@openvtc/trust-tasks 0.28.2 → 0.28.4

package/src/vta/webvh/dids/keys/add/1.0/payload.ts

@@ -8,6 +8,8 @@ import type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship
 
 /**
  * Add a newly generated key to one role of a did:webvh, without removing any — a post-quantum key beside a classical one, or a second operational key.
+ *
+ * @deprecated retired; use vta/dids/keys/add/1.0
  */
 export interface VTAWebVHDIDsKeysAddPayload {
   /**
@@ -46,6 +48,8 @@ export interface VTAWebVHDIDsKeysAddPayload {
 }
 /**
  * Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response. A refusal is a `trust-task-error` document, never this.
+ *
+ * @deprecated retired; use vta/dids/keys/add/1.0
  */
 export interface VTAWebVHDIDsKeysAddResponsePayload {
   did: string;
@@ -98,15 +102,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "retired; use vta/dids/keys/add/1.0";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/add/1.0
+ */
 export type Payload = VTAWebVHDIDsKeysAddPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/add/1.0
+ */
 export type Response = VTAWebVHDIDsKeysAddResponsePayload;
 
 /**

package/src/vta/webvh/dids/keys/list/1.0/payload.ts

@@ -8,6 +8,8 @@ import type { DidVerificationRelationship, Ext, KeyOrigin, KeyRole, KeyRoleAppro
 
 /**
  * List a did:webvh's keys by role, with their state, and optionally the DID's rotation history and any changes awaiting approval.
+ *
+ * @deprecated retired; use vta/dids/keys/list/1.0
  */
 export interface VTAWebVHDIDsKeysListPayload {
   /**
@@ -32,6 +34,8 @@ export interface VTAWebVHDIDsKeysListPayload {
 }
 /**
  * Success response to vta/webvh/dids/keys/list. Type https://trusttasks.org/spec/vta/webvh/dids/keys/list/1.0#response.
+ *
+ * @deprecated retired; use vta/dids/keys/list/1.0
  */
 export interface VTAWebVHDIDsKeysListResponsePayload {
   did: string;
@@ -71,15 +75,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "retired; use vta/dids/keys/list/1.0";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/list/1.0
+ */
 export type Payload = VTAWebVHDIDsKeysListPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/keys/list/1.0#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/list/1.0
+ */
 export type Response = VTAWebVHDIDsKeysListResponsePayload;
 
 /**

package/src/vta/webvh/dids/keys/retire/1.0/payload.ts

@@ -8,6 +8,8 @@ import type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship
 
 /**
  * Retire one key from a did:webvh by planned retirement: remove it from its role, its relationship, keyRoles and the document. Completes a rotation (retire the predecessor), aborts one (retire the successor), or removes an added key. What the key signed while published stays valid.
+ *
+ * @deprecated retired; use vta/dids/keys/retire/1.0
  */
 export interface VTAWebVHDIDsKeysRetirePayload {
   /**
@@ -46,6 +48,8 @@ export interface VTAWebVHDIDsKeysRetirePayload {
 }
 /**
  * Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/retire/1.0#response. A refusal is a `trust-task-error` document, never this.
+ *
+ * @deprecated retired; use vta/dids/keys/retire/1.0
  */
 export interface VTAWebVHDIDsKeysRetireResponsePayload {
   did: string;
@@ -98,15 +102,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "retired; use vta/dids/keys/retire/1.0";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/retire/1.0
+ */
 export type Payload = VTAWebVHDIDsKeysRetirePayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/keys/retire/1.0#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/retire/1.0
+ */
 export type Response = VTAWebVHDIDsKeysRetireResponsePayload;
 
 /**

package/src/vta/webvh/dids/keys/revoke/1.0/payload.ts

@@ -8,6 +8,8 @@ import type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship
 
 /**
  * Revoke a did:webvh key for compromise: withdraw it from its role in one entry, without overlap, record the compromise time so verifiers judge its past signatures accordingly, and put a generated replacement in its place where the role would otherwise be empty.
+ *
+ * @deprecated retired; use vta/dids/keys/revoke/1.0
  */
 export interface VTAWebVHDIDsKeysRevokePayload {
   /**
@@ -52,6 +54,8 @@ export interface VTAWebVHDIDsKeysRevokePayload {
 }
 /**
  * Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/revoke/1.0#response. A refusal is a `trust-task-error` document, never this.
+ *
+ * @deprecated retired; use vta/dids/keys/revoke/1.0
  */
 export interface VTAWebVHDIDsKeysRevokeResponsePayload {
   did: string;
@@ -117,15 +121,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "retired; use vta/dids/keys/revoke/1.0";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/revoke/1.0
+ */
 export type Payload = VTAWebVHDIDsKeysRevokePayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/keys/revoke/1.0#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/revoke/1.0
+ */
 export type Response = VTAWebVHDIDsKeysRevokeResponsePayload;
 
