@openvtc/trust-tasks 0.8.2 → 0.9.0

package/dist/provision/integration/0.1/payload.d.ts

@@ -253,16 +253,1010 @@ export type Payload = ProvisionIntegrationPayload;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/provision/integration/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = ProvisionIntegrationResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/provision/integration/0.1";
+    readonly title: "Provision Integration — payload";
+    readonly description: "Relayer presents a VP-signed bootstrap request from an integration holder; the maintainer mints the integration's DIDs and admin credential from a registered DID template and ships the material back HPKE-sealed to the holder's ephemeral did:key. Two ask variants are supported: TemplateBootstrap (mint integration DID + optional admin DID) and AdminRotation (mint only the long-term admin DID).";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["request"];
+    readonly properties: {
+        readonly request: {
+            readonly $ref: "#/$defs/BootstrapRequest";
+            readonly description: "VP-framed bootstrap request signed by the holder's ephemeral did:key. The proof here is independent of, and additional to, the outer Trust Task envelope's proof — it authenticates the holder (the party the sealed bundle is encrypted for), whereas the envelope's proof authenticates the relayer (the party making the call). The two MAY be the same DID in the common case.";
+        };
+        readonly context: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.";
+        };
+        readonly assertion: {
+            readonly type: "string";
+            readonly enum: readonly ["did-signed", "pinned-only"];
+            readonly default: "did-signed";
+            readonly description: "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `did-signed` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinned-only` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests.";
+        };
+        readonly vcValiditySeconds: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly maximum: 31536000;
+            readonly description: "Caller-preferred validity window for the issued VtaAuthorizationCredential, in seconds. The maintainer's policy applies a floor and ceiling; values outside that range MAY be silently clamped. Defaults to the maintainer's policy default (typically 3600s).";
+        };
+        readonly createContext: {
+            readonly type: "boolean";
+            readonly default: false;
+            readonly description: "When `true`, the maintainer provisions the target context inline if it does not already exist. Requires super-admin role on the maintainer; context-admin callers MUST receive `provision/integration:forbidden` against a missing context. Idempotent when the context already exists.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly BootstrapRequest: {
+            readonly $anchor: "bootstrap-request";
+            readonly title: "BootstrapRequest";
+            readonly description: "W3C Verifiable Presentation 2.0 (§6.1: VPs MAY omit `verifiableCredential`). Custom members `nonce`, `validUntil`, `label`, and `ask` sit alongside the standard VP fields and are covered by the same DataIntegrityProof.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["@context", "type", "id", "holder", "nonce", "validUntil", "ask", "proof"];
+            readonly properties: {
+                readonly "@context": {
+                    readonly type: "array";
+                    readonly minItems: 2;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                    };
+                    readonly description: "JSON-LD contexts. MUST contain both `https://www.w3.org/ns/credentials/v2` and `https://openvtc.org/contexts/bootstrap-v1`. Maintainers verifying the proof MAY refuse other shapes.";
+                };
+                readonly type: {
+                    readonly type: "array";
+                    readonly minItems: 2;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: "VP types. MUST contain both `VerifiablePresentation` and `BootstrapRequest`. Additional task-specific types MAY be present.";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "URN-shaped identifier for this presentation. `urn:uuid:<v4>` is RECOMMENDED.";
+                };
+                readonly holder: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The integration's ephemeral did:key (Ed25519). Identifies the party the returned bundle is HPKE-sealed for; the VP proof verifies under this DID's verification method.";
+                };
+                readonly nonce: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z0-9_-]{22}$";
+                    readonly description: "16 random bytes encoded as base64url-no-pad (22 characters). The maintainer treats this as the sealed bundle's `bundleId` (decoded to hex, exposed in `summary.bundleIdHex`) and SHOULD enforce one-shot semantics — a second provisioning with the same nonce MUST be refused as a replay.";
+                };
+                readonly validUntil: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Freshness bound for the VP. RFC 3339 UTC. Maintainers SHOULD allow ±5 minutes of clock skew.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label carried into the maintainer's audit log.";
+                };
+                readonly ask: {
+                    readonly $ref: "#/$defs/BootstrapAsk";
+                    readonly description: "What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/DataIntegrityProof";
