@openvtc/trust-tasks 0.14.0 → 0.14.1

package/src/auth/step-up/approve-request/0.2/payload.ts

@@ -28,7 +28,7 @@ export interface AuthStepUpApproveRequest {
    */
   targetAcr?: string;
   /**
-   * Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `method_unsupported`.
+   * Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `methodUnsupported`.
    *
    * @minItems 1
    */
@@ -160,7 +160,7 @@ export const PAYLOAD_SCHEMA = {
           "webauthn"
         ]
       },
-      "description": "Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `method_unsupported`."
+      "description": "Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `methodUnsupported`."
     },
     "webauthn": {
       "$ref": "#/$defs/CredentialRequestOptions",

package/src/did-management/did/info/0.1/payload.ts

@@ -6,7 +6,7 @@
 export interface DIDManagementInfoPayload {
   mnemonic: string;
   /**
-   * Optional explicit hosting domain. See [category conventions §1](../../../_shared/0.1/CONVENTIONS.md#1-domain-resolution). Unknown domains return `did-management:unknown_domain`.
+   * Optional explicit hosting domain. See [category conventions §1](../../../_shared/0.1/CONVENTIONS.md#1-domain-resolution). Unknown domains return `did-management:unknownDomain`.
    */
   domain?: string;
   ext?: Ext;
@@ -116,7 +116,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "domain": {
       "type": "string",
-      "description": "Optional explicit hosting domain. See [category conventions §1](../../../_shared/0.1/CONVENTIONS.md#1-domain-resolution). Unknown domains return `did-management:unknown_domain`."
+      "description": "Optional explicit hosting domain. See [category conventions §1](../../../_shared/0.1/CONVENTIONS.md#1-domain-resolution). Unknown domains return `did-management:unknownDomain`."
     },
     "ext": {
       "$ref": "#/$defs/Ext"

package/src/governance/capability/enable/0.1/payload.ts

@@ -16,7 +16,7 @@ export interface GovernanceCapabilityEnablePayload {
    */
   version: string;
   /**
-   * Per-community configuration. Opaque to the framework; the recipient MUST validate it against the schema named by the capability manifest's `configSchema` and reject `config_invalid` on mismatch.
+   * Per-community configuration. Opaque to the framework; the recipient MUST validate it against the schema named by the capability manifest's `configSchema` and reject `configInvalid` on mismatch.
    */
   config?: {};
   /**
@@ -176,7 +176,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "config": {
       "type": "object",
-      "description": "Per-community configuration. Opaque to the framework; the recipient MUST validate it against the schema named by the capability manifest's `configSchema` and reject `config_invalid` on mismatch."
+      "description": "Per-community configuration. Opaque to the framework; the recipient MUST validate it against the schema named by the capability manifest's `configSchema` and reject `configInvalid` on mismatch."
     },
     "delegate": {
       "type": "string",

package/src/provision/integration/0.1/payload.ts

@@ -14,11 +14,11 @@ export type BootstrapAsk = TemplateBootstrapAsk | AdminRotationAsk;
 export interface ProvisionIntegrationPayload {
   request: BootstrapRequest;
   /**
-   * The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.
+   * The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:contextRequired`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.
    */
   context?: string;
   /**
-   * Producer-assertion mode the maintainer should apply to the returned sealed bundle. `did-signed` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinned-only` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests.
+   * Producer-assertion mode the maintainer should apply to the returned sealed bundle. `did-signed` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinned-only` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertionUnsupported` to unsupported requests.
    */
   assertion?: "did-signed" | "pinned-only";
   /**
@@ -95,7 +95,7 @@ export interface DidTemplateRef {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -110,7 +110,7 @@ export interface DidTemplateRef1 {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -140,7 +140,7 @@ export interface DidTemplateRef2 {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -287,7 +287,7 @@ export const PAYLOAD_SCHEMA = {
     "context": {
       "type": "string",
       "minLength": 1,
-      "description": "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly."
+      "description": "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:contextRequired`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly."
     },
     "assertion": {
       "type": "string",
@@ -296,7 +296,7 @@ export const PAYLOAD_SCHEMA = {
         "pinned-only"
       ],
       "default": "did-signed",
-      "description": "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `did-signed` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinned-only` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests."
+      "description": "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `did-signed` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinned-only` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertionUnsupported` to unsupported requests."
     },
     "vcValiditySeconds": {
       "type": "integer",
@@ -486,7 +486,7 @@ export const PAYLOAD_SCHEMA = {
           "type": "object",
           "additionalProperties": true,
           "default": {},
-          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`."
+          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`."
         }
       }
     },
@@ -826,7 +826,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "type": "object",
           "additionalProperties": true,
           "default": {},
-          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`."
+          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`."
         }
       }
     },

