@openvtc/trust-tasks 0.21.11 → 0.21.13

package/src/vtc/website/upload/chunk/0.1/payload.ts

@@ -0,0 +1,295 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/website/upload/chunk/0.1/payload.schema.json
+ */
+
+import type { ChunkData, ChunkIndex, DigestMultibase, ExpiresAt, Ext, UploadId } from "../../../../../_shared/components.js";
+
+
+/**
+ * One chunk of an open upload. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTCWebsiteUploadChunkPayload {
+  uploadId: UploadId;
+  index: ChunkIndex;
+  digestMultibase: DigestMultibase;
+  data: ChunkData;
+  ext?: Ext;
+}
+export interface VTCWebsiteUploadChunkResponsePayload {
+  uploadId: UploadId;
+  index: ChunkIndex;
+  /**
+   * Whether this request is what stored the chunk. False means identical bytes were already staged at this index — a success, and why a chunk can be re-sent safely.
+   */
+  stored: boolean;
+  /**
+   * Indices still missing after this write.
+   */
+  remainingCount: number;
+  expiresAt: ExpiresAt;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ChunkData, ChunkIndex, DigestMultibase, ExpiresAt, Ext, UploadId };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/website/upload/chunk/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCWebsiteUploadChunkPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/website/upload/chunk/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCWebsiteUploadChunkResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/website/upload/chunk/0.1",
+  "title": "VTC Website — Upload — Chunk — payload",
+  "description": "One chunk of an open upload. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "uploadId",
+    "index",
+    "digestMultibase",
+    "data"
+  ],
+  "properties": {
+    "uploadId": {
+      "$ref": "#/$defs/UploadId"
+    },
+    "index": {
+      "$ref": "#/$defs/ChunkIndex"
+    },
+    "digestMultibase": {
+      "$ref": "#/$defs/DigestMultibase"
+    },
+    "data": {
+      "$ref": "#/$defs/ChunkData"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Website — Upload — Chunk — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "uploadId",
+        "index",
+        "stored",
+        "remainingCount",
+        "expiresAt"
+      ],
+      "properties": {
+        "uploadId": {
+          "$ref": "#/$defs/UploadId"
+        },
+        "index": {
+          "$ref": "#/$defs/ChunkIndex"
+        },
+        "stored": {
+          "type": "boolean",
+          "description": "Whether this request is what stored the chunk. False means identical bytes were already staged at this index — a success, and why a chunk can be re-sent safely."
+        },
+        "remainingCount": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 4095,
+          "description": "Indices still missing after this write."
+        },
+        "expiresAt": {
+          "$ref": "#/$defs/ExpiresAt"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ExpiresAt": {
+      "title": "ExpiresAt",
+      "description": "After which the bundle is collected: staged bytes discarded, tokens and chunk requests refused. Short by design. For a chunked transfer a recipient may move it later as chunks are exchanged, never past its own ceiling — each chunk response reports the current value.",
+      "type": "string",
+      "format": "date-time"
+    },
+    "ChunkIndex": {
+      "title": "ChunkIndex",
+      "description": "Zero-based position of a chunk within its bundle. Valid values are 0 to chunkCount − 1; an index outside that range is refused with chunkOutOfRange rather than validated here, because the bound depends on the bundle.",
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 4095
+    },
+    "UploadId": {
+      "title": "UploadId",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+      "description": "Handle for one upload across begin, chunk, commit and abort, and — for a bundle — deploy. Recipient-generated and unguessable, which is what lets a reference to somebody else's upload be answered as not-found without confirming it exists. Opaque: a producer quotes what it was given."
+    },
+    "ChunkData": {
+      "title": "ChunkData",
+      "description": "The chunk's bytes, base64url-encoded without padding (RFC 4648 §5). Bounded at 349526 characters, the unpadded encoding of a 262144-byte chunk. These are bytes of the encrypted bundle, so a chunk read in isolation reveals nothing of the agent's state — but a complete set of chunks is the export, and is to be handled as such.",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 349526,
+      "pattern": "^[A-Za-z0-9_-]+$"
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Website — Upload — Chunk — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "uploadId",
+        "index",
+        "stored",
+        "remainingCount",
+        "expiresAt"
+      ],
+      "properties": {
+        "uploadId": {
+          "$ref": "#/$defs/UploadId"
+        },
+        "index": {
+          "$ref": "#/$defs/ChunkIndex"
+        },
+        "stored": {
+          "type": "boolean",
+          "description": "Whether this request is what stored the chunk. False means identical bytes were already staged at this index — a success, and why a chunk can be re-sent safely."