 /**

package/src/vta/webvh/dids/rotate-keys/1.0/payload.ts

@@ -8,8 +8,6 @@ import type { Ext } from "../../../../../_shared/components.js";
 
 /**
  * Rotate a did:webvh's signing keys by appending a log entry that moves to the pre-committed successor.
- *
- * @deprecated superseded by vta/webvh/dids/rotate-keys/2.0
  */
 export interface VTAWebVHDIDsRotateKeysPayload {
   did: string;
@@ -22,8 +20,6 @@ export interface VTAWebVHDIDsRotateKeysPayload {
 }
 /**
  * Success response to vta/webvh/dids/rotate-keys. Type https://trusttasks.org/spec/vta/webvh/dids/rotate-keys/1.0#response.
- *
- * @deprecated superseded by vta/webvh/dids/rotate-keys/2.0
  */
 export interface VTAWebVHDIDsRotateKeysResponsePayload {
   did: string;
@@ -68,23 +64,15 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = "superseded by vta/webvh/dids/rotate-keys/2.0";
+export const DEPRECATION: string | null = null;
 
-/**
- * Stable alias for this specification's request payload shape.
- *
- * @deprecated superseded by vta/webvh/dids/rotate-keys/2.0
- */
+/** Stable alias for this specification's request payload shape. */
 export type Payload = VTAWebVHDIDsRotateKeysPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/rotate-keys/1.0#response" as const;
 
-/**
- * Stable alias for this specification's success-response payload shape.
- *
- * @deprecated superseded by vta/webvh/dids/rotate-keys/2.0
- */
+/** Stable alias for this specification's success-response payload shape. */
 export type Response = VTAWebVHDIDsRotateKeysResponsePayload;
 
 /**

package/src/vta/webvh/dids/rotate-keys/2.0/payload.ts

@@ -8,6 +8,8 @@ import type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship
 
 /**
  * Rotate one key role of a did:webvh: stage a successor, activate it no sooner than every cached copy of the document can have seen it, and retire the predecessor at the end of an overlap. For the update role, move the log's update key to its committed successor.
+ *
+ * @deprecated retired; use vta/dids/keys/rotate/1.0
  */
 export interface VTAWebVHDIDsRotateKeysPayload {
   /**
@@ -68,6 +70,8 @@ export interface VTAWebVHDIDsRotateKeysPayload {
 }
 /**
  * Success response. Type https://trusttasks.org/spec/vta/webvh/dids/rotate-keys/2.0#response. A refusal is a `trust-task-error` document, never this.
+ *
+ * @deprecated retired; use vta/dids/keys/rotate/1.0
  */
 export interface VTAWebVHDIDsRotateKeysResponsePayload {
   did: string;
@@ -120,15 +124,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "retired; use vta/dids/keys/rotate/1.0";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/rotate/1.0
+ */
 export type Payload = VTAWebVHDIDsRotateKeysPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/rotate-keys/2.0#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated retired; use vta/dids/keys/rotate/1.0
+ */
 export type Response = VTAWebVHDIDsRotateKeysResponsePayload;
 
 /**

package/src/vta/webvh/dids/update/1.0/payload.ts

@@ -9,7 +9,7 @@ import type { Ext } from "../../../../../_shared/components.js";
 /**
  * Ask a Verifiable Trust Agent to publish a new entry in a did:webvh log it holds the update key for. The agent decides whether to do so; the caller proposes.
  *
- * @deprecated superseded by vta/webvh/dids/update/2.1
+ * @deprecated superseded by vta/webvh/dids/update/1.1
  */
 export interface WebVHDIDUpdatePayload {
   /**
@@ -51,7 +51,7 @@ export interface WebVHDIDUpdatePayload {
 /**
  * The published entry. camelCase per the framework convention — note the counts are the state AFTER the update, including the rotation the caller did not ask for.
  *
- * @deprecated superseded by vta/webvh/dids/update/2.1
+ * @deprecated superseded by vta/webvh/dids/update/1.1
  */
 export interface WebVHDIDUpdateResponsePayload {
   did: string;
@@ -99,12 +99,12 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = "superseded by vta/webvh/dids/update/2.1";
+export const DEPRECATION: string | null = "superseded by vta/webvh/dids/update/1.1";
 
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by vta/webvh/dids/update/2.1
+ * @deprecated superseded by vta/webvh/dids/update/1.1
  */
 export type Payload = WebVHDIDUpdatePayload;
 
