@openvtc/trust-tasks 0.26.7 → 0.26.8

package/dist/vta/witness/present/0.1/payload.js

@@ -0,0 +1,170 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/witness/present/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/witness/present/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/witness/present/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vta/witness/present/0.1",
+    "title": "VTA Witness — Present — payload",
+    "description": "A client hands its VTA the witness's answer to the session it opened; the VTA verifies that the answer is the witness's own, builds the presentations bound to its challenge and domain, and returns the witness/session/submit document, signed as the relationship DID, for the client to send.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "sessionId",
+        "response"
+    ],
+    "properties": {
+        "sessionId": {
+            "$ref": "#/$defs/SessionId"
+        },
+        "response": {
+            "$ref": "#/$defs/CarriedDocument",
+            "description": "The witness/session/0.1 #response the witness returned, exactly as received, under the witness's proof."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA Witness — Present — response payload",
+            "description": "The witness/session/submit document to send.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "sessionId",
+                "document"
+            ],
+            "properties": {
+                "sessionId": {
+                    "$ref": "#/$defs/SessionId"
+                },
+                "document": {
+                    "$ref": "#/$defs/CarriedDocument",
+                    "description": "The witness/session/submit/0.1 document, on the session's thread, issued and signed by relationshipDid and addressed to the witness, carrying the relationship presentation in `vp` and, under the member link, the member presentation in the carriage the witness accepts. For the client to send from relationshipDid unaltered."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "CarriedDocument": {
+            "title": "CarriedDocument",
+            "description": "A whole Trust Task document — `id`, `type`, `payload` and every other member, `proof` included — carried between the VTA and the witness by the client: one the VTA built and signed for the client to send, or one the witness returned for the client to hand back. Typed as an open object so every member survives a round trip: carried exactly as built or received, never re-serialised, because its proof is over itself. Its envelope is checked by the VTA against the session record (CONVENTIONS.md §3), not by this schema.",
+            "type": "object",
+            "minProperties": 1
+        },
+        "SessionId": {
+            "title": "SessionId",
+            "description": "The id of the witness/session document the VTA built in vta/witness/open: the session's name, the thread every document of the session is on, and the value the VWC carries as taskContext. The VTA keys its state for the session by it.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA Witness — Present — response payload",
+            "description": "The witness/session/submit document to send.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "sessionId",
+                "document"
+            ],
+            "properties": {
+                "sessionId": {
+                    "$ref": "#/$defs/SessionId"
+                },
+                "document": {
+                    "$ref": "#/$defs/CarriedDocument",
+                    "description": "The witness/session/submit/0.1 document, on the session's thread, issued and signed by relationshipDid and addressed to the witness, carrying the relationship presentation in `vp` and, under the member link, the member presentation in the carriage the witness accepts. For the client to send from relationshipDid unaltered."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "CarriedDocument": {
+            "title": "CarriedDocument",
+            "description": "A whole Trust Task document — `id`, `type`, `payload` and every other member, `proof` included — carried between the VTA and the witness by the client: one the VTA built and signed for the client to send, or one the witness returned for the client to hand back. Typed as an open object so every member survives a round trip: carried exactly as built or received, never re-serialised, because its proof is over itself. Its envelope is checked by the VTA against the session record (CONVENTIONS.md §3), not by this schema.",
+            "type": "object",
+            "minProperties": 1
+        },
+        "SessionId": {
+            "title": "SessionId",
+            "description": "The id of the witness/session document the VTA built in vta/witness/open: the session's name, the thread every document of the session is on, and the value the VWC carries as taskContext. The VTA keys its state for the session by it.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vta/witness/present/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/witness/present/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,qDAA8D,CAAC;AAKvF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,8DAAuE,CAAC;AAKzG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,qDAAqD;IAC5D,OAAO,EAAE,iCAAiC;IAC1C,aAAa,EAAE,mSAAmS;IAClT,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,WAAW;QACX,UAAU;KACX;IACD,YAAY,EAAE;QACZ,WAAW,EAAE;YACX,MAAM,EAAE,mBAAmB;SAC5B;QACD,UAAU,EAAE;YACV,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,yGAAyG;SACzH;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,8CAA8C;YAC7D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,qUAAqU;iBACrV;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,0gBAA0gB;YACzhB,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;SACnB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,2OAA2O;YAC1P,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;SACjB;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,8CAA8C;YAC7D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,qUAAqU;iBACrV;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,0gBAA0gB;YACzhB,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;SACnB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,2OAA2O;YAC1P,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;SACjB;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.26.7",
+  "version": "0.26.8",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_shared/components.ts

