@openvtc/trust-tasks 0.8.1 → 0.9.0

package/src/trust-task-error/0.3/payload.ts

@@ -67,14 +67,103 @@ export const TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.3" as co
 /** Stable alias for this specification's request payload shape. */
 export type Payload = TrustTaskErrorPayload;
 
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/trust-task-error/0.3",
+  "title": "Trust Task Error — payload",
+  "description": "The canonical error-response payload per SPEC.md §8.2.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "code",
+    "retryable"
+  ],
+  "properties": {
+    "code": {
+      "type": "string",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "anyOf": [
+        {
+          "enum": [
+            "malformedRequest",
+            "unsupportedType",
+            "unsupportedVersion",
+            "expired",
+            "proofRequired",
+            "proofInvalid",
+            "permissionDenied",
+            "wrongRecipient",
+            "identityMismatch",
+            "taskFailed",
+            "unavailable",
+            "internalError"
+          ]
+        },
+        {
+          "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*(/[a-z][a-z0-9]*(-[a-z0-9]+)*)*:[a-z][a-zA-Z0-9_]*$"
+        }
+      ]
+    },
+    "inResponseTo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "typeUri"
+      ],
+      "description": "Identifies the Trust Task document this error reports on. RECOMMENDED on every error response, and REQUIRED in practice for any error a third party may later be asked to rely on: threadId correlates the exchange only for a party that saw the request, so without this an error retained as evidence names neither the task it terminated nor the instance.",
+      "properties": {
+        "typeUri": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "description": "The Type URI of the document being reported on, including any #request or #response fragment it carried. This is what tells a consumer which specification's semantics apply to an extended code, and which specification declared the requirement that was breached."
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The id of the specific document being reported on (SPEC §4.3). Globally unique and never reused, so it names one instance where threadId names an exchange. Omit only where echoing it would disclose more than the error already does."
+        }
+      }
+    },
+    "message": {
+      "type": "string",
+      "description": "Human-readable description of the error. Non-normative; intended for logs and operator UI."
+    },
+    "retryable": {
+      "type": "boolean",
+      "description": "true if the producer of the original document MAY retry; false if retrying with the same document is not expected to succeed."
+    },
+    "retryAfter": {
+      "type": "string",
+      "format": "date-time",
+      "description": "RFC 3339 timestamp before which the producer SHOULD NOT retry. Meaningful only when retryable is true."
+    },
+    "details": {
+      "type": "object",
+      "description": "Optional task-specific extension data. Per-spec error code declarations may pin the shape via a JSON Schema fragment."
+    }
+  }
+} as const;
+
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
   typeUri: TYPE_URI,
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/trust-task-error/0.4/payload.ts

@@ -68,14 +68,104 @@ export const TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.4" as co
 /** Stable alias for this specification's request payload shape. */
 export type Payload = TrustTaskErrorPayload;
 
