@openvtc/trust-tasks 0.2.54 → 0.2.56

package/src/policy/active/0.1/payload.ts

@@ -20,9 +20,58 @@ export interface PolicyActivePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyActiveResponsePayload {
+  /**
+   * The active (contextId, purpose) -> policy bindings that matched the request. Zero entries when the requested purpose has no active policy; the full set when purpose is omitted. Unpaginated — the active set has one entry per purpose, which is small by construction.
+   */
+  bindings: ActiveBinding[];
+  ext?: Ext;
+}
+/**
+ * One active-policy binding: the policy currently authoritative for a (contextId, purpose) decision slot.
+ */
+export interface ActiveBinding {
+  purpose: string;
+  /**
+   * Present when the binding is context-scoped.
+   */
+  contextId?: string;
+  policy: PolicyModule;
+}
+export interface PolicyModule {
+  id: string;
+  /**
+   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
+   */
+  name: string;
+  description?: string;
+  /**
+   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
+   */
+  module: string;
+  /**
+   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
+   */
+  appliesTo?: string[];
+  /**
+   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
+   */
+  priority?: number;
+  enabled?: boolean;
+  version: number;
+  createdAt: string;
+  updatedAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/active/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PolicyActivePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/active/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyActiveResponsePayload;

package/src/policy/delete/0.1/payload.ts

@@ -15,9 +15,20 @@ export interface PolicyDeletePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyDeleteResponsePayload {
+  id: string;
+  deletedAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/delete/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PolicyDeletePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/delete/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyDeleteResponsePayload;

package/src/policy/evaluate/0.1/payload.ts

@@ -94,9 +94,49 @@ export interface Service {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyEvaluateResponsePayload {
+  decision: PolicyDecision;
+  /**
+   * Ids (or `candidate` for the dry-run module) of the policies that returned a non-null decision, in evaluation order. The first is the winning policy.
+   */
+  matchedPolicies?: string[];
+  /**
+   * Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging.
+   */
+  trace?: string[];
+  ext?: Ext;
+}
+export interface PolicyDecision {
+  decision: "allow" | "deny" | "require_step_up";
+  /**
+   * When decision == "allow", whether the maintainer should proxy-login or release-for-fill. Default: proxy.
+   */
+  mode?: "proxy" | "fill";
+  /**
+   * When decision == "require_step_up", which method to demand.
+   */
+  stepUp?: {
+    method: "webauthn-uv" | "push-approval" | "totp";
+    ttlSeconds?: number;
+  };
+  /**
+   * When decision == "allow", maximum lifetime of the issued session blob / released secret.
+   */
+  ttlSecondsCap?: number;
+  /**
+   * Human-readable explanation for diagnostic display.
+   */
+  explanation?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SiteTarget;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyEvaluateResponsePayload;

package/src/policy/evaluate/0.2/payload.ts

@@ -94,9 +94,49 @@ export interface Service {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyEvaluateResponsePayload {
+  decision: PolicyDecision;
+  /**
+   * Ids (or `candidate` for the dry-run module) of the policies that returned a non-null decision, in evaluation order. The first is the winning policy.
+   */
+  matchedPolicies?: string[];
+  /**
+   * Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging.
+   */
+  trace?: string[];
+  ext?: Ext;
+}
+export interface PolicyDecision {
+  decision: "allow" | "deny" | "requireStepUp";
+  /**
+   * When decision == "allow", whether the maintainer should proxy-login or release-for-fill. Default: proxy.
+   */
+  mode?: "proxy" | "fill";
+  /**
+   * When decision == "require_step_up", which method to demand.
+   */
+  stepUp?: {
+    method: "webauthnUv" | "pushApproval" | "totp";
+    ttlSeconds?: number;
+  };
+  /**
+   * When decision == "allow", maximum lifetime of the issued session blob / released secret.
+   */
+  ttlSecondsCap?: number;
+  /**
+   * Human-readable explanation for diagnostic display.
+   */
+  explanation?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SiteTarget;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyEvaluateResponsePayload;

