@openvtc/trust-tasks 0.26.17 → 0.26.18

package/dist/keys/sign-document/0.1/payload.d.ts

@@ -0,0 +1,627 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-document/0.1/payload.schema.json
+ */
+import type { Ext } from "../../../_shared/components.js";
+/**
+ * A request for a W3C Data Integrity proof (`eddsa-jcs-2022`) over a JSON document, made with a key the custodian already holds, named by `keyId`. The document names its own signer — an `issuer` or a `controller` — and the custodian signs only as that DID, only with a key that DID's document lists under the requested proof purpose. The custodian canonicalises the document (RFC 8785), builds the proof configuration and the signing input itself; the producer never supplies bytes to sign. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface KeysSignDocumentPayload {
+    /**
+     * Identifier of the key to sign with, as `keys/show` describes it. The key MUST be `active`, `ed25519`, and a verification method of the DID the document names as its issuer or controller.
+     */
+    keyId: string;
+    /**
+     * The JSON document to secure — a verifiable credential, a Trust Task document, or another document that names its own signer. It MUST NOT carry `proof`, and MUST carry `issuer` (a DID, or an object whose `id` is a DID) or `controller` (a DID, or an array holding exactly one DID), every one present naming the DID the key belongs to. The custodian checks these rules itself (`proofPresent`, `documentInvalid`, `issuerMismatch`) rather than the schema, because the document is carried whole and every member is signed as given: a typed document would drop the members it does not name. The custodian serialises the whole object with RFC 8785.
+     */
+    document: {};
+    /**
+     * The verification relationship the proof is made under, carried verbatim into the proof (W3C Data Integrity). The key MUST be listed under this relationship in the signer DID's document. Absent means `assertionMethod`, which is what a credential's issuer signs under; `authentication` is for a document the DID presents as itself, such as a Trust Task document. Externally owned, carried verbatim.
+     */
+    proofPurpose?: "assertionMethod" | "authentication";
+    /**
+     * The proof's `created` value (an XML Schema dateTimeStamp, as Data Integrity requires). Absent means the custodian's own clock at signing. When present, the custodian refuses a value outside its acceptance window around its own clock with `keys:invalidArgument`: the key's signature dates the proof, so the producer cannot back- or forward-date it.
+     */
+    created?: string;
+    /**
+     * A challenge the proof's verifier issued, copied into the proof's `challenge` member verbatim (W3C Data Integrity). Absent means the proof carries none. The custodian does not interpret it.
+     */
+    challenge?: string;
+    /**
+     * The security domain the proof is restricted to, copied into the proof's `domain` member verbatim (W3C Data Integrity). Absent means the proof carries none. The custodian does not interpret it.
+     */
+    domain?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The success response to a keys/sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-document/0.1#response. Failures use trust-task-error, not this shape.
+ */
+export interface KeysSignDocumentResponsePayload {
+    /**
+     * The key that produced the proof. Echoed so a response separated from its request is still attributable.
+     */
+    keyId: string;
+    /**
+     * The DID the document was signed as — the one its `issuer` or `controller` names, and the DID a verifier resolves the proof's verification method against.
+     */
+    signerDid: string;
+    /**
+     * The request's document, unchanged, with `proof` added. Every other member is exactly as the producer sent it.
+     */
+    document: {};
+    proof: DataIntegrityProof;
+    ext?: Ext;
+}
+/**
+ * The proof the custodian attached to `document`, returned on its own so a producer need not dig it out.
+ */
+export interface DataIntegrityProof {
+    /**
+     * The document's own `@context`, copied into the proof configuration as `eddsa-jcs-2022` requires when the document has one; absent otherwise.
+     */
+    "@context"?: string | [unknown, ...unknown[]];
+    type: "DataIntegrityProof";
+    /**
+     * The only cryptosuite this version defines.
+     */
+    cryptosuite: "eddsa-jcs-2022";
+    created: string;
+    /**
+     * The DID URL of the key's verification method in the signer DID's document, chosen by the custodian.
+     */
+    verificationMethod: string;
+    proofPurpose: "assertionMethod" | "authentication";
+    challenge?: string;
+    domain?: string;
+    /**
+     * The Ed25519 signature, base58btc multibase-encoded.