+        },
+        "remainingCount": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 4095,
+          "description": "Indices still missing after this write."
+        },
+        "expiresAt": {
+          "$ref": "#/$defs/ExpiresAt"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ExpiresAt": {
+      "title": "ExpiresAt",
+      "description": "After which the bundle is collected: staged bytes discarded, tokens and chunk requests refused. Short by design. For a chunked transfer a recipient may move it later as chunks are exchanged, never past its own ceiling — each chunk response reports the current value.",
+      "type": "string",
+      "format": "date-time"
+    },
+    "ChunkIndex": {
+      "title": "ChunkIndex",
+      "description": "Zero-based position of a chunk within its bundle. Valid values are 0 to chunkCount − 1; an index outside that range is refused with chunkOutOfRange rather than validated here, because the bound depends on the bundle.",
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 4095
+    },
+    "UploadId": {
+      "title": "UploadId",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+      "description": "Handle for one upload across begin, chunk, commit and abort, and — for a bundle — deploy. Recipient-generated and unguessable, which is what lets a reference to somebody else's upload be answered as not-found without confirming it exists. Opaque: a producer quotes what it was given."
+    },
+    "ChunkData": {
+      "title": "ChunkData",
+      "description": "The chunk's bytes, base64url-encoded without padding (RFC 4648 §5). Bounded at 349526 characters, the unpadded encoding of a 262144-byte chunk. These are bytes of the encrypted bundle, so a chunk read in isolation reveals nothing of the agent's state — but a complete set of chunks is the export, and is to be handled as such.",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 349526,
+      "pattern": "^[A-Za-z0-9_-]+$"
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vtc/website/upload/commit/0.1/payload.ts

@@ -0,0 +1,385 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/website/upload/commit/0.1/payload.schema.json
+ */
+
+import type { ExpectedSha256, ExpectedSizeBytes, ExpiresAt, Ext, UploadId, UploadTarget, WebsiteEtag, WebsitePath } from "../../../../../_shared/components.js";
+
+
+/**
+ * Complete an upload. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTCWebsiteUploadCommitPayload {
+  uploadId: UploadId;
+  ext?: Ext;
+}
+/**
+ * Exactly one of `file` (for a `file` target) and `stagedUntil` (for a `bundle` target) is present — a rule over two members that this schema does not express.
+ */
+export interface VTCWebsiteUploadCommitResponsePayload {
+  uploadId: UploadId;
+  target: UploadTarget;
+  sha256: ExpectedSha256;
+  sizeBytes: ExpectedSizeBytes;
+  file?: WrittenFile;
+  stagedUntil?: ExpiresAt;
+  ext?: Ext;
+}
+/**
+ * The file a `file` upload wrote.
+ */
+export interface WrittenFile {
+  path: WebsitePath;
+  etag: WebsiteEtag;
+  /**
+   * The file's size in bytes.
