@openvtc/trust-tasks 0.16.2 → 0.16.4

package/src/consent/approve-request/0.1/payload.ts

@@ -0,0 +1,200 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/consent/approve-request/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../_shared/components.js";
+
+
+/**
+ * Interaction kind. Present because it changes what the approver is agreeing to: consenting to an agent reading a 1:1 conversation exposes two parties, and consenting on a group exposes everyone in it, most of whom are not being asked.
+ */
+export type ConsentKind = "dm" | "group" | "channel";
+/**
+ * What the agent is asking to be allowed to do.
+ */
+export type ConsentScope = "receive" | "converse";
+
+/**
+ * The prompt an agent's home service sends to a designated approver, asking a human to decide whether an agent may act on one conversation. It carries no decision itself: the approver answers with a separate, separately-signed consent/decision. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface ConsentApproveRequestPayload {
+  subject: ConsentSubject;
+  scope: ConsentScope;
+  /**
+   * Single-use, unpredictable value the approver MUST echo in the consent/decision it signs. This is what binds a decision to this request: without it a decision is a free-floating assertion that the approver consented to something, and cannot be shown to answer this prompt rather than an earlier one. Consumers MUST reject a decision whose challenge they did not issue, and MUST NOT accept the same challenge twice.
+   */
+  challenge: string;
+  /**
+   * Human-readable label for the conversation, for the approver's screen — "Signal group 'Family'". Present because conversationRef is deliberately opaque: without a hint the approver is asked to decide about an identifier that means nothing to them, and will either always allow or always deny. Advisory only. It is chosen by the requesting party, so a renderer MUST treat it as untrusted text — escape it, bound its length, and never let it displace the subject members above as the basis of the decision.
+   */
+  displayHint?: string;
+  /**
+   * Digest of the inbound message that prompted this request, when there is one, so an approver deciding on a receive scope can confirm the decision it is being asked to make corresponds to a real arriving message. A digest rather than the content: the approver is deciding whether the agent may read the conversation, and showing them the message in order to ask would disclose what the decision is meant to gate.
+   */
+  firstMessageDigest?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * What the decision is about: one conversation, for one agent.
+ */
+export interface ConsentSubject {
+  /**
+   * Messaging platform the conversation lives on, as the bridge names it (for example `signal`, `whatsapp`). Opaque to the framework.
+   */
+  platform: string;
+  /**
+   * The bridge's OPAQUE handle for the conversation. MUST NOT be a raw platform address (a phone number, a handle, a group invite link). The approver identifies the conversation from displayHint; this member exists so a decision can be matched to a conversation without the matching key being personal data.
+   */
+  conversationRef: string;
+  kind: ConsentKind;
+  /**
+   * DID of the agent the decision is about. Consent is granted to one agent, not to the service that hosts it, so that revoking one agent's access does not revoke another's.
+   */
+  agent: string;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/consent/approve-request/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ConsentApproveRequestPayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/consent/approve-request/0.1",
+  "title": "Consent — Approve Request — payload",
+  "description": "The prompt an agent's home service sends to a designated approver, asking a human to decide whether an agent may act on one conversation. It carries no decision itself: the approver answers with a separate, separately-signed consent/decision. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "subject",
+    "scope",
+    "challenge"
+  ],
+  "properties": {
+    "subject": {
+      "$ref": "#/$defs/ConsentSubject",
+      "description": "What the decision is about: one conversation, for one agent."
+    },
+    "scope": {
+      "$ref": "#/$defs/ConsentScope",
+      "description": "What the agent is asking to be allowed to do."
+    },
+    "challenge": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Single-use, unpredictable value the approver MUST echo in the consent/decision it signs. This is what binds a decision to this request: without it a decision is a free-floating assertion that the approver consented to something, and cannot be shown to answer this prompt rather than an earlier one. Consumers MUST reject a decision whose challenge they did not issue, and MUST NOT accept the same challenge twice."
+    },
+    "displayHint": {
+      "type": "string",
+      "maxLength": 256,
+      "description": "Human-readable label for the conversation, for the approver's screen — \"Signal group 'Family'\". Present because conversationRef is deliberately opaque: without a hint the approver is asked to decide about an identifier that means nothing to them, and will either always allow or always deny. Advisory only. It is chosen by the requesting party, so a renderer MUST treat it as untrusted text — escape it, bound its length, and never let it displace the subject members above as the basis of the decision."
+    },
+    "firstMessageDigest": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Digest of the inbound message that prompted this request, when there is one, so an approver deciding on a receive scope can confirm the decision it is being asked to make corresponds to a real arriving message. A digest rather than the content: the approver is deciding whether the agent may read the conversation, and showing them the message in order to ask would disclose what the decision is meant to gate."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "ConsentSubject": {
+      "$anchor": "consentSubject",
+      "title": "ConsentSubject",
+      "description": "Platform-agnostic identifier of what consent is about. Deliberately not a platform address: a consent record that named one would be a stored directory of who the subject talks to, readable by anyone who reaches the store.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "platform",
+        "conversationRef",
+        "kind",
+        "agent"
+      ],
+      "properties": {
+        "platform": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Messaging platform the conversation lives on, as the bridge names it (for example `signal`, `whatsapp`). Opaque to the framework."
+        },
+        "conversationRef": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The bridge's OPAQUE handle for the conversation. MUST NOT be a raw platform address (a phone number, a handle, a group invite link). The approver identifies the conversation from displayHint; this member exists so a decision can be matched to a conversation without the matching key being personal data."
+        },
+        "kind": {
+          "$ref": "#/$defs/ConsentKind"
+        },
+        "agent": {
+          "type": "string",
+          "pattern": "^did:",
+          "description": "DID of the agent the decision is about. Consent is granted to one agent, not to the service that hosts it, so that revoking one agent's access does not revoke another's."
+        }
+      }
+    },
+    "ConsentKind": {
+      "$anchor": "consentKind",
+      "title": "ConsentKind",
+      "description": "Interaction kind. Present because it changes what the approver is agreeing to: consenting to an agent reading a 1:1 conversation exposes two parties, and consenting on a group exposes everyone in it, most of whom are not being asked.",
+      "type": "string",
+      "enum": [
+        "dm",
+        "group",
+        "channel"
+      ]
+    },
+    "ConsentScope": {
+      "$anchor": "consentScope",
+      "title": "ConsentScope",
+      "description": "What the agent may do. `receive` is read-only: the agent sees inbound messages. `converse` additionally lets it reply, which means it can speak to the other parties as the subject — a materially different decision, and the reason the two are distinct values rather than a boolean.",
+      "type": "string",
+      "enum": [
+        "receive",
+        "converse"
+      ]
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;