+                    readonly description: "Data Integrity proof signed by the holder's Ed25519 key. Cryptosuite MUST equal `eddsa-jcs-2022`. `proofPurpose` MUST equal `authentication`. `verificationMethod` MUST resolve under `holder`. Signs the JCS canonicalisation of the VP with `proof` removed.";
+                };
+            };
+        };
+        readonly BootstrapAsk: {
+            readonly $anchor: "bootstrap-ask";
+            readonly title: "BootstrapAsk";
+            readonly description: "Discriminated union of bootstrap intents. Extensible — future minor versions MAY add variants.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/TemplateBootstrapAsk";
+            }, {
+                readonly $ref: "#/$defs/AdminRotationAsk";
+            }];
+        };
+        readonly TemplateBootstrapAsk: {
+            readonly $anchor: "template-bootstrap-ask";
+            readonly title: "TemplateBootstrapAsk";
+            readonly description: "Mint an integration DID from `template`, and (when `adminTemplate` is present) atomically roll over the holder to a fresh long-term admin DID minted from `adminTemplate`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "template"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "TemplateBootstrap";
+                };
+                readonly contextHint: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Hint for the integration's target context. The wire `payload.context` is authoritative; this hint exists for documentation / cross-check only.";
+                };
+                readonly template: {
+                    readonly $ref: "#/$defs/DidTemplateRef";
+                    readonly description: "Integration template. MUST be registered at the maintainer; MUST declare a `kind` other than `\"admin\"`.";
+                };
+                readonly adminTemplate: {
+                    readonly $ref: "#/$defs/DidTemplateRef";
+                    readonly description: "Optional admin-DID template. When present, the maintainer mints a fresh long-term admin DID + keys, binds the authorization VC + ACL row to it, and rolls the holder over from the ephemeral did:key in the same transaction. When absent, the authorization VC's subject and ACL row are bound to the ephemeral `holder`, which the operator is expected to swap via `acl/swap-key/0.1` before steady-state operation. MUST declare `kind == \"admin\"` when present.";
+                };
+                readonly note: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 1024;
+                    readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                };
+            };
+        };
+        readonly AdminRotationAsk: {
+            readonly $anchor: "admin-rotation-ask";
+            readonly title: "AdminRotationAsk";
+            readonly description: "Admin-only mint. No integration DID is produced. Used by holders that bring (or will mint elsewhere) their own integration-side identity and only need an admin credential at this maintainer.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "adminTemplate"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "AdminRotation";
+                };
+                readonly contextHint: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Hint for the admin grant's target context. The wire `payload.context` is authoritative.";
+                };
+                readonly adminTemplate: {
+                    readonly $ref: "#/$defs/DidTemplateRef";
+                    readonly description: "Admin-DID template. MUST be registered at the maintainer and MUST declare `kind == \"admin\"`.";
+                };
+                readonly note: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 1024;
+                    readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                };
+            };
+        };
+        readonly DidTemplateRef: {
+            readonly $anchor: "did-template-ref";
+            readonly title: "DidTemplateRef";
+            readonly description: "Reference to a DID template already registered at the maintainer. Inline template definitions are deliberately not supported — templates must be uploaded out-of-band first (operator-authored or built-in) so the maintainer can validate `vars` against the template's declared schema.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["name"];
+            readonly properties: {
+                readonly name: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Template name as registered at the maintainer (built-in or operator-uploaded). Examples of built-ins shipped with VTA deployments: `didcomm-mediator`, `vta-admin`, `did-hosting-control`, `did-hosting-daemon`, `did-hosting-server`.";
+                };
+                readonly vars: {
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly default: {};
+                    readonly description: "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.";
+                };
+            };
+        };
+        readonly DataIntegrityProof: {
+            readonly $anchor: "data-integrity-proof";
+            readonly title: "DataIntegrityProof";
+            readonly description: "W3C Data Integrity proof. Spec body pins cryptosuite and proofPurpose; this schema permits the standard property bag so future cryptosuites can ride the same shape.";
+            readonly type: "object";
+            readonly additionalProperties: true;