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/trust-task-error/0.4",
+  "title": "Trust Task Error — payload",
+  "description": "The canonical error-response payload per SPEC.md §8.2.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "code",
+    "retryable"
+  ],
+  "properties": {
+    "code": {
+      "type": "string",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "anyOf": [
+        {
+          "enum": [
+            "malformedRequest",
+            "unsupportedType",
+            "unsupportedVersion",
+            "expired",
+            "proofRequired",
+            "proofInvalid",
+            "permissionDenied",
+            "wrongRecipient",
+            "identityMismatch",
+            "idConflict",
+            "taskFailed",
+            "unavailable",
+            "internalError"
+          ]
+        },
+        {
+          "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*(/[a-z][a-z0-9]*(-[a-z0-9]+)*)*:[a-z][a-zA-Z0-9_]*$"
+        }
+      ]
+    },
+    "inResponseTo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "typeUri"
+      ],
+      "description": "Identifies the Trust Task document this error reports on. RECOMMENDED on every error response, and REQUIRED in practice for any error a third party may later be asked to rely on: threadId correlates the exchange only for a party that saw the request, so without this an error retained as evidence names neither the task it terminated nor the instance.",
+      "properties": {
+        "typeUri": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "description": "The Type URI of the document being reported on, including any #request or #response fragment it carried. This is what tells a consumer which specification's semantics apply to an extended code, and which specification declared the requirement that was breached."
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The id of the specific document being reported on (SPEC §4.3). Globally unique and never reused, so it names one instance where threadId names an exchange. Omit only where echoing it would disclose more than the error already does."
+        }
+      }
+    },
+    "message": {
+      "type": "string",
+      "description": "Human-readable description of the error. Non-normative; intended for logs and operator UI."
+    },
+    "retryable": {
+      "type": "boolean",
+      "description": "true if the producer of the original document MAY retry; false if retrying with the same document is not expected to succeed."
+    },
+    "retryAfter": {
+      "type": "string",
+      "format": "date-time",
+      "description": "RFC 3339 timestamp before which the producer SHOULD NOT retry. Meaningful only when retryable is true."
+    },
+    "details": {
+      "type": "object",
+      "description": "Optional task-specific extension data. Per-spec error code declarations may pin the shape via a JSON Schema fragment."
+    }
+  }
+} as const;
+
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
   typeUri: TYPE_URI,
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/trust-task-error/0.5/payload.ts

@@ -69,14 +69,105 @@ export const TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.5" as co
 /** Stable alias for this specification's request payload shape. */
 export type Payload = TrustTaskErrorPayload;
 
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/trust-task-error/0.5",
+  "title": "Trust Task Error — payload",
+  "description": "The canonical error-response payload per SPEC.md §8.2.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "code",
+    "retryable"
+  ],
+  "properties": {
+    "code": {
+      "type": "string",
+      "description": "Short identifier for the failure category. MUST be either a framework standard code (SPEC.md §8.3) or an extended code namespaced by the originating spec's slug (SPEC.md §8.5, e.g. 'acl/grant:role_not_recognized').",
+      "anyOf": [
+        {
+          "enum": [
+            "malformedRequest",
+            "unsupportedType",
+            "unsupportedVersion",
+            "expired",
+            "proofRequired",
+            "proofInvalid",
+            "permissionDenied",
+            "wrongRecipient",
+            "identityMismatch",
+            "idConflict",
+            "cancelled",
+            "taskFailed",
+            "unavailable",
+            "internalError"
+          ]
+        },
+        {
+          "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*(/[a-z][a-z0-9]*(-[a-z0-9]+)*)*:[a-z][a-zA-Z0-9_]*$"
+        }
+      ]
+    },
+    "inResponseTo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "typeUri"
+      ],
+      "description": "Identifies the Trust Task document this error reports on. RECOMMENDED on every error response, and REQUIRED in practice for any error a third party may later be asked to rely on: threadId correlates the exchange only for a party that saw the request, so without this an error retained as evidence names neither the task it terminated nor the instance.",
+      "properties": {
+        "typeUri": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "description": "The Type URI of the document being reported on, including any #request or #response fragment it carried. This is what tells a consumer which specification's semantics apply to an extended code, and which specification declared the requirement that was breached."
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The id of the specific document being reported on (SPEC §4.3). Globally unique and never reused, so it names one instance where threadId names an exchange. Omit only where echoing it would disclose more than the error already does."
+        }
+      }
+    },
+    "message": {
+      "type": "string",
+      "description": "Human-readable description of the error. Non-normative; intended for logs and operator UI."
+    },
+    "retryable": {
+      "type": "boolean",
+      "description": "true if the producer of the original document MAY retry; false if retrying with the same document is not expected to succeed."
+    },
+    "retryAfter": {
+      "type": "string",
+      "format": "date-time",
+      "description": "RFC 3339 timestamp before which the producer SHOULD NOT retry. Meaningful only when retryable is true."
+    },
+    "details": {
+      "type": "object",
+      "description": "Optional task-specific extension data. Per-spec error code declarations may pin the shape via a JSON Schema fragment."
+    }
+  }
+} as const;
+
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
   typeUri: TYPE_URI,
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/trust-task-next-step/0.1/payload.ts