package/src/index.ts

@@ -60,6 +60,7 @@ export * as ConfigShow_v0_1 from "./config/show/0.1/payload.js";
 export * as ConfirmRequest_v0_1 from "./confirm/request/0.1/payload.js";
 export * as ConfirmResponse_v0_1 from "./confirm/response/0.1/payload.js";
 export * as ConsentShared_v0_1 from "./consent/_shared/0.1/consent.js";
+export * as ConsentApproveRequest_v0_1 from "./consent/approve-request/0.1/payload.js";
 export * as ConsentApproverList_v1_0 from "./consent/approver-list/1.0/payload.js";
 export * as ConsentApproverSet_v1_0 from "./consent/approver-set/1.0/payload.js";
 export * as ConsentDecision_v1_0 from "./consent/decision/1.0/payload.js";
@@ -234,6 +235,14 @@ export * as SealedEnvelopeShared_v0_3 from "./vault/_shared/0.3/sealed-envelope.
 export * as SessionBlobShared_v0_3 from "./vault/_shared/0.3/session-blob.js";
 export * as VaultEntryShared_v0_3 from "./vault/_shared/0.3/vault-entry.js";
 export * as VaultSecretShared_v0_3 from "./vault/_shared/0.3/vault-secret.js";
+export * as VaultCredentialsArchive_v0_1 from "./vault/credentials/archive/0.1/payload.js";
+export * as VaultCredentialsDelete_v0_1 from "./vault/credentials/delete/0.1/payload.js";
+export * as VaultCredentialsGet_v0_1 from "./vault/credentials/get/0.1/payload.js";
+export * as VaultCredentialsPurge_v0_1 from "./vault/credentials/purge/0.1/payload.js";
+export * as VaultCredentialsQuery_v0_1 from "./vault/credentials/query/0.1/payload.js";
+export * as VaultCredentialsReceive_v0_1 from "./vault/credentials/receive/0.1/payload.js";
+export * as VaultCredentialsRestore_v0_1 from "./vault/credentials/restore/0.1/payload.js";
+export * as VaultCredentialsUnarchive_v0_1 from "./vault/credentials/unarchive/0.1/payload.js";
 export * as VaultDelete_v0_1 from "./vault/delete/0.1/payload.js";
 export * as VaultGet_v0_1 from "./vault/get/0.1/payload.js";
 export * as VaultGet_v0_2 from "./vault/get/0.2/payload.js";

