@openvtc/trust-tasks 0.2.55 → 0.2.56

package/src/vta/did-templates/update/1.0/payload.ts

@@ -3,6 +3,11 @@
  * Source: specs/vta/did-templates/update/1.0/payload.schema.json
  */
 
+/**
+ * Resolved scope of the stored template.
+ */
+export type Scope = Builtin | Global | Context;
+
 /**
  * Replace an existing global DID template on a VTA. Super-admin gated. The `name` is the resource id within the global scope and MUST equal `template.name`; the VTA replaces the stored body, preserving createdAt/createdBy and advancing updatedAt. The success response is the persisted DidTemplateRecord.
  */
@@ -65,9 +70,56 @@ export interface DidTemplate {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The persisted DidTemplateRecord. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by create/get.
+ */
+export interface VTADIDTemplateUpdateResponsePayload {
+  schemaVersion: 1;
+  name: string;
+  kind: string;
+  description?: string | null;
+  methods?: string[];
+  requiredVars?: string[];
+  optionalVars?: {
+    [k: string]: unknown | undefined;
+  };
+  defaults?: {
+    [k: string]: unknown | undefined;
+  };
+  document: {};
+  scope: Scope;
+  /**
+   * UTC unix-epoch seconds the template was first stored.
+   */
+  createdAt: number;
+  /**
+   * UTC unix-epoch seconds of the last write.
+   */
+  updatedAt: number;
+  /**
+   * DID of the admin who last wrote the template.
+   */
+  createdBy: string;
+}
+export interface Builtin {
+  type: "builtin";
+}
+export interface Global {
+  type: "global";
+}
+export interface Context {
+  type: "context";
+  contextId: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/update/1.0" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = Scope;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/update/1.0#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTADIDTemplateUpdateResponsePayload;

package/src/vta/did-templates/update/2.0/payload.ts

@@ -3,6 +3,11 @@
  * Source: specs/vta/did-templates/update/2.0/payload.schema.json
  */
 
+/**
+ * Resolved scope of the stored template.
+ */
+export type Scope = Builtin | Global | Context;
+
 /**
  * Replace an existing DID template on a VTA. Omit `contextId` to replace in the global scope (super-admin gated); set it to replace a template scoped to that context (gated on the context's admin, or a super-admin). The `name` is the resource id within the selected scope and MUST equal `template.name`; the VTA replaces the stored body, preserving createdAt/createdBy and advancing updatedAt. The success response is the persisted DidTemplateRecord.
  */
@@ -69,9 +74,56 @@ export interface DidTemplate {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.
+ */
+export interface DidTemplateRecord {
+  schemaVersion: 1;
+  name: string;
+  kind: string;
+  description?: string | null;
+  methods?: string[];
+  requiredVars?: string[];
+  optionalVars?: {
+    [k: string]: unknown | undefined;
+  };
+  defaults?: {
+    [k: string]: unknown | undefined;
+  };
+  document: {};
+  scope: Scope;
+  /**
+   * UTC unix-epoch seconds the template was first stored.
+   */
+  createdAt: number;
+  /**
+   * UTC unix-epoch seconds of the last write.
+   */
+  updatedAt: number;
+  /**
+   * DID of the admin who last wrote the template.
+   */
+  createdBy: string;
+}
+export interface Builtin {
+  type: "builtin";
+}
+export interface Global {
+  type: "global";
+}
+export interface Context {
+  type: "context";
+  contextId: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/update/2.0" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = Scope;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/update/2.0#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DidTemplateRecord;

package/src/vta/memory/delete/0.1/payload.ts

@@ -20,9 +20,25 @@ export interface VTAMemoryDeletePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Success response to vta/memory/delete. Type https://trusttasks.org/spec/vta/memory/delete/0.1#response.
+ */
+export interface VTAMemoryDeleteResponsePayload {
+  /**
+   * The forgotten item's key.
+   */
+  key: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/memory/delete/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAMemoryDeletePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/memory/delete/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAMemoryDeleteResponsePayload;

package/src/vta/memory/list/0.1/payload.ts

@@ -16,9 +16,28 @@ export interface VTAMemoryListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Success response to vta/memory/list. Type https://trusttasks.org/spec/vta/memory/list/0.1#response.
+ */
+export interface VTAMemoryListResponsePayload {
+  /**
+   * Every memory item in the context.
+   */
+  items: {
+    key: string;
+    value: string;
+  }[];
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/memory/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAMemoryListPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/memory/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAMemoryListResponsePayload;