package/src/provision/integration/0.2/payload.ts

@@ -14,11 +14,11 @@ export type BootstrapAsk = TemplateBootstrapAsk | AdminRotationAsk;
 export interface ProvisionIntegrationPayload {
   request: BootstrapRequest;
   /**
-   * The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.
+   * The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:contextRequired`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.
    */
   context?: string;
   /**
-   * Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests.
+   * Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertionUnsupported` to unsupported requests.
    */
   assertion?: "didSigned" | "pinnedOnly";
   /**
@@ -95,7 +95,7 @@ export interface DidTemplateRef {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -110,7 +110,7 @@ export interface DidTemplateRef1 {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -140,7 +140,7 @@ export interface DidTemplateRef2 {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -287,7 +287,7 @@ export const PAYLOAD_SCHEMA = {
     "context": {
       "type": "string",
       "minLength": 1,
-      "description": "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly."
+      "description": "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:contextRequired`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly."
     },
     "assertion": {
       "type": "string",
@@ -296,7 +296,7 @@ export const PAYLOAD_SCHEMA = {
         "pinnedOnly"
       ],
       "default": "didSigned",
-      "description": "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests."
+      "description": "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertionUnsupported` to unsupported requests."
     },
     "vcValiditySeconds": {
       "type": "integer",
@@ -486,7 +486,7 @@ export const PAYLOAD_SCHEMA = {
           "type": "object",
           "additionalProperties": true,
           "default": {},
-          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`."
+          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`."
         }
       }
     },
@@ -826,7 +826,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "type": "object",
           "additionalProperties": true,
           "default": {},
-          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`."
+          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`."
         }
       }
     },

package/src/provision/integration/0.3/payload.ts

@@ -18,11 +18,11 @@ export type DigestMultibase = string;
 export interface ProvisionIntegrationPayload {
   request: BootstrapRequest;
   /**
-   * The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.
+   * The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:contextRequired`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.
    */
   context?: string;
   /**
-   * Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests.
+   * Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertionUnsupported` to unsupported requests.
    */
   assertion?: "didSigned" | "pinnedOnly";
   /**
@@ -99,7 +99,7 @@ export interface DidTemplateRef {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -114,7 +114,7 @@ export interface DidTemplateRef1 {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -144,7 +144,7 @@ export interface DidTemplateRef2 {
    */
   name: string;
   /**
-   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.
+   * Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`.
    */
   vars?: {
     [k: string]: unknown | undefined;
@@ -288,7 +288,7 @@ export const PAYLOAD_SCHEMA = {
     "context": {
       "type": "string",
       "minLength": 1,
-      "description": "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly."
+      "description": "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:contextRequired`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly."
     },
     "assertion": {
       "type": "string",
@@ -297,7 +297,7 @@ export const PAYLOAD_SCHEMA = {
         "pinnedOnly"
       ],
       "default": "didSigned",
-      "description": "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests."
+      "description": "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `didSigned` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinnedOnly` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertionUnsupported` to unsupported requests."
     },
     "vcValiditySeconds": {
       "type": "integer",
@@ -487,7 +487,7 @@ export const PAYLOAD_SCHEMA = {
           "type": "object",
           "additionalProperties": true,
           "default": {},
-          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`."
+          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`."
         }
       }
     },
@@ -836,7 +836,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "type": "object",
           "additionalProperties": true,
           "default": {},
-          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`."
+          "description": "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:templateVarsInvalid`."
         }
       }
     },

package/src/trust-task-error/0.1/payload.ts

@@ -8,7 +8,7 @@
  */
 export interface TrustTaskErrorPayload {
   /**
-   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').
+   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').
    */
   code: (
     | (
@@ -77,7 +77,7 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "code": {
       "type": "string",
-      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').",
       "anyOf": [
         {
           "enum": [