package/src/vault/credentials/archive/0.1/payload.ts

@@ -0,0 +1,217 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vault/credentials/archive/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * Hide a stored credential from default query results and refuse it for presentation, reversibly.
+ */
+export interface VaultCredentialsArchive {
+  /**
+   * Local handle from a query descriptor. Opaque; consumers must not derive or guess one.
+   */
+  id: string;
+  /**
+   * Free text recorded with the transition. Must not carry credential contents.
+   */
+  reason?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+export interface VaultCredentialsArchiveResponsePayload {
+  id: string;
+  /**
+   * State after the transition, echoed rather than left to be inferred from the verb.
+   */
+  lifecycle: "active" | "archived" | "deleted";
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vault/credentials/archive/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VaultCredentialsArchive;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/credentials/archive/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultCredentialsArchiveResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vault/credentials/archive/0.1",
+  "title": "Vault Credentials — Archive",
+  "description": "Hide a stored credential from default query results and refuse it for presentation, reversibly.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Local handle from a query descriptor. Opaque; consumers must not derive or guess one."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "description": "Free text recorded with the transition. Must not carry credential contents."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Vault Credentials Archive — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "lifecycle"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "lifecycle": {
+          "$ref": "#/$defs/VaultLifecycle",
+          "description": "State after the transition, echoed rather than left to be inferred from the verb."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "VaultLifecycle": {
+      "type": "string",
+      "enum": [
+        "active",
+        "archived",
+        "deleted"
+      ],
+      "description": "Archival state. Orthogonal to validity."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Vault Credentials Archive — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "lifecycle"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "lifecycle": {
+          "$ref": "#/$defs/VaultLifecycle",
+          "description": "State after the transition, echoed rather than left to be inferred from the verb."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "VaultLifecycle": {
+      "type": "string",
+      "enum": [
+        "active",
+        "archived",
+        "deleted"
+      ],
+      "description": "Archival state. Orthogonal to validity."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vault/credentials/delete/0.1/payload.ts

@@ -0,0 +1,239 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vault/credentials/delete/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * Move a stored credential to a recoverable tombstone, or erase it outright.
+ */
+export interface VaultCredentialsDelete {
+  /**
+   * Local handle from a query descriptor. Opaque; consumers must not derive or guess one.
+   */
+  id: string;
+  /**
+   * Free text recorded with the transition. Must not carry credential contents.
+   */
+  reason?: string;
+  /**
+   * Erase immediately rather than tombstoning. Irrecoverable. Absent means false.
+   */
+  force?: boolean;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+export interface VaultCredentialsDeleteResponsePayload {
+  id: string;
+  /**
+   * State after the transition, echoed rather than left to be inferred from the verb.
+   */
+  lifecycle: "active" | "archived" | "deleted";
+  /**
+   * Restore deadline. Present on the default path; absent when `force` was set, and its absence is how a consumer knows nothing can be restored.
+   */
+  graceUntil?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vault/credentials/delete/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VaultCredentialsDelete;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/credentials/delete/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VaultCredentialsDeleteResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vault/credentials/delete/0.1",
+  "title": "Vault Credentials — Delete",
+  "description": "Move a stored credential to a recoverable tombstone, or erase it outright.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Local handle from a query descriptor. Opaque; consumers must not derive or guess one."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "description": "Free text recorded with the transition. Must not carry credential contents."
+    },
+    "force": {
+      "type": "boolean",
+      "description": "Erase immediately rather than tombstoning. Irrecoverable. Absent means false."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Vault Credentials Delete — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "lifecycle"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "lifecycle": {
+          "$ref": "#/$defs/VaultLifecycle",
+          "description": "State after the transition, echoed rather than left to be inferred from the verb."
+        },
+        "graceUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Restore deadline. Present on the default path; absent when `force` was set, and its absence is how a consumer knows nothing can be restored."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "VaultLifecycle": {
+      "type": "string",
+      "enum": [
+        "active",
+        "archived",
+        "deleted"
+      ],
+      "description": "Archival state. Orthogonal to validity."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Vault Credentials Delete — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "lifecycle"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "lifecycle": {
+          "$ref": "#/$defs/VaultLifecycle",
+          "description": "State after the transition, echoed rather than left to be inferred from the verb."
+        },
+        "graceUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Restore deadline. Present on the default path; absent when `force` was set, and its absence is how a consumer knows nothing can be restored."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "VaultLifecycle": {
+      "type": "string",
+      "enum": [
+        "active",
+        "archived",
+        "deleted"
+      ],
+      "description": "Archival state. Orthogonal to validity."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;