package/src/vta/memory/put/0.1/payload.ts

@@ -24,9 +24,31 @@ export interface VTAMemoryPutPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Success response to vta/memory/put. Type https://trusttasks.org/spec/vta/memory/put/0.1#response.
+ */
+export interface VTAMemoryPutResponsePayload {
+  /**
+   * The stored item's key.
+   */
+  key: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/memory/put/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAMemoryPutPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/memory/put/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAMemoryPutResponsePayload;

package/src/vta/passkey-vms/enroll-challenge/0.1/payload.ts

@@ -23,9 +23,59 @@ export interface VTAPasskeyVMEnrollChallengePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The server-issued WebAuthn registration challenge. All byte-valued fields are base64url-encoded (no padding); the browser passes the decoded bytes to navigator.credentials.create.
+ */
+export interface VTAPasskeyVMEnrollChallengeResponsePayload {
+  /**
+   * Opaque server-side ceremony id. The producer MUST echo this back in the vta/passkey-vms/enroll-submit request. Binds the challenge, the target DID, and the eventual submission together.
+   */
+  ceremonyId: string;
+  /**
+   * WebAuthn challenge (base64url, no padding; at least 32 random bytes).
+   */
+  challenge: string;
+  /**
+   * WebAuthn Relying-Party identifier — a DNS name that matches the origin the browser is served from.
+   */
+  rpId: string;
+  /**
+   * Human-readable Relying-Party name.
+   */
+  rpName: string;
+  /**
+   * Stable WebAuthn user handle (base64url). Opaque to the client; the VTA derives a per-DID handle.
+   */
+  userHandle: string;
+  /**
+   * WebAuthn user name (e.g. the DID or the operator-supplied label).
+   */
+  userName: string;
+  /**
+   * WebAuthn user display name.
+   */
+  userDisplayName: string;
+  /**
+   * Suggested ceremony timeout in milliseconds. Advisory; the authenticator and browser apply their own limits.
+   */
+  timeoutMs?: number;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/enroll-challenge/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAPasskeyVMEnrollChallengePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/enroll-challenge/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAPasskeyVMEnrollChallengeResponsePayload;

package/src/vta/passkey-vms/enroll-submit/0.1/payload.ts

@@ -55,9 +55,65 @@ export interface VTAPasskeyVMEnrollSubmitPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Successful enrolment. The verificationMethod has already been appended to the DID document via a WebVH log entry at the returned version.
+ */
+export interface VTAPasskeyVMEnrollSubmitResponsePayload {
+  verificationMethod: PasskeyVerificationMethod;
+  /**
+   * The WebVH log-entry version that recorded the change (e.g. "3-Qm…").
+   */
+  webvhVersion: string;
+  ext?: Ext1;
+}
+/**
+ * The verificationMethod entry exactly as it now appears in the DID document. `publicKeyMultibase` here is the server-re-derived key, which is authoritative.
+ */
+export interface PasskeyVerificationMethod {
+  /**
+   * The verificationMethod id as it appears in the DID document: `<did>#passkey-<base64url(sha256(credentialId))>`. The fragment is content-derived so a verifier can locate this VM by recomputing `sha256(credential.id)`.
+   */
+  id: string;
+  /**
+   * Always `Multikey`. The WebAuthn public key is published in W3C Multikey form so DID resolvers and verifiers need no WebAuthn-specific knowledge to consume it.
+   */
+  type: "Multikey";
+  /**
+   * The DID this verificationMethod is published on (the DID being augmented).
+   */
+  controller: string;
+  /**
+   * W3C Multikey (multibase) encoding of the WebAuthn credential public key. This is the value a verifier validates a WebAuthn assertion against. Re-derived server-side from the attestation at enrolment — never trusted from the browser (see vta/passkey-vms/enroll-submit).
+   */
+  publicKeyMultibase: string;
+  /**
+   * The WebAuthn `credential.id` (base64url, no padding). Lets a verifier recompute `sha256(credentialId)` and match the assertion to this VM's `id` fragment.
+   */
+  webauthnCredentialId: string;
+  /**
+   * Transport hints reported by the authenticator (e.g. `internal`, `hybrid`, `usb`, `nfc`, `ble`). Advisory only — verifiers MUST NOT make trust decisions based on transport hints.
+   */
+  webauthnTransports?: string[];
+  /**
+   * Optional operator-supplied human-readable label (e.g. "MacBook Touch ID"). Informational; not authoritative and not a security input.
+   */
+  label?: string;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/enroll-submit/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAPasskeyVMEnrollSubmitPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/enroll-submit/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAPasskeyVMEnrollSubmitResponsePayload;