@@ -1216,6 +1216,10 @@ export type Sensitivity = "normal" | "high";
  * Which transport a task is acting on. This is the discriminator: it selects which member of `config` is meaningful, and a payload naming one kind with another's config is malformed rather than merely ignored.
  */
 export type ServiceKind = "didcomm" | "rest" | "tsp" | "webauthn";
+/**
+ * The id of the witness/session document the VTA built in vta/witness/open: the session's name, the thread every document of the session is on, and the value the VWC carries as taskContext. The VTA keys its state for the session by it.
+ */
+export type SessionId = string;
 /**
  * `EdDSA` pairs with an `ed25519` key; `ES256` pairs with a `p256` key; `ML-DSA-44` and `ML-DSA-65` pair with `mldsa44` and `mldsa65` keys respectively. An `x25519` key performs key agreement and can sign nothing, so no algorithm here is valid for one. These are JOSE algorithm identifiers, externally owned, so they are carried verbatim and never re-cased (SPEC.md §4.10 rule 5); the ML-DSA names are those RFC 9964 registers in the JOSE Web Signature and Encryption Algorithms registry, which is why their hyphenated casing differs from the `keyType` values beside them — those are specification-defined. The set is expected to grow as algorithms are registered. The enumeration remains closed: an unrecognised algorithm is refused rather than silently substituted with a supported one.
  */
@@ -4484,6 +4488,10 @@ export interface CapabilityScopeListed {
 export interface CapabilityScopeNone {
   scope: "none";
 }
+/**
+ * A whole Trust Task document — `id`, `type`, `payload` and every other member, `proof` included — carried between the VTA and the witness by the client: one the VTA built and signed for the client to send, or one the witness returned for the client to hand back. Typed as an open object so every member survives a round trip: carried exactly as built or received, never re-serialised, because its proof is over itself. Its envelope is checked by the VTA against the session record (CONVENTIONS.md §3), not by this schema.
+ */
+export interface CarriedDocument {}
 /**
  * The terms of a `chunkedTrustTask` transfer, committed before any chunk moves. On export the recipient states them in the descriptor; on import the producer pre-commits them in the request and the recipient echoes them. Either way the manifest arrives in a document whose proof is REQUIRED, so the per-chunk digests are authenticated by the party that computed them and each chunk can be verified — and a single bad chunk re-fetched or refused — on arrival rather than only after reassembly.
  *

package/src/index.ts

@@ -562,6 +562,7 @@ export * as WebvhRecordsShared_v0_1 from "./vta/_shared/0.1/webvh-records.js";
 export * as DidTemplateShared_v0_2 from "./vta/_shared/0.2/did-template.js";
 export * as DidKeyRolesShared_v0_3 from "./vta/_shared/0.3/did-key-roles.js";
 export * as PcsEngineShared_v0_4 from "./vta/_shared/0.4/pcs-engine.js";
+export * as WitnessPartyShared_v0_5 from "./vta/_shared/0.5/witness-party.js";
 export * as VtaAppStateDelete_v1_0 from "./vta/app-state/delete/1.0/payload.js";
 export * as VtaAppStateGetMany_v1_0 from "./vta/app-state/get-many/1.0/payload.js";
 export * as VtaAppStateGet_v1_0 from "./vta/app-state/get/1.0/payload.js";
@@ -679,6 +680,9 @@ export * as VtaWebvhServersReconcile_v0_1 from "./vta/webvh/servers/reconcile/0.
 export * as VtaWebvhServersRegister_v1_0 from "./vta/webvh/servers/register/1.0/payload.js";
 export * as VtaWebvhServersRemove_v1_0 from "./vta/webvh/servers/remove/1.0/payload.js";
 export * as VtaWebvhServersRetireOrphan_v0_1 from "./vta/webvh/servers/retire-orphan/0.1/payload.js";
+export * as VtaWitnessAccept_v0_1 from "./vta/witness/accept/0.1/payload.js";
+export * as VtaWitnessOpen_v0_1 from "./vta/witness/open/0.1/payload.js";
+export * as VtaWitnessPresent_v0_1 from "./vta/witness/present/0.1/payload.js";
 export * as VtaWitnessRequest_v0_1 from "./vta/witness/request/0.1/payload.js";
 export * as BackupShared_v0_1 from "./vtc/_shared/0.1/backup.js";
 export * as CeremonyShared_v0_1 from "./vtc/_shared/0.1/ceremony.js";

