@openvtc/trust-tasks 0.28.0 → 0.28.2

package/src/task-consent/decision/0.2/payload.ts

@@ -38,7 +38,7 @@ export interface TaskConsentDecisionPayload {
 export interface WebAuthn {
   kind: "webauthn";
   /**
-   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.6 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.
+   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.7 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.
    */
   assertion: AuthenticatorAssertionResponseLogin;
 }
@@ -179,7 +179,7 @@ export const PAYLOAD_SCHEMA = {
             },
             "assertion": {
               "$ref": "#/$defs/AssertionResponse",
-              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.6 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
+              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.7 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
             }
           }
         },
@@ -363,7 +363,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             },
             "assertion": {
               "$ref": "#/$defs/AssertionResponse",
-              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.6 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
+              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.7 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
             }
           }
         },

package/src/vta/contexts/delete/1.0/payload.ts

@@ -6,6 +6,7 @@
 import type { Ext } from "../../../../_shared/components.js";
 
 
+/** @deprecated superseded by vta/contexts/delete/1.1 */
 export interface VTAContextsDeletePayload {
   /**
    * Context to delete.
@@ -19,6 +20,8 @@ export interface VTAContextsDeletePayload {
 }
 /**
  * Success response to vta/contexts/delete. Type https://trusttasks.org/spec/vta/contexts/delete/1.0#response.
+ *
+ * @deprecated superseded by vta/contexts/delete/1.1
  */
 export interface VTAContextsDeleteResponsePayload {
   id: string;
@@ -53,15 +56,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "superseded by vta/contexts/delete/1.1";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vta/contexts/delete/1.1
+ */
 export type Payload = VTAContextsDeletePayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/contexts/delete/1.0#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vta/contexts/delete/1.1
+ */
 export type Response = VTAContextsDeleteResponsePayload;
 
 /**

package/src/vta/contexts/delete/1.1/payload.ts

@@ -0,0 +1,228 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/contexts/delete/1.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+export interface VTAContextsDeletePayload {
+  /**
+   * Context to delete.
+   */
+  id: string;
+  /**
+   * Delete even though the context still holds keys, DIDs or templates. Default false, and the default is the point: without it a context holding anything is refused, so the destructive case is always something a caller asked for explicitly.
+   */
+  force?: boolean;
+  /**
+   * Complete the deletion even where the published log of a `did:webvh` DID in the subtree could not be confirmed removed from its hosting server — the server unreachable, refusing, or no longer known to the VTA. Default false: such a deletion is refused with `vta/contexts/delete:hostCleanupFailed` and nothing is deleted locally, so the caller can wait for the host and retry. True accepts that the named DIDs may keep resolving and that removing them is now the caller's responsibility; each is reported in `daemonCleanupErrors`.
+   */
+  abandonHostCopies?: boolean;
+  ext?: Ext;
+}
+/**
+ * Success response to vta/contexts/delete. Type https://trusttasks.org/spec/vta/contexts/delete/1.1#response.
+ */
+export interface VTAContextsDeleteResponsePayload {
+  id: string;
+  /**
+   * Whether the context was removed. A successful response carrying `false` means the VTA declined to act — it is not an error, and a consumer MUST NOT report the deletion as done on the basis of the response status alone.
+   */
+  deleted: boolean;
+  /**
+   * One entry per `did:webvh` DID in the deleted subtree whose local record was removed while its hosting server did not confirm removal of the published log. **Those DIDs may still resolve.** Only ever present when the request set `abandonHostCopies`; a requester that did not is refused instead. A consumer MUST surface it rather than treating the deletion as complete. Absent or empty means every host copy was confirmed gone.
+   */
+  daemonCleanupErrors?: string[];
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/contexts/delete/1.1" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAContextsDeletePayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/contexts/delete/1.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAContextsDeleteResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vta/contexts/delete/1.1",
+  "title": "VTA Contexts Delete — payload",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Context to delete."
+    },
+    "force": {
+      "type": "boolean",
+      "default": false,
+      "description": "Delete even though the context still holds keys, DIDs or templates. Default false, and the default is the point: without it a context holding anything is refused, so the destructive case is always something a caller asked for explicitly."
+    },
+    "abandonHostCopies": {
+      "type": "boolean",
+      "default": false,
+      "description": "Complete the deletion even where the published log of a `did:webvh` DID in the subtree could not be confirmed removed from its hosting server — the server unreachable, refusing, or no longer known to the VTA. Default false: such a deletion is refused with `vta/contexts/delete:hostCleanupFailed` and nothing is deleted locally, so the caller can wait for the host and retry. True accepts that the named DIDs may keep resolving and that removing them is now the caller's responsibility; each is reported in `daemonCleanupErrors`."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA Contexts Delete — response payload",
+      "description": "Success response to vta/contexts/delete. Type https://trusttasks.org/spec/vta/contexts/delete/1.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "deleted"
+      ],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "deleted": {
+          "type": "boolean",
+          "description": "Whether the context was removed. A successful response carrying `false` means the VTA declined to act — it is not an error, and a consumer MUST NOT report the deletion as done on the basis of the response status alone."
+        },
+        "daemonCleanupErrors": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "One entry per `did:webvh` DID in the deleted subtree whose local record was removed while its hosting server did not confirm removal of the published log. **Those DIDs may still resolve.** Only ever present when the request set `abandonHostCopies`; a requester that did not is refused instead. A consumer MUST surface it rather than treating the deletion as complete. Absent or empty means every host copy was confirmed gone."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA Contexts Delete — response payload",
+      "description": "Success response to vta/contexts/delete. Type https://trusttasks.org/spec/vta/contexts/delete/1.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "deleted"
+      ],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "deleted": {
+          "type": "boolean",
+          "description": "Whether the context was removed. A successful response carrying `false` means the VTA declined to act — it is not an error, and a consumer MUST NOT report the deletion as done on the basis of the response status alone."
+        },
+        "daemonCleanupErrors": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "One entry per `did:webvh` DID in the deleted subtree whose local record was removed while its hosting server did not confirm removal of the published log. **Those DIDs may still resolve.** Only ever present when the request set `abandonHostCopies`; a requester that did not is refused instead. A consumer MUST surface it rather than treating the deletion as complete. Absent or empty means every host copy was confirmed gone."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vtc/install/claim/finish/0.2/payload.ts