@@ -114,7 +114,7 @@ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/upd
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by vta/webvh/dids/update/2.1
+ * @deprecated superseded by vta/webvh/dids/update/1.1
  */
 export type Response = WebVHDIDUpdateResponsePayload;
 

package/src/vta/webvh/dids/update/1.1/payload.ts

@@ -0,0 +1,351 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/webvh/dids/update/1.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../../_shared/components.js";
+
+
+/**
+ * Ask a Verifiable Trust Agent to publish a new entry in a did:webvh log it holds the update key for. The agent decides whether to do so; the caller proposes.
+ */
+export interface WebVHDIDUpdatePayload {
+  /**
+   * The did:webvh being updated. The agent MUST verify it speaks for this subject.
+   */
+  did: string;
+  /**
+   * The new DID document. Omit to leave it unchanged. Supplying this ROTATES the DID's update key and refreshes its pre-rotation commitments, as a parallel consequence of the change — a consequence not visible anywhere in this payload, because it lives in the executing handler's semantics. A consent surface MUST therefore render effects the executor computed, and MUST NOT derive them from this document.
+   */
+  document?: {};
+  /**
+   * Number of pre-rotation commitments to publish. Omit to keep the current count; `0` disables pre-rotation going forward.
+   */
+  preRotationCount?: number;
+  /**
+   * New witness configuration. Omit to keep the current one.
+   */
+  witnesses?: {
+    [k: string]: unknown | undefined;
+  };
+  /**
+   * New watcher URLs. Omit to keep the current set; an empty array removes them.
+   */
+  watchers?: string[];
+  /**
+   * New TTL in seconds. Omit to keep the current value.
+   */
+  ttl?: number;
+  /**
+   * Operator-facing audit label.
+   */
+  label?: string;
+  /**
+   * Optimistic-concurrency precondition: the versionId the caller based this edit on. The agent MUST refuse the update if the DID's latest entry no longer matches. Without it a `get -> edit -> save` cycle silently overwrites a concurrent edit with a chain that is structurally valid, verifies perfectly, and is based on a stale read. Where a human approves the update the window is minutes wide, so this is a routine race rather than an exotic one. OPTIONAL because a scripted caller with no concurrent writers has nothing to protect against; not optional for anything a person looked at.
+   */
+  expectedVersionId?: string;
+  /**
+   * Whether the published document lists this log's `did:scid:vh:1:<scid>?src=<source>` DID URL in `alsoKnownAs`, linking the did:webvh and did:scid forms as one subject (VTI-KEY-164). `true` adds it, for the log's current location, after the entries the document already has; `false` removes every did:scid entry naming this log's SCID. Applied to `document` when one is supplied, otherwise to the current document. Omit to leave `alsoKnownAs` as `document` (or the current document) has it. The agent derives the DID URL itself — the caller never writes it. Changing it publishes an entry, and so ROTATES the update key exactly as supplying `document` does.
+   */
+  scidAlsoKnownAs?: boolean;
+  ext?: Ext;
+}
+/**
+ * The published entry. camelCase per the framework convention — note the counts are the state AFTER the update, including the rotation the caller did not ask for.
+ */
+export interface WebVHDIDUpdateResponsePayload {
+  did: string;
+  /**
+   * versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`.
+   */
+  newVersionId: string;
+  newScid?: string;
+  /**
+   * The appended log entry, as JSON text.
+   */
+  newLogEntry?: string;
+  /**
+   * Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything.
+   */
+  updateKeysCount?: number;
+  /**
+   * Pre-rotation commitments published by this entry.
+   */
+  preRotationKeyCount?: number;
+  /**
+   * True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`.
+   */
+  serverless?: boolean;
+  /**
+   * Whether the published document lists `scidDidUrl` in `alsoKnownAs`. A 1.1 consumer MUST report it; it is optional in the schema only because 1.1 extends 1.0.
+   */
+  scidAlsoKnownAs?: boolean;
+  /**
+   * The `did:scid:vh:1:<scid>?src=<source>` DID URL of the log at its current location — the did:scid DID with the locator a recipient needs to resolve it. Reported whether or not it is listed. A 1.1 consumer MUST report it; it is optional in the schema only because 1.1 extends 1.0.
+   */
+  scidDidUrl?: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/update/1.1" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = "1.0";
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = WebVHDIDUpdatePayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/update/1.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = WebVHDIDUpdateResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vta/webvh/dids/update/1.1",
+  "title": "WebVH DID Update — payload",
+  "description": "Ask a Verifiable Trust Agent to publish a new entry in a did:webvh log it holds the update key for. The agent decides whether to do so; the caller proposes.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "did"
+  ],
+  "properties": {
+    "did": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The did:webvh being updated. The agent MUST verify it speaks for this subject."
+    },
+    "document": {
+      "type": "object",
+      "description": "The new DID document. Omit to leave it unchanged. Supplying this ROTATES the DID's update key and refreshes its pre-rotation commitments, as a parallel consequence of the change — a consequence not visible anywhere in this payload, because it lives in the executing handler's semantics. A consent surface MUST therefore render effects the executor computed, and MUST NOT derive them from this document."
