@openvtc/trust-tasks 0.26.10 → 0.26.11

package/dist/rooms/keys/open/0.2/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/rooms/keys/open/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,iDAA0D,CAAC;AAKnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,0DAAmE,CAAC;AAKrG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,iDAAiD;IACxD,OAAO,EAAE,2BAA2B;IACpC,aAAa,EAAE,+KAA+K;IAC9L,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,QAAQ;QACR,KAAK;QACL,SAAS;QACT,QAAQ;KACT;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,8KAA8K;SAC9L;QACD,KAAK,EAAE;YACL,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,mCAAmC;SACnD;QACD,SAAS,EAAE;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,gHAAgH;SAChI;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;gBACZ,OAAO;gBACP,OAAO;aACR;YACD,aAAa,EAAE,oDAAoD;YACnE,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,YAAY;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,YAAY;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,sGAAsG;iBACtH;aACF;SACF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oCAAoC;YAC7C,aAAa,EAAE,qGAAqG;YACpH,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,iFAAiF;iBACjG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oCAAoC;YAC7C,aAAa,EAAE,qGAAqG;YACpH,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,iFAAiF;iBACjG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.26.10",
+  "version": "0.26.11",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/index.ts

@@ -445,14 +445,17 @@ export * as RoomsEpochMint_v0_1 from "./rooms/epoch/mint/0.1/payload.js";
 export * as RoomsEpochPrune_v0_1 from "./rooms/epoch/prune/0.1/payload.js";
 export * as RoomsInfo_v0_1 from "./rooms/info/0.1/payload.js";
 export * as RoomsKeysAct_v0_1 from "./rooms/keys/act/0.1/payload.js";
+export * as RoomsKeysAct_v0_2 from "./rooms/keys/act/0.2/payload.js";
 export * as RoomsKeysBackfill_v0_1 from "./rooms/keys/backfill/0.1/payload.js";
 export * as RoomsKeysBrowse_v0_1 from "./rooms/keys/browse/0.1/payload.js";
 export * as RoomsKeysChain_v0_1 from "./rooms/keys/chain/0.1/payload.js";
 export * as RoomsKeysCommit_v0_1 from "./rooms/keys/commit/0.1/payload.js";
 export * as RoomsKeysFileKey_v0_1 from "./rooms/keys/file-key/0.1/payload.js";
+export * as RoomsKeysFileKey_v0_2 from "./rooms/keys/file-key/0.2/payload.js";
 export * as RoomsKeysKeyPackage_v0_1 from "./rooms/keys/key-package/0.1/payload.js";
 export * as RoomsKeysList_v0_1 from "./rooms/keys/list/0.1/payload.js";
 export * as RoomsKeysOpen_v0_1 from "./rooms/keys/open/0.1/payload.js";
+export * as RoomsKeysOpen_v0_2 from "./rooms/keys/open/0.2/payload.js";
 export * as RoomsKeysPresent_v0_1 from "./rooms/keys/present/0.1/payload.js";
 export * as RoomsKeysPresent_v0_2 from "./rooms/keys/present/0.2/payload.js";
 export * as RoomsKeysRead_v0_1 from "./rooms/keys/read/0.1/payload.js";