+     */
+    proofValue: string;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/keys/sign-document/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeysSignDocumentPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/sign-document/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysSignDocumentResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/keys/sign-document/0.1";
+    readonly title: "Keys — Sign Document — payload";
+    readonly description: "A request for a W3C Data Integrity proof (`eddsa-jcs-2022`) over a JSON document, made with a key the custodian already holds, named by `keyId`. The document names its own signer — an `issuer` or a `controller` — and the custodian signs only as that DID, only with a key that DID's document lists under the requested proof purpose. The custodian canonicalises the document (RFC 8785), builds the proof configuration and the signing input itself; the producer never supplies bytes to sign. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["keyId", "document"];
+    readonly properties: {
+        readonly keyId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Identifier of the key to sign with, as `keys/show` describes it. The key MUST be `active`, `ed25519`, and a verification method of the DID the document names as its issuer or controller.";
+        };
+        readonly document: {
+            readonly type: "object";
+            readonly description: "The JSON document to secure — a verifiable credential, a Trust Task document, or another document that names its own signer. It MUST NOT carry `proof`, and MUST carry `issuer` (a DID, or an object whose `id` is a DID) or `controller` (a DID, or an array holding exactly one DID), every one present naming the DID the key belongs to. The custodian checks these rules itself (`proofPresent`, `documentInvalid`, `issuerMismatch`) rather than the schema, because the document is carried whole and every member is signed as given: a typed document would drop the members it does not name. The custodian serialises the whole object with RFC 8785.";
+        };
+        readonly proofPurpose: {
+            readonly type: "string";
+            readonly enum: readonly ["assertionMethod", "authentication"];
+            readonly description: "The verification relationship the proof is made under, carried verbatim into the proof (W3C Data Integrity). The key MUST be listed under this relationship in the signer DID's document. Absent means `assertionMethod`, which is what a credential's issuer signs under; `authentication` is for a document the DID presents as itself, such as a Trust Task document. Externally owned, carried verbatim.";
+        };
+        readonly created: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$";
+            readonly description: "The proof's `created` value (an XML Schema dateTimeStamp, as Data Integrity requires). Absent means the custodian's own clock at signing. When present, the custodian refuses a value outside its acceptance window around its own clock with `keys:invalidArgument`: the key's signature dates the proof, so the producer cannot back- or forward-date it.";
+        };
+        readonly challenge: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 1024;
+            readonly description: "A challenge the proof's verifier issued, copied into the proof's `challenge` member verbatim (W3C Data Integrity). Absent means the proof carries none. The custodian does not interpret it.";
+        };
+        readonly domain: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 1024;
+            readonly description: "The security domain the proof is restricted to, copied into the proof's `domain` member verbatim (W3C Data Integrity). Absent means the proof carries none. The custodian does not interpret it.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Did: {
+            readonly type: "string";
+            readonly minLength: 7;
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:[A-Za-z0-9._:%-]*[A-Za-z0-9._%-]$";
+            readonly description: "A DID (W3C DID Core §3.1) — never a DID URL: no path, query or fragment.";
+        };
+        readonly Proof: {
+            readonly title: "Data Integrity proof";
+            readonly description: "The proof the custodian made: a W3C `DataIntegrityProof` under the `eddsa-jcs-2022` cryptosuite. Member names and values are Data Integrity's, carried verbatim.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly properties: {
+                readonly "@context": {
+                    readonly description: "The document's own `@context`, copied into the proof configuration as `eddsa-jcs-2022` requires when the document has one; absent otherwise.";
+                    readonly oneOf: readonly [{
+                        readonly type: "string";
+                    }, {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                    }];
+                };
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly enum: readonly ["eddsa-jcs-2022"];
+                    readonly description: "The only cryptosuite this version defines.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly pattern: "^did:[a-z0-9]+:[^#\\s]+#[^\\s]+$";
+                    readonly description: "The DID URL of the key's verification method in the signer DID's document, chosen by the custodian.";
+                };
+                readonly proofPurpose: {
+                    readonly type: "string";
+                    readonly enum: readonly ["assertionMethod", "authentication"];
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                };
+                readonly domain: {
+                    readonly type: "string";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The Ed25519 signature, base58btc multibase-encoded.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys — Sign Document — response payload";
+            readonly description: "The success response to a keys/sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-document/0.1#response. Failures use trust-task-error, not this shape.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "signerDid", "document", "proof"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly description: "The key that produced the proof. Echoed so a response separated from its request is still attributable.";
+                };
+                readonly signerDid: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The DID the document was signed as — the one its `issuer` or `controller` names, and the DID a verifier resolves the proof's verification method against.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The request's document, unchanged, with `proof` added. Every other member is exactly as the producer sent it.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/Proof";
+                    readonly description: "The proof the custodian attached to `document`, returned on its own so a producer need not dig it out.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Did: {
+            readonly type: "string";
+            readonly minLength: 7;
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:[A-Za-z0-9._:%-]*[A-Za-z0-9._%-]$";