+   */
+  sizeBytes: number;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ExpectedSha256, ExpectedSizeBytes, ExpiresAt, Ext, UploadId, UploadTarget, WebsiteEtag, WebsitePath };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/website/upload/commit/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCWebsiteUploadCommitPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/website/upload/commit/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCWebsiteUploadCommitResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/website/upload/commit/0.1",
+  "title": "VTC Website — Upload — Commit — payload",
+  "description": "Complete an upload. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "uploadId"
+  ],
+  "properties": {
+    "uploadId": {
+      "$ref": "#/$defs/UploadId"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "WrittenFile": {
+      "title": "WrittenFile",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "etag",
+        "sizeBytes"
+      ],
+      "description": "The file a `file` upload wrote.",
+      "properties": {
+        "path": {
+          "$ref": "#/$defs/WebsitePath"
+        },
+        "etag": {
+          "$ref": "#/$defs/WebsiteEtag"
+        },
+        "sizeBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The file's size in bytes."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Website — Upload — Commit — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "uploadId",
+        "target",
+        "sha256",
+        "sizeBytes"
+      ],
+      "description": "Exactly one of `file` (for a `file` target) and `stagedUntil` (for a `bundle` target) is present — a rule over two members that this schema does not express.",
+      "properties": {
+        "uploadId": {
+          "$ref": "#/$defs/UploadId"
+        },
+        "target": {
+          "$ref": "#/$defs/UploadTarget"
+        },
+        "sha256": {
+          "$ref": "#/$defs/ExpectedSha256"
+        },
+        "sizeBytes": {
+          "$ref": "#/$defs/ExpectedSizeBytes"
+        },
+        "file": {
+          "$ref": "#/$defs/WrittenFile"
+        },
+        "stagedUntil": {
+          "$ref": "#/$defs/ExpiresAt"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ExpiresAt": {
+      "title": "ExpiresAt",
+      "description": "After which the bundle is collected: staged bytes discarded, tokens and chunk requests refused. Short by design. For a chunked transfer a recipient may move it later as chunks are exchanged, never past its own ceiling — each chunk response reports the current value.",
+      "type": "string",
+      "format": "date-time"
+    },
+    "ExpectedSizeBytes": {
+      "title": "ExpectedSizeBytes",
+      "description": "Total byte count of the bundle. A zero-length bundle is not a degenerate success — nothing was serialized — so the floor is 1.",
+      "type": "integer",
+      "minimum": 1
+    },
+    "ExpectedSha256": {
+      "title": "ExpectedSha256",
+      "description": "Lowercase hex SHA-256 of the whole bundle's bytes. Kept in the hex form the 1.0 descriptor published rather than moved to DigestMultibase, because it is an unchanged member of an existing descriptor and re-encoding it would break every stream producer for no gain in what it checks. For a chunked transfer it is the check over the reassembled bundle, applied after every chunk has verified individually, so that a correct set of chunks assembled in the wrong order is still caught.",
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "UploadTarget": {
+      "title": "UploadTarget",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind"
+      ],
+      "description": "What the uploaded bytes are for, committed before any byte moves. `file`: one file at `path`, written into the site when the upload commits — the single-file write. `bundle`: a gzip-compressed tar of the whole site, staged when the upload commits and published by vtc/website/deploy. `path` is required for a `file` target and forbidden for a `bundle`, and `ifMatch` is allowed only for a `file` — rules over two members that this schema does not express; a community refuses a violation with `malformedRequest`. `ifMatch` is optimistic concurrency: the write commits only if the file's current content hash is this value.",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "enum": [
+            "file",
+            "bundle"
+          ]
+        },
+        "path": {
+          "$ref": "#/$defs/WebsitePath"
+        },
+        "ifMatch": {
+          "$ref": "#/$defs/WebsiteEtag"
+        }
+      }
+    },
+    "WebsiteEtag": {
+      "title": "WebsiteEtag",
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "A file's content hash: the lowercase hex SHA-256 of its bytes — the `etag` vtc/website/files/list reports, and the `ETag` a direct read of the path returns, without the HTTP quotes."
+    },
+    "WebsitePath": {
+      "title": "WebsitePath",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "pattern": "^[^\\\\]+$",
+      "description": "A file's path relative to the site root, `/`-separated, with or without a leading `/`. The community resolves it inside the site root and refuses one that escapes the root (`..`), names a hidden file or directory (a segment beginning `.`), carries a blocklisted extension, or contains a control character — the same rules the public read handler applies, so nothing can be written that the site would refuse to serve, and nothing can be read that it would not."