package/src/vta/_shared/0.5/witness-party.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/_shared/0.5/witness-party.schema.json
+ */
+
+/**
+ * A VTA can act as the participating party of a witnessed session (witness/session/0.1, witness/session/submit/0.1) for its principal: it builds and signs, as the principal's relationship DID, every document the party sends, and verifies and stores what the witness returns. The client carries the documents between the VTA and the witness. The normative rules (the session binding, custody, authorization, retries) are in CONVENTIONS.md beside this file. Not itself a Trust Task specification: the `_shared` folder is skipped by the registry build and the codegen.
+ */
+export interface WitnessedPartySharedDefinitionsForTheVtaWitnessTasks {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { CarriedDocument, SessionId } from "../../../_shared/components.js";

package/src/vta/witness/accept/0.1/payload.ts

@@ -0,0 +1,326 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/witness/accept/0.1/payload.schema.json
+ */
+
+import type { CarriedDocument, DigestMultibase, Ext, SessionId } from "../../../../_shared/components.js";
+
+
+/**
+ * A client hands its VTA the witness's answer to the submission; the VTA verifies the Verifiable Witness Credential it carries against the session, and stores it in the credential vault with its evidence.
+ */
+export interface VTAWitnessAcceptPayload {
+  sessionId: SessionId;
+  /**
+   * The witness/session/submit/0.1 #response the witness returned, exactly as received, under the witness's proof. It carries the VWC and its vwcDigestMultibase.
+   */
+  response: CarriedDocument;
+  ext?: Ext;
+}
+/**
+ * The stored VWC's vault handle, its digest, and the evidence documents that carry it. Sent only once the VWC is verified and stored.
+ */
+export interface VTAWitnessAcceptResponsePayload {
+  sessionId: SessionId;
+  /**
+   * The credential-vault handle the VWC is now stored under, with its evidence.
+   */
+  credentialId: string;
+  /**
+   * The witness that issued the VWC: the session's witness, since a VWC issued by any other party is refused, not stored.
+   */
+  witness: string;
+  /**
+   * The digest the witness returned for the VWC, which the VTA has checked against the VWC it stored: over the RFC 8785 canonicalization of the VWC, proof included.
+   */
+  vwcDigestMultibase: DigestMultibase;
+  evidence: Evidence;
+  ext?: Ext;
+}
+/**
+ * The two documents a holder ships with the VWC so a verifier can pair it with the session that produced it (witness/session/submit, This response is the outcome evidence). Each is carried exactly as sent or received, never re-serialised.
+ */
+export interface Evidence {
+  /**
+   * The witness/session document that opened the session, as the VTA built it. The VWC's taskContext is its id and its taskDigestMultibase is computed over it.
+   */
+  session: CarriedDocument;
+  /**
+   * The witness/session/submit #response, as handed back, under the witness's proof. It carries the VWC and its vwcDigestMultibase.
+   */
+  outcome: CarriedDocument;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CarriedDocument, DigestMultibase, Ext, SessionId };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/witness/accept/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAWitnessAcceptPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/witness/accept/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAWitnessAcceptResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vta/witness/accept/0.1",
+  "title": "VTA Witness — Accept — payload",
+  "description": "A client hands its VTA the witness's answer to the submission; the VTA verifies the Verifiable Witness Credential it carries against the session, and stores it in the credential vault with its evidence.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "sessionId",
+    "response"
+  ],
+  "properties": {
+    "sessionId": {
+      "$ref": "#/$defs/SessionId"
+    },
+    "response": {
+      "$ref": "#/$defs/CarriedDocument",
+      "description": "The witness/session/submit/0.1 #response the witness returned, exactly as received, under the witness's proof. It carries the VWC and its vwcDigestMultibase."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Evidence": {
+      "title": "Evidence",
+      "description": "The two documents a holder ships with the VWC so a verifier can pair it with the session that produced it (witness/session/submit, This response is the outcome evidence). Each is carried exactly as sent or received, never re-serialised.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "session",
+        "outcome"
+      ],
+      "properties": {
+        "session": {
+          "$ref": "#/$defs/CarriedDocument",
+          "description": "The witness/session document that opened the session, as the VTA built it. The VWC's taskContext is its id and its taskDigestMultibase is computed over it."
+        },
+        "outcome": {
+          "$ref": "#/$defs/CarriedDocument",
+          "description": "The witness/session/submit #response, as handed back, under the witness's proof. It carries the VWC and its vwcDigestMultibase."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA Witness — Accept — response payload",