package/src/trust-task-error/0.2/payload.ts

@@ -8,7 +8,7 @@
  */
 export interface TrustTaskErrorPayload {
   /**
-   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').
+   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').
    */
   code: (
     | (
@@ -77,7 +77,7 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "code": {
       "type": "string",
-      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').",
       "anyOf": [
         {
           "enum": [

package/src/trust-task-error/0.3/payload.ts

@@ -8,7 +8,7 @@
  */
 export interface TrustTaskErrorPayload {
   /**
-   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').
+   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').
    */
   code: (
     | (
@@ -90,7 +90,7 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "code": {
       "type": "string",
-      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').",
       "anyOf": [
         {
           "enum": [

package/src/trust-task-error/0.4/payload.ts

@@ -8,7 +8,7 @@
  */
 export interface TrustTaskErrorPayload {
   /**
-   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').
+   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').
    */
   code: (
     | (
@@ -91,7 +91,7 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "code": {
       "type": "string",
-      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').",
       "anyOf": [
         {
           "enum": [

package/src/trust-task-error/0.5/payload.ts

@@ -8,7 +8,7 @@
  */
 export interface TrustTaskErrorPayload {
   /**
-   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').
+   * Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').
    */
   code: (
     | (
@@ -92,7 +92,7 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "code": {
       "type": "string",
-      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:roleNotRecognized').",
       "anyOf": [
         {
           "enum": [

package/src/vault/proxy-login/0.1/payload.ts

@@ -8,7 +8,7 @@
  */
 export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
 /**
- * Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.
+ * Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelopeUnsupported`.
  */
 export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
 
@@ -89,7 +89,7 @@ export interface ConsumerContext {
   networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
 }
 /**
- * Optional — included on retry after a prior proxy-login attempt returned `step_up_required`.
+ * Optional — included on retry after a prior proxy-login attempt returned `stepUpRequired`.
  */
 export interface StepUpProof {
   kind: "webauthn-uv" | "push-approval" | "totp";
@@ -145,7 +145,7 @@ export interface HpkeArmoredEnvelope {
   producerAssertion?: "did-signed" | "attested" | "pinned-only";
 }
 /**
- * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
  */
 export interface TspMessageEnvelope {
   envelope: "tsp-message";
@@ -202,7 +202,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "stepUpProof": {
       "$ref": "#/$defs/StepUpProof",
-      "description": "Optional — included on retry after a prior proxy-login attempt returned `step_up_required`."
+      "description": "Optional — included on retry after a prior proxy-login attempt returned `stepUpRequired`."
     },
     "nonce": {
       "type": "string",
@@ -232,7 +232,7 @@ export const PAYLOAD_SCHEMA = {
       "properties": {
         "sealedSessionBlob": {
           "$ref": "#/$defs/SealedEnvelope",
-          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`."
+          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelopeUnsupported`."
         },
         "ext": {
           "$ref": "#/$defs/Ext"
@@ -266,7 +266,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "TspMessageEnvelope": {
       "title": "TspMessageEnvelope",
-      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
+      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
       "type": "object",
       "additionalProperties": false,
       "required": [
@@ -517,7 +517,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "properties": {
         "sealedSessionBlob": {
           "$ref": "#/$defs/SealedEnvelope",
-          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`."
+          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelopeUnsupported`."
         },
         "ext": {
           "$ref": "#/$defs/Ext"
@@ -551,7 +551,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "TspMessageEnvelope": {
       "title": "TspMessageEnvelope",
-      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
+      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
       "type": "object",
       "additionalProperties": false,
       "required": [

package/src/vault/proxy-login/0.2/payload.ts

@@ -8,7 +8,7 @@
  */
 export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
 /**
- * Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`.
+ * Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelopeUnsupported`.
  */
 export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
 
