@openvtc/trust-tasks 0.26.10 → 0.26.11

package/dist/rooms/keys/act/0.2/payload.js

@@ -0,0 +1,305 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/keys/act/0.2/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/rooms/keys/act/0.2";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/keys/act/0.2#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/rooms/keys/act/0.2",
+    "title": "Rooms Keys Act — payload",
+    "description": "A member's own client asks the member's key holder to complete one host-bound room request as the member: the member's own authority narrowed to the one action the request's type needs, the member as issuer, and the member's signature. The outer document members are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "document"
+    ],
+    "properties": {
+        "document": {
+            "$ref": "#/$defs/UnsignedRoomRequest",
+            "description": "The room request to complete, as the client will send it, minus its presentation and its proof."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext",
+            "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+    },
+    "$defs": {
+        "UnsignedRoomRequest": {
+            "$anchor": "unsigned-room-request",
+            "title": "Unsigned room request",
+            "description": "A Trust Task document of a type in the rooms/keys/act table, built by the member's client: no proof, and no presentation in its payload. The recipient validates the payload against the named type's own schema; this one fixes only the envelope.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "type",
+                "recipient",
+                "issuedAt",
+                "payload"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512,
+                    "description": "The request's identifier, set by the client. The host keys duplicate-execution protection on it."
+                },
+                "type": {
+                    "type": "string",
+                    "pattern": "^https://trusttasks\\.org/spec/rooms/",
+                    "maxLength": 2048,
+                    "description": "The room request's Type URI. Only the types in this task's table are completed; any other is `typeNotActable`."
+                },
+                "issuer": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The member to act as, and this task's subject (subjectPath /document/issuer). REQUIRED for a type that names no room (rooms/blobs/chunk/0.1, rooms/blobs/upload/{commit,abort}/0.2), where it is the member whose request opened the transfer; REQUIRED where the caller may act as more than one member of the room; optional where it may act as exactly one. A rule over two members this schema does not express: the recipient refuses an absent issuer it needs with principalAmbiguous. Never the client's own identifier."
+                },
+                "recipient": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The room's host, which the completed document is for. Covered by the member's proof."
+                },
+                "issuedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "threadId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                },
+                "payload": {
+                    "type": "object",
+                    "description": "The request's payload, as the named type's schema defines it but without `presentation`: the recipient inserts the member's own, narrowed to the table's action, and refuses a payload that already carries one."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            },
+            "not": {
+                "required": [
+                    "proof"
+                ]
+            }
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "Rooms Keys Act — response payload",
+            "description": "Success response to rooms/keys/act. Type https://trusttasks.org/spec/rooms/keys/act/0.2#response. The request, completed as the member, for the caller to send to its recipient unaltered.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "principal",
+                "document"
+            ],
+            "properties": {
+                "principal": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The member the recipient signed as: the completed document's `issuer`."
+                },
+                "document": {
+                    "type": "object",
+                    "required": [
+                        "id",
+                        "type",
+                        "issuer",
+                        "recipient",
+                        "issuedAt",
+                        "payload",
+                        "proof"
+                    ],
+                    "description": "The supplied document with `issuer` set to the member, `payload.presentation` inserted where the type takes one, and the member's Data Integrity `proof` (`proofPurpose: authentication`). Every other member is unchanged."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the inserted presentation's leaf lapses. Absent when the type takes no presentation."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "UnsignedRoomRequest": {
+            "$anchor": "unsigned-room-request",
+            "title": "Unsigned room request",
+            "description": "A Trust Task document of a type in the rooms/keys/act table, built by the member's client: no proof, and no presentation in its payload. The recipient validates the payload against the named type's own schema; this one fixes only the envelope.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "type",
+                "recipient",
+                "issuedAt",
+                "payload"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512,
+                    "description": "The request's identifier, set by the client. The host keys duplicate-execution protection on it."
+                },
+                "type": {
+                    "type": "string",
+                    "pattern": "^https://trusttasks\\.org/spec/rooms/",
+                    "maxLength": 2048,
+                    "description": "The room request's Type URI. Only the types in this task's table are completed; any other is `typeNotActable`."
+                },
+                "issuer": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The member to act as, and this task's subject (subjectPath /document/issuer). REQUIRED for a type that names no room (rooms/blobs/chunk/0.1, rooms/blobs/upload/{commit,abort}/0.2), where it is the member whose request opened the transfer; REQUIRED where the caller may act as more than one member of the room; optional where it may act as exactly one. A rule over two members this schema does not express: the recipient refuses an absent issuer it needs with principalAmbiguous. Never the client's own identifier."
+                },
+                "recipient": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The room's host, which the completed document is for. Covered by the member's proof."