+      "description": "The stored VWC's vault handle, its digest, and the evidence documents that carry it. Sent only once the VWC is verified and stored.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sessionId",
+        "credentialId",
+        "witness",
+        "vwcDigestMultibase",
+        "evidence"
+      ],
+      "properties": {
+        "sessionId": {
+          "$ref": "#/$defs/SessionId"
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "description": "The credential-vault handle the VWC is now stored under, with its evidence."
+        },
+        "witness": {
+          "type": "string",
+          "pattern": "^did:",
+          "description": "The witness that issued the VWC: the session's witness, since a VWC issued by any other party is refused, not stored."
+        },
+        "vwcDigestMultibase": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "The digest the witness returned for the VWC, which the VTA has checked against the VWC it stored: over the RFC 8785 canonicalization of the VWC, proof included."
+        },
+        "evidence": {
+          "$ref": "#/$defs/Evidence"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "SessionId": {
+      "title": "SessionId",
+      "description": "The id of the witness/session document the VTA built in vta/witness/open: the session's name, the thread every document of the session is on, and the value the VWC carries as taskContext. The VTA keys its state for the session by it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "CarriedDocument": {
+      "title": "CarriedDocument",
+      "description": "A whole Trust Task document — `id`, `type`, `payload` and every other member, `proof` included — carried between the VTA and the witness by the client: one the VTA built and signed for the client to send, or one the witness returned for the client to hand back. Typed as an open object so every member survives a round trip: carried exactly as built or received, never re-serialised, because its proof is over itself. Its envelope is checked by the VTA against the session record (CONVENTIONS.md §3), not by this schema.",
+      "type": "object",
+      "minProperties": 1
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Evidence": {
+      "title": "Evidence",
+      "description": "The two documents a holder ships with the VWC so a verifier can pair it with the session that produced it (witness/session/submit, This response is the outcome evidence). Each is carried exactly as sent or received, never re-serialised.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "session",
+        "outcome"
+      ],
+      "properties": {
+        "session": {
+          "$ref": "#/$defs/CarriedDocument",
+          "description": "The witness/session document that opened the session, as the VTA built it. The VWC's taskContext is its id and its taskDigestMultibase is computed over it."
+        },
+        "outcome": {
+          "$ref": "#/$defs/CarriedDocument",
+          "description": "The witness/session/submit #response, as handed back, under the witness's proof. It carries the VWC and its vwcDigestMultibase."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA Witness — Accept — response payload",
+      "description": "The stored VWC's vault handle, its digest, and the evidence documents that carry it. Sent only once the VWC is verified and stored.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sessionId",
+        "credentialId",
+        "witness",
+        "vwcDigestMultibase",
+        "evidence"
+      ],
+      "properties": {
+        "sessionId": {
+          "$ref": "#/$defs/SessionId"
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "description": "The credential-vault handle the VWC is now stored under, with its evidence."
+        },
+        "witness": {
+          "type": "string",
+          "pattern": "^did:",
+          "description": "The witness that issued the VWC: the session's witness, since a VWC issued by any other party is refused, not stored."
+        },
+        "vwcDigestMultibase": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "The digest the witness returned for the VWC, which the VTA has checked against the VWC it stored: over the RFC 8785 canonicalization of the VWC, proof included."
+        },
+        "evidence": {
+          "$ref": "#/$defs/Evidence"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "SessionId": {
+      "title": "SessionId",
+      "description": "The id of the witness/session document the VTA built in vta/witness/open: the session's name, the thread every document of the session is on, and the value the VWC carries as taskContext. The VTA keys its state for the session by it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "CarriedDocument": {
+      "title": "CarriedDocument",
+      "description": "A whole Trust Task document — `id`, `type`, `payload` and every other member, `proof` included — carried between the VTA and the witness by the client: one the VTA built and signed for the client to send, or one the witness returned for the client to hand back. Typed as an open object so every member survives a round trip: carried exactly as built or received, never re-serialised, because its proof is over itself. Its envelope is checked by the VTA against the session record (CONVENTIONS.md §3), not by this schema.",
+      "type": "object",
+      "minProperties": 1
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;