+            readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "This version pins `eddsa-jcs-2022`. Maintainers MUST reject other values until a future minor extends the allowlist.";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "DID URL with fragment. The DID portion (left of `#`) MUST equal `holder`.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly proofPurpose: {
+                    readonly const: "authentication";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Multibase-encoded Ed25519 signature.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Provision Integration — response payload";
+            readonly description: "Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["bundle", "digest", "summary"];
+            readonly properties: {
+                readonly bundle: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.";
+                };
+                readonly digest: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9a-f]{64}$";
+                    readonly description: "SHA-256 of the armored ciphertext, lowercase hex. Used by holders that pin the bundle out-of-band.";
+                };
+                readonly summary: {
+                    readonly $ref: "#/$defs/ProvisionSummary";
+                    readonly description: "Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly ProvisionSummary: {
+            readonly $anchor: "provision-summary";
+            readonly title: "ProvisionSummary";
+            readonly description: "Audit-grade metadata about the provisioning outcome. Mirrors the existing `vta_sdk::provision_integration::http::ProvisionSummary` Rust type but uses camelCase wire fields per Trust Task convention.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["clientDid", "bundleIdHex", "secretCount", "outputCount"];
+            readonly properties: {
+                readonly clientDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Ephemeral did:key the holder signed the VP with and opens the sealed bundle with. Echo of `request.holder`.";
+                };
+                readonly adminDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Long-term admin DID after this provisioning. Equals `clientDid` when no admin rollover occurred (TemplateBootstrap with no `adminTemplate`); equals the freshly-minted admin DID when `adminTemplate` was used or when the ask was `AdminRotation`. Maintainers that pre-date admin rollover MAY omit this; consumers SHOULD default it to `clientDid` for backward compatibility.";
+                };
+                readonly adminRolledOver: {
+                    readonly type: "boolean";
+                    readonly default: false;
+                    readonly description: "True when the maintainer minted a fresh long-term admin DID and bound the authorization VC + ACL row to it (i.e. `adminDid != clientDid`).";
+                };
+                readonly integrationDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "DID rendered from the integration template. Absent for `AdminRotation` (no integration was rendered).";
+                };
+                readonly templateName: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Name of the integration template that was rendered. Absent for `AdminRotation`.";
+                };
+                readonly templateKind: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "`kind` of the integration template (e.g. `mediator`, `did-hosting-control`, `app`). Absent for `AdminRotation`.";
+                };
+                readonly adminTemplateName: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Name of the admin template that was rendered. Present when an admin DID was minted (either via `TemplateBootstrap.adminTemplate` or `AdminRotation`).";
+                };
+                readonly bundleIdHex: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9a-f]{32}$";
+                    readonly description: "VP nonce as lowercase hex (32 characters = 16 bytes). MUST equal the `Bundle-Id` armor header of `bundle`. Cross-check anchor: a holder that decodes the VP nonce can verify the bundle they opened matches the one the maintainer minted for them.";
+                };
+                readonly secretCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Number of DIDs the sealed bundle carries private key material for. `TemplateBootstrap` with no adminTemplate typically yields 1 (the integration DID's keys). `AdminRotation` yields 0 (the `admin` field is top-level, not under `secrets`).";
+                };
+                readonly outputCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Number of template-declared side outputs the sealed bundle carries (`did.jsonl` logs, DIDComm service advertisements, etc.). Always 0 for `AdminRotation`.";
+                };
+                readonly webvhServerId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Identifier of the registered webvh hosting server the maintainer published the integration's `did.jsonl` to, if any. Absent when the integration is self-hosted or when the template did not declare a webvh server var.";
+                };
+                readonly contextCreated: {
+                    readonly type: "boolean";
+                    readonly default: false;
+                    readonly description: "True when `payload.createContext` was honoured and the maintainer provisioned the target context inline. False when the context already existed (or when `createContext` was omitted / false).";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly BootstrapRequest: {
+            readonly $anchor: "bootstrap-request";
+            readonly title: "BootstrapRequest";