+    },
+    "UploadId": {
+      "title": "UploadId",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+      "description": "Handle for one upload across begin, chunk, commit and abort, and — for a bundle — deploy. Recipient-generated and unguessable, which is what lets a reference to somebody else's upload be answered as not-found without confirming it exists. Opaque: a producer quotes what it was given."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "WrittenFile": {
+      "title": "WrittenFile",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "etag",
+        "sizeBytes"
+      ],
+      "description": "The file a `file` upload wrote.",
+      "properties": {
+        "path": {
+          "$ref": "#/$defs/WebsitePath"
+        },
+        "etag": {
+          "$ref": "#/$defs/WebsiteEtag"
+        },
+        "sizeBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The file's size in bytes."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Website — Upload — Commit — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "uploadId",
+        "target",
+        "sha256",
+        "sizeBytes"
+      ],
+      "description": "Exactly one of `file` (for a `file` target) and `stagedUntil` (for a `bundle` target) is present — a rule over two members that this schema does not express.",
+      "properties": {
+        "uploadId": {
+          "$ref": "#/$defs/UploadId"
+        },
+        "target": {
+          "$ref": "#/$defs/UploadTarget"
+        },
+        "sha256": {
+          "$ref": "#/$defs/ExpectedSha256"
+        },
+        "sizeBytes": {
+          "$ref": "#/$defs/ExpectedSizeBytes"
+        },
+        "file": {
+          "$ref": "#/$defs/WrittenFile"
+        },
+        "stagedUntil": {
+          "$ref": "#/$defs/ExpiresAt"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ExpiresAt": {
+      "title": "ExpiresAt",
+      "description": "After which the bundle is collected: staged bytes discarded, tokens and chunk requests refused. Short by design. For a chunked transfer a recipient may move it later as chunks are exchanged, never past its own ceiling — each chunk response reports the current value.",
+      "type": "string",
+      "format": "date-time"
+    },
+    "ExpectedSizeBytes": {
+      "title": "ExpectedSizeBytes",
+      "description": "Total byte count of the bundle. A zero-length bundle is not a degenerate success — nothing was serialized — so the floor is 1.",
+      "type": "integer",
+      "minimum": 1
+    },
+    "ExpectedSha256": {
+      "title": "ExpectedSha256",
+      "description": "Lowercase hex SHA-256 of the whole bundle's bytes. Kept in the hex form the 1.0 descriptor published rather than moved to DigestMultibase, because it is an unchanged member of an existing descriptor and re-encoding it would break every stream producer for no gain in what it checks. For a chunked transfer it is the check over the reassembled bundle, applied after every chunk has verified individually, so that a correct set of chunks assembled in the wrong order is still caught.",
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "UploadTarget": {
+      "title": "UploadTarget",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind"
+      ],
+      "description": "What the uploaded bytes are for, committed before any byte moves. `file`: one file at `path`, written into the site when the upload commits — the single-file write. `bundle`: a gzip-compressed tar of the whole site, staged when the upload commits and published by vtc/website/deploy. `path` is required for a `file` target and forbidden for a `bundle`, and `ifMatch` is allowed only for a `file` — rules over two members that this schema does not express; a community refuses a violation with `malformedRequest`. `ifMatch` is optimistic concurrency: the write commits only if the file's current content hash is this value.",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "enum": [
+            "file",
+            "bundle"
+          ]
+        },
+        "path": {
+          "$ref": "#/$defs/WebsitePath"
+        },
+        "ifMatch": {
+          "$ref": "#/$defs/WebsiteEtag"
+        }
+      }
+    },
+    "WebsiteEtag": {
+      "title": "WebsiteEtag",
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "A file's content hash: the lowercase hex SHA-256 of its bytes — the `etag` vtc/website/files/list reports, and the `ETag` a direct read of the path returns, without the HTTP quotes."
+    },
+    "WebsitePath": {
+      "title": "WebsitePath",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "pattern": "^[^\\\\]+$",
+      "description": "A file's path relative to the site root, `/`-separated, with or without a leading `/`. The community resolves it inside the site root and refuses one that escapes the root (`..`), names a hidden file or directory (a segment beginning `.`), carries a blocklisted extension, or contains a control character — the same rules the public read handler applies, so nothing can be written that the site would refuse to serve, and nothing can be read that it would not."
+    },
+    "UploadId": {
+      "title": "UploadId",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+      "description": "Handle for one upload across begin, chunk, commit and abort, and — for a bundle — deploy. Recipient-generated and unguessable, which is what lets a reference to somebody else's upload be answered as not-found without confirming it exists. Opaque: a producer quotes what it was given."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;