package/src/vta/passkey-vms/list/0.1/payload.ts

@@ -19,9 +19,61 @@ export interface VTAPasskeyVMListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The passkey verificationMethods currently on the DID.
+ */
+export interface VTAPasskeyVMListResponsePayload {
+  /**
+   * Every passkey verificationMethod published on the DID. Empty when none are enrolled.
+   */
+  verificationMethods: PasskeyVerificationMethod[];
+  ext?: Ext1;
+}
+export interface PasskeyVerificationMethod {
+  /**
+   * The verificationMethod id as it appears in the DID document: `<did>#passkey-<base64url(sha256(credentialId))>`. The fragment is content-derived so a verifier can locate this VM by recomputing `sha256(credential.id)`.
+   */
+  id: string;
+  /**
+   * Always `Multikey`. The WebAuthn public key is published in W3C Multikey form so DID resolvers and verifiers need no WebAuthn-specific knowledge to consume it.
+   */
+  type: "Multikey";
+  /**
+   * The DID this verificationMethod is published on (the DID being augmented).
+   */
+  controller: string;
+  /**
+   * W3C Multikey (multibase) encoding of the WebAuthn credential public key. This is the value a verifier validates a WebAuthn assertion against. Re-derived server-side from the attestation at enrolment — never trusted from the browser (see vta/passkey-vms/enroll-submit).
+   */
+  publicKeyMultibase: string;
+  /**
+   * The WebAuthn `credential.id` (base64url, no padding). Lets a verifier recompute `sha256(credentialId)` and match the assertion to this VM's `id` fragment.
+   */
+  webauthnCredentialId: string;
+  /**
+   * Transport hints reported by the authenticator (e.g. `internal`, `hybrid`, `usb`, `nfc`, `ble`). Advisory only — verifiers MUST NOT make trust decisions based on transport hints.
+   */
+  webauthnTransports?: string[];
+  /**
+   * Optional operator-supplied human-readable label (e.g. "MacBook Touch ID"). Informational; not authoritative and not a security input.
+   */
+  label?: string;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAPasskeyVMListPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAPasskeyVMListResponsePayload;

package/src/vta/passkey-vms/revoke/0.1/payload.ts

@@ -23,9 +23,27 @@ export interface VTAPasskeyVMRevokePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Empty success body. The verificationMethod has been removed via a WebVH log entry. Modelled as an object so future additive fields (e.g. the resulting WebVH version) do not require a version bump.
+ */
+export interface VTAPasskeyVMRevokeResponsePayload {
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/revoke/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAPasskeyVMRevokePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/revoke/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAPasskeyVMRevokeResponsePayload;

package/src/vta/webvh/dids/update/1.0/payload.ts

@@ -49,9 +49,43 @@ export interface WebVHDIDUpdatePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The published entry. camelCase per the framework convention — note the counts are the state AFTER the update, including the rotation the caller did not ask for.
+ */
+export interface WebVHDIDUpdateResponsePayload {
+  did: string;
+  /**
+   * versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`.
+   */
+  newVersionId: string;
+  newScid?: string;
+  /**
+   * The appended log entry, as JSON text.
+   */
+  newLogEntry?: string;
+  /**
+   * Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything.
+   */
+  updateKeysCount?: number;
+  /**
+   * Pre-rotation commitments published by this entry.
+   */
+  preRotationKeyCount?: number;
+  /**
+   * True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`.
+   */
+  serverless?: boolean;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/update/1.0" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = WebVHDIDUpdatePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/update/1.0#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = WebVHDIDUpdateResponsePayload;