+            readonly description: "A DID (W3C DID Core §3.1) — never a DID URL: no path, query or fragment.";
+        };
+        readonly Proof: {
+            readonly title: "Data Integrity proof";
+            readonly description: "The proof the custodian made: a W3C `DataIntegrityProof` under the `eddsa-jcs-2022` cryptosuite. Member names and values are Data Integrity's, carried verbatim.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly properties: {
+                readonly "@context": {
+                    readonly description: "The document's own `@context`, copied into the proof configuration as `eddsa-jcs-2022` requires when the document has one; absent otherwise.";
+                    readonly oneOf: readonly [{
+                        readonly type: "string";
+                    }, {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                    }];
+                };
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly enum: readonly ["eddsa-jcs-2022"];
+                    readonly description: "The only cryptosuite this version defines.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly pattern: "^did:[a-z0-9]+:[^#\\s]+#[^\\s]+$";
+                    readonly description: "The DID URL of the key's verification method in the signer DID's document, chosen by the custodian.";
+                };
+                readonly proofPurpose: {
+                    readonly type: "string";
+                    readonly enum: readonly ["assertionMethod", "authentication"];
+                };
+                readonly challenge: {
+                    readonly type: "string";
+                };
+                readonly domain: {
+                    readonly type: "string";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The Ed25519 signature, base58btc multibase-encoded.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys — Sign Document — response payload";
+            readonly description: "The success response to a keys/sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-document/0.1#response. Failures use trust-task-error, not this shape.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "signerDid", "document", "proof"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly description: "The key that produced the proof. Echoed so a response separated from its request is still attributable.";
+                };
+                readonly signerDid: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The DID the document was signed as — the one its `issuer` or `controller` names, and the DID a verifier resolves the proof's verification method against.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The request's document, unchanged, with `proof` added. Every other member is exactly as the producer sent it.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/Proof";
+                    readonly description: "The proof the custodian attached to `document`, returned on its own so a producer need not dig it out.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/keys/sign-document/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/keys/sign-document/0.1";
+        readonly title: "Keys — Sign Document — payload";
+        readonly description: "A request for a W3C Data Integrity proof (`eddsa-jcs-2022`) over a JSON document, made with a key the custodian already holds, named by `keyId`. The document names its own signer — an `issuer` or a `controller` — and the custodian signs only as that DID, only with a key that DID's document lists under the requested proof purpose. The custodian canonicalises the document (RFC 8785), builds the proof configuration and the signing input itself; the producer never supplies bytes to sign. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["keyId", "document"];
+        readonly properties: {
+            readonly keyId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Identifier of the key to sign with, as `keys/show` describes it. The key MUST be `active`, `ed25519`, and a verification method of the DID the document names as its issuer or controller.";
+            };
+            readonly document: {
+                readonly type: "object";
+                readonly description: "The JSON document to secure — a verifiable credential, a Trust Task document, or another document that names its own signer. It MUST NOT carry `proof`, and MUST carry `issuer` (a DID, or an object whose `id` is a DID) or `controller` (a DID, or an array holding exactly one DID), every one present naming the DID the key belongs to. The custodian checks these rules itself (`proofPresent`, `documentInvalid`, `issuerMismatch`) rather than the schema, because the document is carried whole and every member is signed as given: a typed document would drop the members it does not name. The custodian serialises the whole object with RFC 8785.";
+            };
+            readonly proofPurpose: {
+                readonly type: "string";
+                readonly enum: readonly ["assertionMethod", "authentication"];
+                readonly description: "The verification relationship the proof is made under, carried verbatim into the proof (W3C Data Integrity). The key MUST be listed under this relationship in the signer DID's document. Absent means `assertionMethod`, which is what a credential's issuer signs under; `authentication` is for a document the DID presents as itself, such as a Trust Task document. Externally owned, carried verbatim.";
+            };
+            readonly created: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$";
+                readonly description: "The proof's `created` value (an XML Schema dateTimeStamp, as Data Integrity requires). Absent means the custodian's own clock at signing. When present, the custodian refuses a value outside its acceptance window around its own clock with `keys:invalidArgument`: the key's signature dates the proof, so the producer cannot back- or forward-date it.";
+            };
+            readonly challenge: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 1024;
+                readonly description: "A challenge the proof's verifier issued, copied into the proof's `challenge` member verbatim (W3C Data Integrity). Absent means the proof carries none. The custodian does not interpret it.";
+            };
+            readonly domain: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 1024;
+                readonly description: "The security domain the proof is restricted to, copied into the proof's `domain` member verbatim (W3C Data Integrity). Absent means the proof carries none. The custodian does not interpret it.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Did: {
+                readonly type: "string";
+                readonly minLength: 7;
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:[A-Za-z0-9._:%-]*[A-Za-z0-9._%-]$";
+                readonly description: "A DID (W3C DID Core §3.1) — never a DID URL: no path, query or fragment.";
+            };
+            readonly Proof: {
+                readonly title: "Data Integrity proof";