@@ -6,7 +6,7 @@
 import type { Ext } from "../../../../../_shared/components.js";
 
 
-/** @deprecated superseded by vtc/install/claim/finish/0.3 */
+/** @deprecated retired; use vtc/install/claim/passkey/finish/0.1 */
 export interface VTCInstallClaimFinishPayload {
   installToken: string;
   /**
@@ -19,7 +19,7 @@ export interface VTCInstallClaimFinishPayload {
   webauthnResponse: {};
   ext?: Ext;
 }
-/** @deprecated superseded by vtc/install/claim/finish/0.3 */
+/** @deprecated retired; use vtc/install/claim/passkey/finish/0.1 */
 export interface VTCInstallClaimFinishResponsePayload {
   /**
    * Candidate admin DID derived from the passkey's Ed25519 public key.
@@ -52,12 +52,12 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = "superseded by vtc/install/claim/finish/0.3";
+export const DEPRECATION: string | null = "retired; use vtc/install/claim/passkey/finish/0.1";
 
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by vtc/install/claim/finish/0.3
+ * @deprecated retired; use vtc/install/claim/passkey/finish/0.1
  */
 export type Payload = VTCInstallClaimFinishPayload;
 
@@ -67,7 +67,7 @@ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/install/claim/
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by vtc/install/claim/finish/0.3
+ * @deprecated retired; use vtc/install/claim/passkey/finish/0.1
  */
 export type Response = VTCInstallClaimFinishResponsePayload;
 

