": "string",
+                    "enum": [
+                        "EdDSA",
+                        "ES256",
+                        "ES256K",
+                        "ML-DSA-44",
+                        "ML-DSA-65"
+                    ],
+                    "description": "The JOSE algorithm the custodian chose from the key's type and wrote into the header: `EdDSA` for `ed25519`, `ES256` for `p256`, `ES256K` for a secp256k1 key, `ML-DSA-44` and `ML-DSA-65` for `mldsa44` and `mldsa65`. Externally owned, carried verbatim."
+                },
+                "jws": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$",
+                    "description": "The JWS in compact serialisation: BASE64URL(header) '.' BASE64URL(payload) '.' BASE64URL(signature), unpadded. For ECDSA the signature is the fixed-width `r || s` of RFC 7518 §3.4, not DER."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Keys — Sign JWS — response payload",
+            "description": "The success response to a keys/sign-jws request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-jws/0.1#response. Failures use trust-task-error, not this shape.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "alg",
+                "jws"
+            ],
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "description": "The key that produced the signature. Echoed so a response separated from its request is still attributable."
+                },
+                "alg": {
+                    "type": "string",
+                    "enum": [
+                        "EdDSA",
+                        "ES256",
+                        "ES256K",
+                        "ML-DSA-44",
+                        "ML-DSA-65"
+                    ],
+                    "description": "The JOSE algorithm the custodian chose from the key's type and wrote into the header: `EdDSA` for `ed25519`, `ES256` for `p256`, `ES256K` for a secp256k1 key, `ML-DSA-44` and `ML-DSA-65` for `mldsa44` and `mldsa65`. Externally owned, carried verbatim."
+                },
+                "jws": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$",
+                    "description": "The JWS in compact serialisation: BASE64URL(header) '.' BASE64URL(payload) '.' BASE64URL(signature), unpadded. For ECDSA the signature is the fixed-width `r || s` of RFC 7518 §3.4, not DER."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/keys/sign-jws/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/sign-jws/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,+CAAwD,CAAC;AAKjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wDAAiE,CAAC;AAKnG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,+CAA+C;IACtD,OAAO,EAAE,2BAA2B;IACpC,aAAa,EAAE,kZAAkZ;IACja,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,OAAO;KACR;IACD,OAAO,EAAE;QACP;YACE,UAAU,EAAE;gBACV,SAAS;aACV;YACD,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV,kBAAkB;iBACnB;aACF;SACF;QACD;YACE,UAAU,EAAE;gBACV,kBAAkB;aACnB;YACD,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV,SAAS;iBACV;aACF;SACF;KACF;IACD,YAAY,EAAE;QACZ,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,0IAA0I;SAC1J;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,4XAA4X;SAC5Y;QACD,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,4OAA4O;SAC5P;QACD,kBAAkB,EAAE;YAClB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,kBAAkB;YAC7B,aAAa,EAAE,4SAA4S;SAC5T;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oCAAoC;YAC7C,aAAa,EAAE,wMAAwM;YACvN,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,KAAK;gBACL,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,6GAA6G;iBAC7H;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,OAAO;wBACP,OAAO;wBACP,QAAQ;wBACR,WAAW;wBACX,WAAW;qBACZ;oBACD,aAAa,EAAE,6PAA6P;iBAC7Q;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,oDAAoD;oBAC/D,aAAa,EAAE,+LAA+L;iBAC/M;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oCAAoC;YAC7C,aAAa,EAAE,wMAAwM;YACvN,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,KAAK;gBACL,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,6GAA6G;iBAC7H;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,OAAO;wBACP,OAAO;wBACP,QAAQ;wBACR,WAAW;wBACX,WAAW;qBACZ;oBACD,aAAa,EAAE,6PAA6P;iBAC7Q;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,oDAAoD;oBAC/D,aAAa,EAAE,+LAA+L;iBAC/M;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/dist/rooms/_shared/0.1/blobs.d.ts

@@ -12,5 +12,5 @@ export interface RoomsSharedFileAndBlobTypes {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../../_shared/components.js".
  */
-export type { BlobManifest, BlobRef, RoomLimits, ScopeLimits, TransferId, Usage } from "../../../_shared/components.js";
+export type { BlobManifest, BlobRef, FileManifest, RoomLimits, ScopeLimits, TransferId, Usage } from "../../../_shared/components.js";
 //# sourceMappingURL=blobs.d.ts.map

package/dist/rooms/_shared/0.1/blobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../../../src/rooms/_shared/0.1/blobs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../../../src/rooms/_shared/0.1/blobs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/rooms/info/0.1/payload.d.ts

@@ -483,7 +483,7 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/rooms/info/0.1";
     readonly isBearer: false;
-    readonly isProofRequired: false;
+    readonly isProofRequired: true;
     readonly isRecipientRequired: true;
     readonly isIssuedAtRequired: false;
     readonly payloadSchema: {
@@ -702,7 +702,7 @@ export declare const SPEC: {
 export declare const RESPONSE_SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/rooms/info/0.1#response";
     readonly isBearer: false;
-    readonly isProofRequired: false;
+    readonly isProofRequired: true;
     readonly isRecipientRequired: true;
     readonly isIssuedAtRequired: false;
     readonly payloadSchema: {

package/dist/rooms/info/0.1/payload.js

@@ -477,7 +477,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
 export const SPEC = {
     typeUri: TYPE_URI,
     isBearer: false,
-    isProofRequired: false,
+    isProofRequired: true,
     isRecipientRequired: true,
     isIssuedAtRequired: false,
     payloadSchema: PAYLOAD_SCHEMA,
@@ -490,7 +490,7 @@ export const SPEC = {
 export const RESPONSE_SPEC = {
     typeUri: RESPONSE_TYPE_URI,
     isBearer: false,
-    isProofRequired: false,
+    isProofRequired: true,
     isRecipientRequired: true,
     isIssuedAtRequired: false,
     payloadSchema: RESPONSE_PAYLOAD_SCHEMA,