+                },
+                "issuedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "threadId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                },
+                "payload": {
+                    "type": "object",
+                    "description": "The request's payload, as the named type's schema defines it but without `presentation`: the recipient inserts the member's own, narrowed to the table's action, and refuses a payload that already carries one."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            },
+            "not": {
+                "required": [
+                    "proof"
+                ]
+            }
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "Rooms Keys Act — response payload",
+            "description": "Success response to rooms/keys/act. Type https://trusttasks.org/spec/rooms/keys/act/0.2#response. The request, completed as the member, for the caller to send to its recipient unaltered.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "principal",
+                "document"
+            ],
+            "properties": {
+                "principal": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The member the recipient signed as: the completed document's `issuer`."
+                },
+                "document": {
+                    "type": "object",
+                    "required": [
+                        "id",
+                        "type",
+                        "issuer",
+                        "recipient",
+                        "issuedAt",
+                        "payload",
+                        "proof"
+                    ],
+                    "description": "The supplied document with `issuer` set to the member, `payload.presentation` inserted where the type takes one, and the member's Data Integrity `proof` (`proofPurpose: authentication`). Every other member is unchanged."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the inserted presentation's leaf lapses. Absent when the type takes no presentation."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/rooms/keys/act/0.2/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/rooms/keys/act/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,gDAAyD,CAAC;AAKlF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,yDAAkE,CAAC;AAKpG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,gDAAgD;IACvD,OAAO,EAAE,0BAA0B;IACnC,aAAa,EAAE,gTAAgT;IAC/T,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,UAAU;KACX;IACD,YAAY,EAAE;QACZ,UAAU,EAAE;YACV,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,iGAAiG;SACjH;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,qBAAqB,EAAE;YACrB,SAAS,EAAE,uBAAuB;YAClC,OAAO,EAAE,uBAAuB;YAChC,aAAa,EAAE,qPAAqP;YACpQ,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,MAAM;gBACN,WAAW;gBACX,UAAU;gBACV,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,kGAAkG;iBAClH;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,uCAAuC;oBAClD,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,gHAAgH;iBAChI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,mgBAAmgB;iBACnhB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,sFAAsF;iBACtG;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;iBACjB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kNAAkN;iBAClO;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;YACD,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV,OAAO;iBACR;aACF;SACF;QACD,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,4LAA4L;YAC3M,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,wEAAwE;iBACxF;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE;wBACV,IAAI;wBACJ,MAAM;wBACN,QAAQ;wBACR,WAAW;wBACX,UAAU;wBACV,SAAS;wBACT,OAAO;qBACR;oBACD,aAAa,EAAE,6NAA6N;iBAC7O;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2FAA2F;iBAC3G;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,qBAAqB,EAAE;YACrB,SAAS,EAAE,uBAAuB;YAClC,OAAO,EAAE,uBAAuB;YAChC,aAAa,EAAE,qPAAqP;YACpQ,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,MAAM;gBACN,WAAW;gBACX,UAAU;gBACV,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,kGAAkG;iBAClH;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,uCAAuC;oBAClD,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,gHAAgH;iBAChI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,mgBAAmgB;iBACnhB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,sFAAsF;iBACtG;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;iBACjB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kNAAkN;iBAClO;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;YACD,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV,OAAO;iBACR;aACF;SACF;QACD,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,4LAA4L;YAC3M,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,wEAAwE;iBACxF;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE;wBACV,IAAI;wBACJ,MAAM;wBACN,QAAQ;wBACR,WAAW;wBACX,UAAU;wBACV,SAAS;wBACT,OAAO;qBACR;oBACD,aAAa,EAAE,6NAA6N;iBAC7O;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2FAA2F;iBAC3G;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/dist/rooms/keys/file-key/0.2/payload.d.ts

@@ -0,0 +1,306 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/keys/file-key/0.2/payload.schema.json
+ */
+import type { Ext } from "../../../../_shared/components.js";
+/**
+ * A caller asks the party holding its principal's room keys for the key of ONE file in a room: derived from the room's storage key for an epoch, bound to the room, the epoch and the file's identifier, and opening that file and nothing else.
+ */
+export interface RoomsKeysFileKeyPayload {
+    /**
+     * The room the file belongs to. Bound into the derivation, so a key released for one room cannot open a blob relocated from another.
+     */
+    roomId: string;
+    /**
+     * The file's identifier: 32 random bytes, base64url without padding, as in FileManifest.fileId. The salt of the derivation. For `seal` the caller mints it fresh and MUST NOT reuse it; for `open` it is read from the sealed record's file manifest.
+     */
+    fileId: string;
+    /**
+     * `seal`: a key for a file about to be uploaded, derived under the room's CURRENT epoch, which the response names. `open`: a key for a file already in the room, derived under the epoch its manifest names.
+     */
+    purpose: "seal" | "open";
+    /**
+     * The epoch the file key derives from, as FileManifest.epoch states it. REQUIRED for `open` and forbidden for `seal` — a rule over two members this schema does not express; the custodian refuses a violation with `malformedRequest`. A sealing caller never chooses the epoch: sealing under anything but the current one would produce a file members who joined later could not open, or one a removed member still could.