package/src/rooms/keys/act/0.2/payload.ts

@@ -0,0 +1,380 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/keys/act/0.2/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * A member's own client asks the member's key holder to complete one host-bound room request as the member: the member's own authority narrowed to the one action the request's type needs, the member as issuer, and the member's signature. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface RoomsKeysActPayload {
+  document: UnsignedRoomRequest;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The room request to complete, as the client will send it, minus its presentation and its proof.
+ */
+export interface UnsignedRoomRequest {
+  /**
+   * The request's identifier, set by the client. The host keys duplicate-execution protection on it.
+   */
+  id: string;
+  /**
+   * The room request's Type URI. Only the types in this task's table are completed; any other is `typeNotActable`.
+   */
+  type: string;
+  /**
+   * The member to act as, and this task's subject (subjectPath /document/issuer). REQUIRED for a type that names no room (rooms/blobs/chunk/0.1, rooms/blobs/upload/{commit,abort}/0.2), where it is the member whose request opened the transfer; REQUIRED where the caller may act as more than one member of the room; optional where it may act as exactly one. A rule over two members this schema does not express: the recipient refuses an absent issuer it needs with principalAmbiguous. Never the client's own identifier.
+   */
+  issuer?: string;
+  /**
+   * The room's host, which the completed document is for. Covered by the member's proof.
+   */
+  recipient: string;
+  issuedAt: string;
+  expiresAt?: string;
+  threadId?: string;
+  /**
+   * The request's payload, as the named type's schema defines it but without `presentation`: the recipient inserts the member's own, narrowed to the table's action, and refuses a payload that already carries one.
+   */
+  payload: {};
+  ext?: Ext;
+}
+/**
+ * Success response to rooms/keys/act. Type https://trusttasks.org/spec/rooms/keys/act/0.2#response. The request, completed as the member, for the caller to send to its recipient unaltered.
+ */
+export interface RoomsKeysActResponsePayload {
+  /**
+   * The member the recipient signed as: the completed document's `issuer`.
+   */
+  principal: string;
+  /**
+   * The supplied document with `issuer` set to the member, `payload.presentation` inserted where the type takes one, and the member's Data Integrity `proof` (`proofPurpose: authentication`). Every other member is unchanged.
+   */
+  document: {};
+  /**
+   * When the inserted presentation's leaf lapses. Absent when the type takes no presentation.
+   */
+  expiresAt?: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/rooms/keys/act/0.2" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsKeysActPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/keys/act/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsKeysActResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/rooms/keys/act/0.2",
+  "title": "Rooms Keys Act — payload",
+  "description": "A member's own client asks the member's key holder to complete one host-bound room request as the member: the member's own authority narrowed to the one action the request's type needs, the member as issuer, and the member's signature. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "document"
+  ],
+  "properties": {
+    "document": {
+      "$ref": "#/$defs/UnsignedRoomRequest",
+      "description": "The room request to complete, as the client will send it, minus its presentation and its proof."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "UnsignedRoomRequest": {
+      "$anchor": "unsigned-room-request",
+      "title": "Unsigned room request",
+      "description": "A Trust Task document of a type in the rooms/keys/act table, built by the member's client: no proof, and no presentation in its payload. The recipient validates the payload against the named type's own schema; this one fixes only the envelope.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "type",
+        "recipient",
+        "issuedAt",
+        "payload"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The request's identifier, set by the client. The host keys duplicate-execution protection on it."
+        },
+        "type": {
+          "type": "string",
+          "pattern": "^https://trusttasks\\.org/spec/rooms/",
+          "maxLength": 2048,
+          "description": "The room request's Type URI. Only the types in this task's table are completed; any other is `typeNotActable`."
+        },
+        "issuer": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The member to act as, and this task's subject (subjectPath /document/issuer). REQUIRED for a type that names no room (rooms/blobs/chunk/0.1, rooms/blobs/upload/{commit,abort}/0.2), where it is the member whose request opened the transfer; REQUIRED where the caller may act as more than one member of the room; optional where it may act as exactly one. A rule over two members this schema does not express: the recipient refuses an absent issuer it needs with principalAmbiguous. Never the client's own identifier."
+        },
+        "recipient": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The room's host, which the completed document is for. Covered by the member's proof."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "threadId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "payload": {
+          "type": "object",
+          "description": "The request's payload, as the named type's schema defines it but without `presentation`: the recipient inserts the member's own, narrowed to the table's action, and refuses a payload that already carries one."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      },
+      "not": {
+        "required": [
+          "proof"
+        ]
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Keys Act — response payload",
+      "description": "Success response to rooms/keys/act. Type https://trusttasks.org/spec/rooms/keys/act/0.2#response. The request, completed as the member, for the caller to send to its recipient unaltered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "principal",
+        "document"
+      ],
+      "properties": {
+        "principal": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The member the recipient signed as: the completed document's `issuer`."
+        },
+        "document": {
+          "type": "object",
+          "required": [
+            "id",
+            "type",
+            "issuer",
+            "recipient",
+            "issuedAt",
+            "payload",
+            "proof"
+          ],
+          "description": "The supplied document with `issuer` set to the member, `payload.presentation` inserted where the type takes one, and the member's Data Integrity `proof` (`proofPurpose: authentication`). Every other member is unchanged."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the inserted presentation's leaf lapses. Absent when the type takes no presentation."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "UnsignedRoomRequest": {
+      "$anchor": "unsigned-room-request",
+      "title": "Unsigned room request",
+      "description": "A Trust Task document of a type in the rooms/keys/act table, built by the member's client: no proof, and no presentation in its payload. The recipient validates the payload against the named type's own schema; this one fixes only the envelope.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "type",
+        "recipient",
+        "issuedAt",
+        "payload"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The request's identifier, set by the client. The host keys duplicate-execution protection on it."
+        },
+        "type": {
+          "type": "string",
+          "pattern": "^https://trusttasks\\.org/spec/rooms/",
+          "maxLength": 2048,
+          "description": "The room request's Type URI. Only the types in this task's table are completed; any other is `typeNotActable`."
+        },
+        "issuer": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The member to act as, and this task's subject (subjectPath /document/issuer). REQUIRED for a type that names no room (rooms/blobs/chunk/0.1, rooms/blobs/upload/{commit,abort}/0.2), where it is the member whose request opened the transfer; REQUIRED where the caller may act as more than one member of the room; optional where it may act as exactly one. A rule over two members this schema does not express: the recipient refuses an absent issuer it needs with principalAmbiguous. Never the client's own identifier."
+        },
+        "recipient": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The room's host, which the completed document is for. Covered by the member's proof."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "threadId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "payload": {
+          "type": "object",
+          "description": "The request's payload, as the named type's schema defines it but without `presentation`: the recipient inserts the member's own, narrowed to the table's action, and refuses a payload that already carries one."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      },
+      "not": {
+        "required": [
+          "proof"
+        ]
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Keys Act — response payload",
+      "description": "Success response to rooms/keys/act. Type https://trusttasks.org/spec/rooms/keys/act/0.2#response. The request, completed as the member, for the caller to send to its recipient unaltered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "principal",
+        "document"
+      ],
+      "properties": {
+        "principal": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The member the recipient signed as: the completed document's `issuer`."
+        },
+        "document": {
+          "type": "object",
+          "required": [
+            "id",
+            "type",
+            "issuer",
+            "recipient",
+            "issuedAt",
+            "payload",
+            "proof"
+          ],
+          "description": "The supplied document with `issuer` set to the member, `payload.presentation` inserted where the type takes one, and the member's Data Integrity `proof` (`proofPurpose: authentication`). Every other member is unchanged."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the inserted presentation's leaf lapses. Absent when the type takes no presentation."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/rooms/keys/file-key/0.2/payload.ts