package/src/policy/evaluate/0.3/payload.ts

@@ -120,9 +120,66 @@ export interface Service {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyEvaluateResponsePayload {
+  decision: PolicyDecision;
+  /**
+   * Ids (or `candidate` for the dry-run module) of the policies that returned a non-null decision, in evaluation order. The first is the winning policy.
+   */
+  matchedPolicies?: string[];
+  /**
+   * Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging.
+   */
+  trace?: string[];
+  ext?: Ext;
+}
+export interface PolicyDecision {
+  decision: "allow" | "deny" | "requireStepUp" | "requireConsent";
+  /**
+   * Vault-flow-specific. When decision == "allow" for a proxy-login/release request, whether the maintainer should proxy-login or release-for-fill. Default: proxy. Ignored for other task kinds.
+   */
+  mode?: "proxy" | "fill";
+  /**
+   * When decision == "requireStepUp", which method to demand.
+   */
+  stepUp?: {
+    method: "webauthnUv" | "pushApproval" | "totp";
+    ttlSeconds?: number;
+  };
+  /**
+   * When decision == "requireConsent", the approver constraint the enforcement point MUST satisfy — a signed consent decision from the named set, bound to the request's payloadDigest — before executing.
+   */
+  requireConsent?: {
+    /**
+     * Named set of enrolled approver devices permitted to approve this task (resolved by the enforcement point against its device registry).
+     */
+    approverSet: string;
+    /**
+     * When true, the device that issued the request MUST NOT be accepted as the approver — forcing cross-device approval so a compromised requesting device cannot self-approve.
+     */
+    excludeRequester?: boolean;
+    /**
+     * Number of distinct approvers from the set required before the task may execute.
+     */
+    minApprovals?: number;
+  };
+  /**
+   * When decision == "allow", maximum lifetime of any issued session blob / released secret.
+   */
+  ttlSecondsCap?: number;
+  /**
+   * Human-readable explanation for diagnostic display.
+   */
+  explanation?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.3" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = SiteTarget;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.3#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyEvaluateResponsePayload;

package/src/policy/get/0.1/payload.ts

@@ -16,9 +16,44 @@ export interface PolicyGetPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyGetResponsePayload {
+  policy: PolicyModule;
+  ext?: Ext;
+}
+export interface PolicyModule {
+  id: string;
+  /**
+   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
+   */
+  name: string;
+  description?: string;
+  /**
+   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
+   */
+  module: string;
+  /**
+   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
+   */
+  appliesTo?: string[];
+  /**
+   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
+   */
+  priority?: number;
+  enabled?: boolean;
+  version: number;
+  createdAt: string;
+  updatedAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/get/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PolicyGetPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/get/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyGetResponsePayload;

package/src/policy/list/0.1/payload.ts

@@ -16,9 +16,46 @@ export interface PolicyListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyListResponsePayload {
+  policies: PolicyModule[];
+  truncated: boolean;
+  cursor?: string;
+  ext?: Ext;
+}
+export interface PolicyModule {
+  id: string;
+  /**
+   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
+   */
+  name: string;
+  description?: string;
+  /**
+   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
+   */
+  module: string;
+  /**
+   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
+   */
+  appliesTo?: string[];
+  /**
+   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
+   */
+  priority?: number;
+  enabled?: boolean;
+  version: number;
+  createdAt: string;
+  updatedAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PolicyListPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyListResponsePayload;

package/src/policy/list/0.2/payload.ts

@@ -16,9 +16,46 @@ export interface PolicyListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyListResponsePayload {
+  policies: PolicyModule[];
+  truncated: boolean;
+  cursor?: string;
+  ext?: Ext;
+}
+export interface PolicyModule {
+  id: string;
+  /**
+   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
+   */
+  name: string;
+  description?: string;
+  /**
+   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
+   */
+  module: string;
+  /**
+   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
+   */
+  appliesTo?: string[];
+  /**
+   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
+   */
+  priority?: number;
+  enabled?: boolean;
+  version: number;
+  createdAt: string;
+  updatedAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/list/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PolicyListPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/list/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyListResponsePayload;