+    },
+    "preRotationCount": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Number of pre-rotation commitments to publish. Omit to keep the current count; `0` disables pre-rotation going forward."
+    },
+    "witnesses": {
+      "description": "New witness configuration. Omit to keep the current one."
+    },
+    "watchers": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "New watcher URLs. Omit to keep the current set; an empty array removes them."
+    },
+    "ttl": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "New TTL in seconds. Omit to keep the current value."
+    },
+    "label": {
+      "type": "string",
+      "maxLength": 256,
+      "description": "Operator-facing audit label."
+    },
+    "expectedVersionId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Optimistic-concurrency precondition: the versionId the caller based this edit on. The agent MUST refuse the update if the DID's latest entry no longer matches. Without it a `get -> edit -> save` cycle silently overwrites a concurrent edit with a chain that is structurally valid, verifies perfectly, and is based on a stale read. Where a human approves the update the window is minutes wide, so this is a routine race rather than an exotic one. OPTIONAL because a scripted caller with no concurrent writers has nothing to protect against; not optional for anything a person looked at."
+    },
+    "scidAlsoKnownAs": {
+      "type": "boolean",
+      "description": "Whether the published document lists this log's `did:scid:vh:1:<scid>?src=<source>` DID URL in `alsoKnownAs`, linking the did:webvh and did:scid forms as one subject (VTI-KEY-164). `true` adds it, for the log's current location, after the entries the document already has; `false` removes every did:scid entry naming this log's SCID. Applied to `document` when one is supplied, otherwise to the current document. Omit to leave `alsoKnownAs` as `document` (or the current document) has it. The agent derives the DID URL itself — the caller never writes it. Changing it publishes an entry, and so ROTATES the update key exactly as supplying `document` does."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "WebVH DID Update — response payload",
+      "description": "The published entry. camelCase per the framework convention — note the counts are the state AFTER the update, including the rotation the caller did not ask for.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "did",
+        "newVersionId"
+      ],
+      "properties": {
+        "did": {
+          "type": "string"
+        },
+        "newVersionId": {
+          "type": "string",
+          "description": "versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`."
+        },
+        "newScid": {
+          "type": "string"
+        },
+        "newLogEntry": {
+          "type": "string",
+          "description": "The appended log entry, as JSON text."
+        },
+        "updateKeysCount": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything."
+        },
+        "preRotationKeyCount": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Pre-rotation commitments published by this entry."
+        },
+        "serverless": {
+          "type": "boolean",
+          "description": "True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`."
+        },
+        "scidAlsoKnownAs": {
+          "type": "boolean",
+          "description": "Whether the published document lists `scidDidUrl` in `alsoKnownAs`. A 1.1 consumer MUST report it; it is optional in the schema only because 1.1 extends 1.0."
+        },
+        "scidDidUrl": {
+          "type": "string",
+          "description": "The `did:scid:vh:1:<scid>?src=<source>` DID URL of the log at its current location — the did:scid DID with the locator a recipient needs to resolve it. Reported whether or not it is listed. A 1.1 consumer MUST report it; it is optional in the schema only because 1.1 extends 1.0."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "WebVH DID Update — response payload",
+      "description": "The published entry. camelCase per the framework convention — note the counts are the state AFTER the update, including the rotation the caller did not ask for.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "did",
+        "newVersionId"
+      ],
+      "properties": {
+        "did": {
+          "type": "string"
+        },
+        "newVersionId": {
+          "type": "string",
+          "description": "versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`."
+        },
+        "newScid": {
+          "type": "string"
+        },
+        "newLogEntry": {
+          "type": "string",
+          "description": "The appended log entry, as JSON text."
+        },
+        "updateKeysCount": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything."
+        },
+        "preRotationKeyCount": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Pre-rotation commitments published by this entry."
+        },
+        "serverless": {
+          "type": "boolean",
+          "description": "True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`."
+        },
+        "scidAlsoKnownAs": {
+          "type": "boolean",
+          "description": "Whether the published document lists `scidDidUrl` in `alsoKnownAs`. A 1.1 consumer MUST report it; it is optional in the schema only because 1.1 extends 1.0."
+        },
+        "scidDidUrl": {
+          "type": "string",
+          "description": "The `did:scid:vh:1:<scid>?src=<source>` DID URL of the log at its current location — the did:scid DID with the locator a recipient needs to resolve it. Reported whether or not it is listed. A 1.1 consumer MUST report it; it is optional in the schema only because 1.1 extends 1.0."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;