@@ -82,14 +82,116 @@ export const TYPE_URI = "https://trusttasks.org/spec/trust-task-next-step/0.1" a
 /** Stable alias for this specification's request payload shape. */
 export type Payload = TrustTaskNextStepPayload;
 
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/trust-task-next-step/0.1",
+  "title": "Trust Task Next Step — payload",
+  "description": "The recipient-suggested continuation reserved at SPEC.md §8.6: the original task was understood, but cannot complete in isolation, and this names what the recipient party expects in order to proceed.\n\nA next step is neither a success response nor a failure. The originating task is left open — a consumer that means 'no' returns a trust-task-error instead, and one that means 'done' returns the originating specification's #response variant.\n\nThis specification declares no response anchor: a producer answers a next step by issuing a document of the expected type, not by responding to this one.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "expects"
+  ],
+  "properties": {
+    "expects": {
+      "type": "array",
+      "minItems": 1,
+      "description": "The continuations the recipient will accept, in the producer's order of preference where the recipient has one. More than one entry means ALTERNATIVES — satisfying any single entry unblocks the exchange, never all of them. A recipient that needs several things done first names the one it wants next and issues a further next step afterwards; expressing a conjunction here would be a flow definition, which belongs to a ceremony rather than to a single response.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "typeUri"
+        ],
+        "properties": {
+          "typeUri": {
+            "type": "string",
+            "format": "uri",
+            "minLength": 1,
+            "description": "The Type URI of the Trust Task the recipient expects next, including any #request fragment. A suggestion only: it confers no authorization to perform that task, and the producer applies its own policy before acting (see the specification's Security & Privacy section)."
+          },
+          "reason": {
+            "type": "string",
+            "description": "Human-readable explanation of why this continuation is expected. Non-normative; intended for operator UI and logs."
+          },
+          "hint": {
+            "type": "object",
+            "description": "Optional structured data the producer MAY use when composing the expected document — a challenge to echo, an identifier to quote, a presentation definition to satisfy. Its shape is governed by the specification named in typeUri, not by this one. A producer MUST NOT treat a hint as authoritative for any value it can determine itself."
+          }
+        }
+      }
+    },
+    "continuation": {
+      "enum": [
+        "resubmit",
+        "proceed"
+      ],
+      "default": "resubmit",
+      "description": "What happens once an expected task completes. `resubmit` (the default) means the expected task is a PREREQUISITE and the producer re-issues the originating request to continue — a new document with a fresh id and the same threadId, which SPEC §8.4 distinguishes from a retry, since a retry is bit-for-bit identical and is not what happens here; this matches the established pattern of task-consent/granted, where the requester re-submits once approval lands. `proceed` means the expected task IS the continuation and the originating request is not re-issued, as in an offer answered by a request.",
+      "$comment": "Two values rather than a boolean, because 'resubmit: false' reads as a negation of something the reader has to reconstruct."
+    },
+    "inResponseTo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "typeUri"
+      ],
+      "description": "Identifies the Trust Task document this next step answers. SHOULD be populated, for the reason SPEC §8.2 gives for the identical member on an error response: threadId correlates the exchange only for a party that already saw the request, so a retained next step otherwise names neither the task it interrupted nor the instance.",
+      "properties": {
+        "typeUri": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "description": "The Type URI of the document being answered, including any fragment it carried."
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The id of the specific document being answered (SPEC §4.3). Globally unique and never reused, so it names one instance where threadId names an exchange."
+        }
+      }
+    },
+    "message": {
+      "type": "string",
+      "description": "Human-readable description of why the task cannot complete in isolation. Non-normative. Subject to the same restraint as an error message: it reaches a party that may not be entitled to learn why."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
   typeUri: TYPE_URI,
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/trust-task-ok/0.1/payload.ts

@@ -44,14 +44,67 @@ export const TYPE_URI = "https://trusttasks.org/spec/trust-task-ok/0.1" as const
 /** Stable alias for this specification's request payload shape. */
 export type Payload = TrustTaskOKPayload;
 
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/trust-task-ok/0.1",
+  "title": "Trust Task OK — payload",
+  "description": "The courtesy acknowledgement reserved at SPEC.md §8.6: a consumer confirming that it received and performed a task which defines no success-response document of its own.\n\nIt is deliberately weak. A producer MUST NOT rely on receiving one, and the absence of one carries no information — a consumer may not implement this specification, and the document may be lost. Anything a task's contract depends on belongs in that task's own #response, not here.\n\nEvery member is optional: an empty payload is the ordinary case, and means exactly 'received and performed'.\n\nThis specification declares no response anchor. An acknowledgement is not answered.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "message": {
+      "type": "string",
+      "description": "Human-readable confirmation, for operator UI and logs. Non-normative. A producer MUST NOT parse this for any value it needs, and MUST NOT condition behaviour on its presence or content."
+    },
+    "refs": {
+      "type": "array",
+      "description": "Opaque references the consumer chose to surface — a ticket number, a queue position, a processing handle, a retention deadline. Convenience only.\n\nA consumer MUST NOT convey through `refs` anything the task's own contract depends on: a value a producer needs in order to proceed is part of that task's semantics and belongs in a response the task itself defines. A producer that finds itself parsing `refs` to continue an exchange is using the wrong document, and the task it is performing should declare its own #response.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "name",
+          "value"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "description": "What this reference is, in the consumer's own vocabulary. Not drawn from any registry, and not interoperable — a producer that does not recognize a name ignores it."
+          },
+          "value": {
+            "type": "string",
+            "description": "The reference itself, opaque to this framework."
+          }
+        }
+      }
+    },
+    "ext": {
+      "type": "object",
+      "description": "Vendor-namespaced extension data per SPEC.md §4.5.1. Every immediate child key MUST be a reverse-DNS prefix the producer of this document controls."
+    }
+  }
+} as const;
+
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
   typeUri: TYPE_URI,
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/vault/delete/0.1/payload.ts

@@ -50,16 +50,151 @@ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/delete/0.1#r
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = VaultDeleteResponsePayload;
 
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vault/delete/0.1",
+  "title": "Vault Delete — payload",
+  "description": "Tombstone a vault entry. The maintainer SHOULD keep the tombstone for a configured grace period so late-syncing consumers wipe the entry from their caches; after the grace period expires the maintainer MAY garbage-collect.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "expectedVersion": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Observed version for optimistic-concurrency check. Recommended to supply."
+    },
+    "reason": {
+      "type": "string",
+      "maxLength": 256,
+      "description": "Optional human-readable reason recorded in the audit log."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    },
+    "force": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip the grace window and hard-delete immediately: the secret bytes are zeroised and the entry is UNRECOVERABLE (equivalent to vault/purge). The default, false, performs a recoverable soft delete — the entry becomes a tombstone, restorable via vault/restore until the sweeper purges it at graceUntil. A consumer MUST NOT present a forced delete to a human as though it were recoverable."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Vault Delete — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "deletedAt",
+        "graceUntil"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "deletedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "graceUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Time after which the maintainer MAY garbage-collect the tombstone. Late-syncing consumers that connect before this time MUST receive the tombstone via vault/sync and wipe their cache; consumers that connect after this time will simply see the entry as absent."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Vault Delete — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "deletedAt",
+        "graceUntil"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "deletedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "graceUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Time after which the maintainer MAY garbage-collect the tombstone. Late-syncing consumers that connect before this time MUST receive the tombstone via vault/sync and wipe their cache; consumers that connect after this time will simply see the entry as absent."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export const SPEC = {
   typeUri: TYPE_URI,
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
 /**
@@ -72,4 +207,5 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;