package/src/policy/upsert/0.1/payload.ts

@@ -23,9 +23,45 @@ export interface PolicyUpsertPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyUpsertResponsePayload {
+  policy: PolicyModule;
+  created: boolean;
+  ext?: Ext;
+}
+export interface PolicyModule {
+  id: string;
+  /**
+   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
+   */
+  name: string;
+  description?: string;
+  /**
+   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
+   */
+  module: string;
+  /**
+   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
+   */
+  appliesTo?: string[];
+  /**
+   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
+   */
+  priority?: number;
+  enabled?: boolean;
+  version: number;
+  createdAt: string;
+  updatedAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/upsert/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PolicyUpsertPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/upsert/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyUpsertResponsePayload;

package/src/policy/upsert/0.2/payload.ts

@@ -23,9 +23,45 @@ export interface PolicyUpsertPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface PolicyUpsertResponsePayload {
+  policy: PolicyModule;
+  created: boolean;
+  ext?: Ext;
+}
+export interface PolicyModule {
+  id: string;
+  /**
+   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
+   */
+  name: string;
+  description?: string;
+  /**
+   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
+   */
+  module: string;
+  /**
+   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
+   */
+  appliesTo?: string[];
+  /**
+   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
+   */
+  priority?: number;
+  enabled?: boolean;
+  version: number;
+  createdAt: string;
+  updatedAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/upsert/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PolicyUpsertPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/policy/upsert/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PolicyUpsertResponsePayload;

package/src/provision/integration/0.1/payload.ts

@@ -173,9 +173,89 @@ export interface DataIntegrityProof {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.
+ */
+export interface ProvisionIntegrationResponsePayload {
+  /**
+   * OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.
+   */
+  bundle: string;
+  /**
+   * SHA-256 of the armored ciphertext, lowercase hex. Used by holders that pin the bundle out-of-band.
+   */
+  digest: string;
+  summary: ProvisionSummary;
+  ext?: Ext1;
+}
+/**
+ * Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.
+ */
+export interface ProvisionSummary {
+  /**
+   * Ephemeral did:key the holder signed the VP with and opens the sealed bundle with. Echo of `request.holder`.
+   */
+  clientDid: string;
+  /**
+   * Long-term admin DID after this provisioning. Equals `clientDid` when no admin rollover occurred (TemplateBootstrap with no `adminTemplate`); equals the freshly-minted admin DID when `adminTemplate` was used or when the ask was `AdminRotation`. Maintainers that pre-date admin rollover MAY omit this; consumers SHOULD default it to `clientDid` for backward compatibility.
+   */
+  adminDid?: string;
+  /**
+   * True when the maintainer minted a fresh long-term admin DID and bound the authorization VC + ACL row to it (i.e. `adminDid != clientDid`).
+   */
+  adminRolledOver?: boolean;
+  /**
+   * DID rendered from the integration template. Absent for `AdminRotation` (no integration was rendered).
+   */
+  integrationDid?: string;
+  /**
+   * Name of the integration template that was rendered. Absent for `AdminRotation`.
+   */
+  templateName?: string;
+  /**
+   * `kind` of the integration template (e.g. `mediator`, `did-hosting-control`, `app`). Absent for `AdminRotation`.
+   */
+  templateKind?: string;
+  /**
+   * Name of the admin template that was rendered. Present when an admin DID was minted (either via `TemplateBootstrap.adminTemplate` or `AdminRotation`).
+   */
+  adminTemplateName?: string;
+  /**
+   * VP nonce as lowercase hex (32 characters = 16 bytes). MUST equal the `Bundle-Id` armor header of `bundle`. Cross-check anchor: a holder that decodes the VP nonce can verify the bundle they opened matches the one the maintainer minted for them.
+   */
+  bundleIdHex: string;
+  /**
+   * Number of DIDs the sealed bundle carries private key material for. `TemplateBootstrap` with no adminTemplate typically yields 1 (the integration DID's keys). `AdminRotation` yields 0 (the `admin` field is top-level, not under `secrets`).
+   */
+  secretCount: number;
+  /**
+   * Number of template-declared side outputs the sealed bundle carries (`did.jsonl` logs, DIDComm service advertisements, etc.). Always 0 for `AdminRotation`.
+   */
+  outputCount: number;
+  /**
+   * Identifier of the registered webvh hosting server the maintainer published the integration's `did.jsonl` to, if any. Absent when the integration is self-hosted or when the template did not declare a webvh server var.
+   */
+  webvhServerId?: string;
+  /**
+   * True when `payload.createContext` was honoured and the maintainer provisioned the target context inline. False when the context already existed (or when `createContext` was omitted / false).
+   */
+  contextCreated?: boolean;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = BootstrapAsk;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ProvisionIntegrationResponsePayload;