package/src/vta/webvh/servers/domains/0.1/payload.ts

@@ -19,9 +19,69 @@ export interface WebVHServerDomainsPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The success response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vta/webvh/servers/domains/0.1#response.
+ */
+export interface WebVHServerDomainsResponsePayload {
+  /**
+   * The domains the agent may use on that server, as the server reported them. Empty is a legitimate answer — a server the agent can reach but holds no domain grant on.
+   */
+  domains: DomainEntry[];
+  /**
+   * The domain used when a request names none — the caller's own default where the server records one, else the server's system default. Producers SHOULD omit it when there is neither; `null` is accepted as the same answer, and consumers MUST NOT read a difference between the two.
+   */
+  default?: string | null;
+  ext?: Ext2;
+}
+export interface DomainEntry {
+  /**
+   * Hosting domain name (e.g. `did.example.com`). Compared case-insensitively; producers SHOULD emit lowercase canonical form.
+   */
+  name: string;
+  /**
+   * Optional human-readable label.
+   */
+  label?: string;
+  /**
+   * Domain lifecycle state. A `disabled` domain still serves existing DIDs in read-only mode for the host's configured grace period before purge becomes eligible.
+   */
+  status: "active" | "disabled";
+  /**
+   * When `true`, this domain is the host's default — new DIDs created without an explicit domain are hosted here. Exactly one entry SHOULD carry `defaultDomain: true`.
+   */
+  defaultDomain?: boolean;
+  createdAt: string;
+  /**
+   * Present iff `status === "disabled"`.
+   */
+  disabledAt?: string;
+  /**
+   * Earliest RFC3339 timestamp at which the host's background sweep is allowed to purge content for a disabled domain. Operators with administrative authority MAY override the wait via `domain/purge`.
+   */
+  purgeAt?: string;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext2 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/webvh/servers/domains/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = WebVHServerDomainsPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/servers/domains/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = WebVHServerDomainsResponsePayload;

package/src/vtc/admin/bootstrap/0.1/payload.ts

@@ -16,9 +16,26 @@ export interface VTCAdminBootstrapPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface VTCAdminBootstrapResponsePayload {
+  /**
+   * The admin DID just written to the ACL.
+   */
+  adminDid: string;
+  /**
+   * event_id of the persisted CommunityInstalled audit envelope (a UUID).
+   */
+  eventId: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/admin/bootstrap/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCAdminBootstrapPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/admin/bootstrap/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCAdminBootstrapResponsePayload;

package/src/vtc/admin/invites/create/0.1/payload.ts

@@ -24,9 +24,38 @@ export interface VTCAdminInvitesCreatePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface VTCAdminInvitesCreateResponsePayload {
+  /**
+   * Invite identifier; the revoke target.
+   */
+  jti: string;
+  /**
+   * One-shot enrolment URL. Returned once and never retrievable again.
+   */
+  installUrl: string;
+  /**
+   * Secret that authorises the enrolment. Returned once.
+   */
+  claimCode: string;
+  /**
+   * When the invite lapses.
+   */
+  expiresAt: string;
+  /**
+   * True when the target DID had no ACL entry and one was created.
+   */
+  aclEntryCreated: boolean;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/admin/invites/create/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCAdminInvitesCreatePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/admin/invites/create/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCAdminInvitesCreateResponsePayload;

package/src/vtc/admin/invites/list/0.1/payload.ts

@@ -3,6 +3,11 @@
  * Source: specs/vtc/admin/invites/list/0.1/payload.schema.json
  */
 
+/**
+ * `issued` is outstanding and revocable; `consumed` and `expired` are terminal.
+ */
+export type InviteStatus = "issued" | "consumed" | "expired";
+
 export interface VTCAdminInvitesListPayload {
   ext?: Ext;
 }
@@ -12,9 +17,44 @@ export interface VTCAdminInvitesListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface VTCAdminInvitesListResponsePayload {
+  /**
+   * Every invite the community holds, outstanding and terminal.
+   */
+  invites: InviteSummary[];
+  ext?: Ext;
+}
+/**
+ * One outstanding or historical admin invite. Consumed rows are retained as audit history and cannot be revoked.
+ */
+export interface InviteSummary {
+  /**
+   * Unique invite identifier; the revoke target.
+   */
+  jti: string;
+  status: InviteStatus;
+  /**
+   * The admin DID this invite enrols a passkey for.
+   */
+  targetDid?: string;
+  /**
+   * When an `issued` invite lapses.
+   */
+  expiresAt?: string;
+  /**
+   * When the invite was redeemed, if it was.
+   */
+  consumedAt?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/admin/invites/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = InviteStatus;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/admin/invites/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCAdminInvitesListResponsePayload;