{
	"lexicon": 1,
	"id": "com.fedfork.exec.attest",
	"defs": {
		"main": {
			"type": "procedure",
			"description": "Host pseudo-call, never sent to a PDS: the module host signs a record with the attestation key it holds for the signed-in account (secp256k1, did:key) and returns the record with an inline network.attested.signature entry appended (attestation CID over the record without signatures, bound to repository). Without a record it returns only the key, for binding it with a com.publicdomainrelay.temp.badgeBlueKeys record.",
			"input": {
				"encoding": "application/json",
				"schema": {
					"type": "object",
					"required": ["repository"],
					"properties": {
						"repository": { "type": "string", "format": "did", "description": "The repo the record will be written to; must be the session's DID." },
						"record": { "type": "unknown", "description": "The record to sign, without signatures." }
					}
				}
			},
			"output": {
				"encoding": "application/json",
				"schema": {
					"type": "object",
					"required": ["key"],
					"properties": {
						"key": { "type": "string", "description": "The attestation key as a did:key." },
						"record": { "type": "unknown", "description": "The input record with signatures: [network.attested.signature] added." }
					}
				}
			}
		}
	}
}