@@ -0,0 +1,224 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/keys/file-key/0.2/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * A caller asks the party holding its principal's room keys for the key of ONE file in a room: derived from the room's storage key for an epoch, bound to the room, the epoch and the file's identifier, and opening that file and nothing else.
+ */
+export interface RoomsKeysFileKeyPayload {
+  /**
+   * The room the file belongs to. Bound into the derivation, so a key released for one room cannot open a blob relocated from another.
+   */
+  roomId: string;
+  /**
+   * The file's identifier: 32 random bytes, base64url without padding, as in FileManifest.fileId. The salt of the derivation. For `seal` the caller mints it fresh and MUST NOT reuse it; for `open` it is read from the sealed record's file manifest.
+   */
+  fileId: string;
+  /**
+   * `seal`: a key for a file about to be uploaded, derived under the room's CURRENT epoch, which the response names. `open`: a key for a file already in the room, derived under the epoch its manifest names.
+   */
+  purpose: "seal" | "open";
+  /**
+   * The epoch the file key derives from, as FileManifest.epoch states it. REQUIRED for `open` and forbidden for `seal` — a rule over two members this schema does not express; the custodian refuses a violation with `malformedRequest`. A sealing caller never chooses the epoch: sealing under anything but the current one would produce a file members who joined later could not open, or one a removed member still could.
+   */
+  epoch?: number;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.
+ */
+export interface RoomsKeysFileKeyResponsePayload {
+  /**
+   * The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it.
+   */
+  key: string;
+  /**
+   * The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested.
+   */
+  epoch: number;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/rooms/keys/file-key/0.2" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsKeysFileKeyPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/keys/file-key/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsKeysFileKeyResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/rooms/keys/file-key/0.2",
+  "title": "Rooms Keys File Key — payload",
+  "description": "A caller asks the party holding its principal's room keys for the key of ONE file in a room: derived from the room's storage key for an epoch, bound to the room, the epoch and the file's identifier, and opening that file and nothing else.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "roomId",
+    "fileId",
+    "purpose"
+  ],
+  "properties": {
+    "roomId": {
+      "type": "string",
+      "description": "The room the file belongs to. Bound into the derivation, so a key released for one room cannot open a blob relocated from another."
+    },
+    "fileId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{43}$",
+      "description": "The file's identifier: 32 random bytes, base64url without padding, as in FileManifest.fileId. The salt of the derivation. For `seal` the caller mints it fresh and MUST NOT reuse it; for `open` it is read from the sealed record's file manifest."
+    },
+    "purpose": {
+      "type": "string",
+      "enum": [
+        "seal",
+        "open"
+      ],
+      "description": "`seal`: a key for a file about to be uploaded, derived under the room's CURRENT epoch, which the response names. `open`: a key for a file already in the room, derived under the epoch its manifest names."
+    },
+    "epoch": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "The epoch the file key derives from, as FileManifest.epoch states it. REQUIRED for `open` and forbidden for `seal` — a rule over two members this schema does not express; the custodian refuses a violation with `malformedRequest`. A sealing caller never chooses the epoch: sealing under anything but the current one would produce a file members who joined later could not open, or one a removed member still could."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Keys File Key — response payload",
+      "description": "Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "epoch"
+      ],
+      "properties": {
+        "key": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{43}$",
+          "description": "The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it."
+        },
+        "epoch": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Keys File Key — response payload",
+      "description": "Success response to rooms/keys/file-key. Type https://trusttasks.org/spec/rooms/keys/file-key/0.2#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "epoch"
+      ],
+      "properties": {
+        "key": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{43}$",
+          "description": "The 32-byte file key, base64url without padding. Opens exactly one file. The caller holds it in memory for as long as the file is being sealed or opened and then discards it; it never stores, logs or forwards it."
+        },
+        "epoch": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The epoch the key was derived under. For `seal`, the room's current epoch, which the caller writes into the file's manifest; for `open`, the epoch requested."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;