package/src/provision/integration/0.2/payload.ts

@@ -173,9 +173,89 @@ export interface DataIntegrityProof {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.
+ */
+export interface ProvisionIntegrationResponsePayload {
+  /**
+   * OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.
+   */
+  bundle: string;
+  /**
+   * SHA-256 of the armored ciphertext, lowercase hex. Used by holders that pin the bundle out-of-band.
+   */
+  digest: string;
+  summary: ProvisionSummary;
+  ext?: Ext1;
+}
+/**
+ * Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.
+ */
+export interface ProvisionSummary {
+  /**
+   * Ephemeral did:key the holder signed the VP with and opens the sealed bundle with. Echo of `request.holder`.
+   */
+  clientDid: string;
+  /**
+   * Long-term admin DID after this provisioning. Equals `clientDid` when no admin rollover occurred (TemplateBootstrap with no `adminTemplate`); equals the freshly-minted admin DID when `adminTemplate` was used or when the ask was `adminRotation`. Maintainers that pre-date admin rollover MAY omit this; consumers SHOULD default it to `clientDid` for backward compatibility.
+   */
+  adminDid?: string;
+  /**
+   * True when the maintainer minted a fresh long-term admin DID and bound the authorization VC + ACL row to it (i.e. `adminDid != clientDid`).
+   */
+  adminRolledOver?: boolean;
+  /**
+   * DID rendered from the integration template. Absent for `adminRotation` (no integration was rendered).
+   */
+  integrationDid?: string;
+  /**
+   * Name of the integration template that was rendered. Absent for `adminRotation`.
+   */
+  templateName?: string;
+  /**
+   * `kind` of the integration template (e.g. `mediator`, `did-hosting-control`, `app`). Absent for `adminRotation`.
+   */
+  templateKind?: string;
+  /**
+   * Name of the admin template that was rendered. Present when an admin DID was minted (either via `TemplateBootstrap.adminTemplate` or `adminRotation`).
+   */
+  adminTemplateName?: string;
+  /**
+   * VP nonce as lowercase hex (32 characters = 16 bytes). MUST equal the `Bundle-Id` armor header of `bundle`. Cross-check anchor: a holder that decodes the VP nonce can verify the bundle they opened matches the one the maintainer minted for them.
+   */
+  bundleIdHex: string;
+  /**
+   * Number of DIDs the sealed bundle carries private key material for. `templateBootstrap` with no adminTemplate typically yields 1 (the integration DID's keys). `adminRotation` yields 0 (the `admin` field is top-level, not under `secrets`).
+   */
+  secretCount: number;
+  /**
+   * Number of template-declared side outputs the sealed bundle carries (`did.jsonl` logs, DIDComm service advertisements, etc.). Always 0 for `adminRotation`.
+   */
+  outputCount: number;
+  /**
+   * Identifier of the registered webvh hosting server the maintainer published the integration's `did.jsonl` to, if any. Absent when the integration is self-hosted or when the template did not declare a webvh server var.
+   */
+  webvhServerId?: string;
+  /**
+   * True when `payload.createContext` was honoured and the maintainer provisioned the target context inline. False when the context already existed (or when `createContext` was omitted / false).
+   */
+  contextCreated?: boolean;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = BootstrapAsk;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ProvisionIntegrationResponsePayload;