+                readonly description: "The proof the custodian made: a W3C `DataIntegrityProof` under the `eddsa-jcs-2022` cryptosuite. Member names and values are Data Integrity's, carried verbatim.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly properties: {
+                    readonly "@context": {
+                        readonly description: "The document's own `@context`, copied into the proof configuration as `eddsa-jcs-2022` requires when the document has one; absent otherwise.";
+                        readonly oneOf: readonly [{
+                            readonly type: "string";
+                        }, {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                        }];
+                    };
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly enum: readonly ["eddsa-jcs-2022"];
+                        readonly description: "The only cryptosuite this version defines.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly pattern: "^did:[a-z0-9]+:[^#\\s]+#[^\\s]+$";
+                        readonly description: "The DID URL of the key's verification method in the signer DID's document, chosen by the custodian.";
+                    };
+                    readonly proofPurpose: {
+                        readonly type: "string";
+                        readonly enum: readonly ["assertionMethod", "authentication"];
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                    };
+                    readonly domain: {
+                        readonly type: "string";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The Ed25519 signature, base58btc multibase-encoded.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys — Sign Document — response payload";
+                readonly description: "The success response to a keys/sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-document/0.1#response. Failures use trust-task-error, not this shape.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "signerDid", "document", "proof"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly description: "The key that produced the proof. Echoed so a response separated from its request is still attributable.";
+                    };
+                    readonly signerDid: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The DID the document was signed as — the one its `issuer` or `controller` names, and the DID a verifier resolves the proof's verification method against.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The request's document, unchanged, with `proof` added. Every other member is exactly as the producer sent it.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/Proof";
+                        readonly description: "The proof the custodian attached to `document`, returned on its own so a producer need not dig it out.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/keys/sign-document/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Did: {
+                readonly type: "string";
+                readonly minLength: 7;
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:[A-Za-z0-9._:%-]*[A-Za-z0-9._%-]$";
+                readonly description: "A DID (W3C DID Core §3.1) — never a DID URL: no path, query or fragment.";
+            };
+            readonly Proof: {
+                readonly title: "Data Integrity proof";
+                readonly description: "The proof the custodian made: a W3C `DataIntegrityProof` under the `eddsa-jcs-2022` cryptosuite. Member names and values are Data Integrity's, carried verbatim.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly properties: {
+                    readonly "@context": {
+                        readonly description: "The document's own `@context`, copied into the proof configuration as `eddsa-jcs-2022` requires when the document has one; absent otherwise.";
+                        readonly oneOf: readonly [{
+                            readonly type: "string";
+                        }, {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                        }];
+                    };
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly enum: readonly ["eddsa-jcs-2022"];
+                        readonly description: "The only cryptosuite this version defines.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly pattern: "^did:[a-z0-9]+:[^#\\s]+#[^\\s]+$";
+                        readonly description: "The DID URL of the key's verification method in the signer DID's document, chosen by the custodian.";
+                    };
+                    readonly proofPurpose: {
+                        readonly type: "string";
+                        readonly enum: readonly ["assertionMethod", "authentication"];
+                    };
+                    readonly challenge: {
+                        readonly type: "string";
+                    };
+                    readonly domain: {
+                        readonly type: "string";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The Ed25519 signature, base58btc multibase-encoded.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys — Sign Document — response payload";
+                readonly description: "The success response to a keys/sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-document/0.1#response. Failures use trust-task-error, not this shape.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "signerDid", "document", "proof"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly description: "The key that produced the proof. Echoed so a response separated from its request is still attributable.";
+                    };
+                    readonly signerDid: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The DID the document was signed as — the one its `issuer` or `controller` names, and the DID a verifier resolves the proof's verification method against.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The request's document, unchanged, with `proof` added. Every other member is exactly as the producer sent it.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/Proof";
+                        readonly description: "The proof the custodian attached to `document`, returned on its own so a producer need not dig it out.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/keys/sign-document/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/sign-document/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gCAAgC,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,QAAQ,EAAE,EAAE,CAAC;IACb;;OAEG;IACH,YAAY,CAAC,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACpD;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,EAAE,CAAC;IACb,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC9C,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;OAEG;IACH,WAAW,EAAE,gBAAgB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,CAAC;AAEpB,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,oDAA6D,CAAC;AAEtF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAE9C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,6DAAsE,CAAC;AAExG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2KjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0H1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}