package/src/vtc/install/claim/passkey/finish/0.1/payload.ts

@@ -0,0 +1,228 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/install/claim/passkey/finish/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../../../_shared/components.js";
+
+
+/**
+ * Complete first-administrator enrolment with a passkey: submit the WebAuthn registration and one assertion proving possession of the registered key, from whose credential public key — Ed25519 or P-256 — the administrator's did:key is derived, and receive a setup-session token. The passkey ceremony of vtc/install/claim/finish 0.2, widened from Ed25519 alone to P-256. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface VTCInstallClaimPasskeyFinishPayload {
+  /**
+   * The install JWT the claim was started with.
+   */
+  installToken: string;
+  /**
+   * From vtc/install/claim/passkey/start.
+   */
+  registrationId: string;
+  /**
+   * RegisterPublicKeyCredential from navigator.credentials.create() (opaque here). Its credential public key is a COSE key for EdDSA/Ed25519 (alg -8) or ES256/P-256 (alg -7); any other is refused with unsupportedAlgorithm.
+   */
+  webauthnResponse: {};
+  /**
+   * PublicKeyCredential from navigator.credentials.get() (opaque here): one assertion by the credential just registered, over the assertion challenge vtc/install/claim/passkey/start issued. Verified against the key the administrator's DID is derived from; it is the proof of possession, whatever the registration's attestation format.
+   */
+  webauthnAssertion: {};
+  ext?: Ext;
+}
+export interface VTCInstallClaimPasskeyFinishResponsePayload {
+  /**
+   * The administrator's DID: the did:key of the passkey credential's own public key — Ed25519 (multicodec 0xed01, did:key:z6Mk…) or P-256, compressed (multicodec 0x1200, did:key:zDn…). Derived by the community from the registered key, never taken from the install token.
+   */
+  adminDid: string;
+  /**
+   * EdDSA JWT (aud=vtc-install-session, 5min TTL) consumed by admin/bootstrap.
+   */
+  setupSessionToken: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/install/claim/passkey/finish/0.1" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCInstallClaimPasskeyFinishPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/install/claim/passkey/finish/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCInstallClaimPasskeyFinishResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/install/claim/passkey/finish/0.1",
+  "title": "VTC Install Claim Passkey Finish — payload",
+  "description": "Complete first-administrator enrolment with a passkey: submit the WebAuthn registration and one assertion proving possession of the registered key, from whose credential public key — Ed25519 or P-256 — the administrator's did:key is derived, and receive a setup-session token. The passkey ceremony of vtc/install/claim/finish 0.2, widened from Ed25519 alone to P-256. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "installToken",
+    "registrationId",
+    "webauthnResponse",
+    "webauthnAssertion"
+  ],
+  "properties": {
+    "installToken": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The install JWT the claim was started with."
+    },
+    "registrationId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "From vtc/install/claim/passkey/start."
+    },
+    "webauthnResponse": {
+      "type": "object",
+      "description": "RegisterPublicKeyCredential from navigator.credentials.create() (opaque here). Its credential public key is a COSE key for EdDSA/Ed25519 (alg -8) or ES256/P-256 (alg -7); any other is refused with unsupportedAlgorithm."
+    },
+    "webauthnAssertion": {
+      "type": "object",
+      "description": "PublicKeyCredential from navigator.credentials.get() (opaque here): one assertion by the credential just registered, over the assertion challenge vtc/install/claim/passkey/start issued. Verified against the key the administrator's DID is derived from; it is the proof of possession, whatever the registration's attestation format."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Install Claim Passkey Finish — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "adminDid",
+        "setupSessionToken"
+      ],
+      "properties": {
+        "adminDid": {
+          "type": "string",
+          "pattern": "^did:key:z(6Mk|Dn)[1-9A-HJ-NP-Za-km-z]+$",
+          "description": "The administrator's DID: the did:key of the passkey credential's own public key — Ed25519 (multicodec 0xed01, did:key:z6Mk…) or P-256, compressed (multicodec 0x1200, did:key:zDn…). Derived by the community from the registered key, never taken from the install token."
+        },
+        "setupSessionToken": {
+          "type": "string",
+          "minLength": 1,
+          "description": "EdDSA JWT (aud=vtc-install-session, 5min TTL) consumed by admin/bootstrap."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Install Claim Passkey Finish — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "adminDid",
+        "setupSessionToken"
+      ],
+      "properties": {
+        "adminDid": {
+          "type": "string",
+          "pattern": "^did:key:z(6Mk|Dn)[1-9A-HJ-NP-Za-km-z]+$",
+          "description": "The administrator's DID: the did:key of the passkey credential's own public key — Ed25519 (multicodec 0xed01, did:key:z6Mk…) or P-256, compressed (multicodec 0x1200, did:key:zDn…). Derived by the community from the registered key, never taken from the install token."
+        },
+        "setupSessionToken": {
+          "type": "string",
+          "minLength": 1,
+          "description": "EdDSA JWT (aud=vtc-install-session, 5min TTL) consumed by admin/bootstrap."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;