@@ -145,7 +145,7 @@ export interface HpkeArmoredEnvelope {
   producerAssertion?: "didSigned" | "attested" | "pinnedOnly";
 }
 /**
- * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
  */
 export interface TspMessageEnvelope {
   envelope: "tspMessage";
@@ -232,7 +232,7 @@ export const PAYLOAD_SCHEMA = {
       "properties": {
         "sealedSessionBlob": {
           "$ref": "#/$defs/SealedEnvelope",
-          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`."
+          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelopeUnsupported`."
         },
         "ext": {
           "$ref": "#/$defs/Ext"
@@ -266,7 +266,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "TspMessageEnvelope": {
       "title": "TspMessageEnvelope",
-      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
+      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
       "type": "object",
       "additionalProperties": false,
       "required": [
@@ -517,7 +517,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "properties": {
         "sealedSessionBlob": {
           "$ref": "#/$defs/SealedEnvelope",
-          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelope_unsupported`."
+          "description": "Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelopeUnsupported`."
         },
         "ext": {
           "$ref": "#/$defs/Ext"
@@ -551,7 +551,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "TspMessageEnvelope": {
       "title": "TspMessageEnvelope",
-      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
+      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
       "type": "object",
       "additionalProperties": false,
       "required": [

package/src/vault/release/0.1/payload.ts

@@ -8,7 +8,7 @@
  */
 export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
 /**
- * Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelope_unsupported`.
+ * Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelopeUnsupported`.
  */
 export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
 /**
@@ -25,7 +25,7 @@ export type SecretKind =
   | "custom";
 
 /**
- * Consumer requests that the maintainer release the cleartext secret material of a vault entry. The response carries the secret in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope); the cleartext shape is `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. This is the fallback when proxy-login is not viable (`vault/proxy-login:not_proxyable`) or when the consumer needs the raw secret for a flow the maintainer cannot perform (e.g. autofill into a desktop app, copy-to-clipboard for offline use).
+ * Consumer requests that the maintainer release the cleartext secret material of a vault entry. The response carries the secret in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope); the cleartext shape is `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. This is the fallback when proxy-login is not viable (`vault/proxy-login:notProxyable`) or when the consumer needs the raw secret for a flow the maintainer cannot perform (e.g. autofill into a desktop app, copy-to-clipboard for offline use).
  */
 export interface VaultReleasePayload {
   entryId: string;
@@ -155,7 +155,7 @@ export interface HpkeArmoredEnvelope {
   producerAssertion?: "did-signed" | "attested" | "pinned-only";
 }
 /**
- * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
  */
 export interface TspMessageEnvelope {
   envelope: "tsp-message";
@@ -190,7 +190,7 @@ export const PAYLOAD_SCHEMA = {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://trusttasks.org/spec/vault/release/0.1",
   "title": "Vault Release — payload",
-  "description": "Consumer requests that the maintainer release the cleartext secret material of a vault entry. The response carries the secret in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope); the cleartext shape is `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. This is the fallback when proxy-login is not viable (`vault/proxy-login:not_proxyable`) or when the consumer needs the raw secret for a flow the maintainer cannot perform (e.g. autofill into a desktop app, copy-to-clipboard for offline use).",
+  "description": "Consumer requests that the maintainer release the cleartext secret material of a vault entry. The response carries the secret in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope); the cleartext shape is `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. This is the fallback when proxy-login is not viable (`vault/proxy-login:notProxyable`) or when the consumer needs the raw secret for a flow the maintainer cannot perform (e.g. autofill into a desktop app, copy-to-clipboard for offline use).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -237,7 +237,7 @@ export const PAYLOAD_SCHEMA = {
       "properties": {
         "sealedSecret": {
           "$ref": "#/$defs/SealedEnvelope",
-          "description": "Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelope_unsupported`."
+          "description": "Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelopeUnsupported`."
         },
         "secretKind": {
           "$ref": "#/$defs/SecretKind",
@@ -296,7 +296,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "TspMessageEnvelope": {
       "title": "TspMessageEnvelope",
-      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
+      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
       "type": "object",
       "additionalProperties": false,
       "required": [
@@ -549,7 +549,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "properties": {
         "sealedSecret": {
           "$ref": "#/$defs/SealedEnvelope",
-          "description": "Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelope_unsupported`."
+          "description": "Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelopeUnsupported`."
         },
         "secretKind": {
           "$ref": "#/$defs/SecretKind",
@@ -608,7 +608,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "TspMessageEnvelope": {
       "title": "TspMessageEnvelope",
-      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelope_unsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
+      "description": "Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.",
       "type": "object",
       "additionalProperties": false,
       "required": [