+     */
+    epoch?: number;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.
+ */
+export interface RoomsKeysFileKeyResponsePayload {
+    /**
+     * The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it.
+     */
+    key: string;
+    /**
+     * The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested.
+     */
+    epoch: number;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/rooms/keys/file-key/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsKeysFileKeyPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/keys/file-key/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsKeysFileKeyResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/rooms/keys/file-key/0.2";
+    readonly title: "Rooms Keys File Key — payload";
+    readonly description: "A caller asks the party holding its principal's room keys for the key of ONE file in a room: derived from the room's storage key for an epoch, bound to the room, the epoch and the file's identifier, and opening that file and nothing else.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["roomId", "fileId", "purpose"];
+    readonly properties: {
+        readonly roomId: {
+            readonly type: "string";
+            readonly description: "The room the file belongs to. Bound into the derivation, so a key released for one room cannot open a blob relocated from another.";
+        };
+        readonly fileId: {
+            readonly type: "string";
+            readonly pattern: "^[A-Za-z0-9_-]{43}$";
+            readonly description: "The file's identifier: 32 random bytes, base64url without padding, as in FileManifest.fileId. The salt of the derivation. For `seal` the caller mints it fresh and MUST NOT reuse it; for `open` it is read from the sealed record's file manifest.";
+        };
+        readonly purpose: {
+            readonly type: "string";
+            readonly enum: readonly ["seal", "open"];
+            readonly description: "`seal`: a key for a file about to be uploaded, derived under the room's CURRENT epoch, which the response names. `open`: a key for a file already in the room, derived under the epoch its manifest names.";
+        };
+        readonly epoch: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly description: "The epoch the file key derives from, as FileManifest.epoch states it. REQUIRED for `open` and forbidden for `seal` — a rule over two members this schema does not express; the custodian refuses a violation with `malformedRequest`. A sealing caller never chooses the epoch: sealing under anything but the current one would produce a file members who joined later could not open, or one a removed member still could.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Keys File Key — response payload";
+            readonly description: "Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["key", "epoch"];
+            readonly properties: {
+                readonly key: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z0-9_-]{43}$";
+                    readonly description: "The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it.";
+                };
+                readonly epoch: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Keys File Key — response payload";
+            readonly description: "Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["key", "epoch"];
+            readonly properties: {
+                readonly key: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z0-9_-]{43}$";
+                    readonly description: "The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it.";
+                };
+                readonly epoch: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/keys/file-key/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/rooms/keys/file-key/0.2";
+        readonly title: "Rooms Keys File Key — payload";
+        readonly description: "A caller asks the party holding its principal's room keys for the key of ONE file in a room: derived from the room's storage key for an epoch, bound to the room, the epoch and the file's identifier, and opening that file and nothing else.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["roomId", "fileId", "purpose"];
+        readonly properties: {
+            readonly roomId: {
+                readonly type: "string";
+                readonly description: "The room the file belongs to. Bound into the derivation, so a key released for one room cannot open a blob relocated from another.";
+            };
+            readonly fileId: {
+                readonly type: "string";
+                readonly pattern: "^[A-Za-z0-9_-]{43}$";
+                readonly description: "The file's identifier: 32 random bytes, base64url without padding, as in FileManifest.fileId. The salt of the derivation. For `seal` the caller mints it fresh and MUST NOT reuse it; for `open` it is read from the sealed record's file manifest.";
+            };
+            readonly purpose: {
+                readonly type: "string";
+                readonly enum: readonly ["seal", "open"];
+                readonly description: "`seal`: a key for a file about to be uploaded, derived under the room's CURRENT epoch, which the response names. `open`: a key for a file already in the room, derived under the epoch its manifest names.";
+            };
+            readonly epoch: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly description: "The epoch the file key derives from, as FileManifest.epoch states it. REQUIRED for `open` and forbidden for `seal` — a rule over two members this schema does not express; the custodian refuses a violation with `malformedRequest`. A sealing caller never chooses the epoch: sealing under anything but the current one would produce a file members who joined later could not open, or one a removed member still could.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Keys File Key — response payload";
+                readonly description: "Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["key", "epoch"];
+                readonly properties: {
+                    readonly key: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z0-9_-]{43}$";
+                        readonly description: "The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it.";
+                    };
+                    readonly epoch: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/keys/file-key/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Keys File Key — response payload";
+                readonly description: "Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["key", "epoch"];
+                readonly properties: {
+                    readonly key: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z0-9_-]{43}$";
+                        readonly description: "The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it.";
+                    };
+                    readonly epoch: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/rooms/keys/file-key/0.2/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/rooms/keys/file-key/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mCAAmC,CAAC;AAG7D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,CAAC;AAEpB,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,qDAA8D,CAAC;AAEvF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAE9C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,8DAAuE,CAAC;AAEzG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8EjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyC1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}