+            readonly description: "W3C Verifiable Presentation 2.0 (§6.1: VPs MAY omit `verifiableCredential`). Custom members `nonce`, `validUntil`, `label`, and `ask` sit alongside the standard VP fields and are covered by the same DataIntegrityProof.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["@context", "type", "id", "holder", "nonce", "validUntil", "ask", "proof"];
+            readonly properties: {
+                readonly "@context": {
+                    readonly type: "array";
+                    readonly minItems: 2;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                    };
+                    readonly description: "JSON-LD contexts. MUST contain both `https://www.w3.org/ns/credentials/v2` and `https://openvtc.org/contexts/bootstrap-v1`. Maintainers verifying the proof MAY refuse other shapes.";
+                };
+                readonly type: {
+                    readonly type: "array";
+                    readonly minItems: 2;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: "VP types. MUST contain both `VerifiablePresentation` and `BootstrapRequest`. Additional task-specific types MAY be present.";
+                };
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "URN-shaped identifier for this presentation. `urn:uuid:<v4>` is RECOMMENDED.";
+                };
+                readonly holder: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The integration's ephemeral did:key (Ed25519). Identifies the party the returned bundle is HPKE-sealed for; the VP proof verifies under this DID's verification method.";
+                };
+                readonly nonce: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z0-9_-]{22}$";
+                    readonly description: "16 random bytes encoded as base64url-no-pad (22 characters). The maintainer treats this as the sealed bundle's `bundleId` (decoded to hex, exposed in `summary.bundleIdHex`) and SHOULD enforce one-shot semantics — a second provisioning with the same nonce MUST be refused as a replay.";
+                };
+                readonly validUntil: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Freshness bound for the VP. RFC 3339 UTC. Maintainers SHOULD allow ±5 minutes of clock skew.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label carried into the maintainer's audit log.";
+                };
+                readonly ask: {
+                    readonly $ref: "#/$defs/BootstrapAsk";
+                    readonly description: "What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/DataIntegrityProof";
+                    readonly description: "Data Integrity proof signed by the holder's Ed25519 key. Cryptosuite MUST equal `eddsa-jcs-2022`. `proofPurpose` MUST equal `authentication`. `verificationMethod` MUST resolve under `holder`. Signs the JCS canonicalisation of the VP with `proof` removed.";
+                };
+            };
+        };
+        readonly BootstrapAsk: {
+            readonly $anchor: "bootstrap-ask";
+            readonly title: "BootstrapAsk";
+            readonly description: "Discriminated union of bootstrap intents. Extensible — future minor versions MAY add variants.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/TemplateBootstrapAsk";
+            }, {
+                readonly $ref: "#/$defs/AdminRotationAsk";
+            }];
+        };
+        readonly TemplateBootstrapAsk: {
+            readonly $anchor: "template-bootstrap-ask";
+            readonly title: "TemplateBootstrapAsk";
+            readonly description: "Mint an integration DID from `template`, and (when `adminTemplate` is present) atomically roll over the holder to a fresh long-term admin DID minted from `adminTemplate`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "template"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "TemplateBootstrap";
+                };
+                readonly contextHint: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Hint for the integration's target context. The wire `payload.context` is authoritative; this hint exists for documentation / cross-check only.";
+                };
+                readonly template: {
+                    readonly $ref: "#/$defs/DidTemplateRef";
+                    readonly description: "Integration template. MUST be registered at the maintainer; MUST declare a `kind` other than `\"admin\"`.";
+                };
+                readonly adminTemplate: {
+                    readonly $ref: "#/$defs/DidTemplateRef";
+                    readonly description: "Optional admin-DID template. When present, the maintainer mints a fresh long-term admin DID + keys, binds the authorization VC + ACL row to it, and rolls the holder over from the ephemeral did:key in the same transaction. When absent, the authorization VC's subject and ACL row are bound to the ephemeral `holder`, which the operator is expected to swap via `acl/swap-key/0.1` before steady-state operation. MUST declare `kind == \"admin\"` when present.";
+                };
+                readonly note: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 1024;
+                    readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                };
+            };
+        };
+        readonly AdminRotationAsk: {
+            readonly $anchor: "admin-rotation-ask";
+            readonly title: "AdminRotationAsk";
+            readonly description: "Admin-only mint. No integration DID is produced. Used by holders that bring (or will mint elsewhere) their own integration-side identity and only need an admin credential at this maintainer.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "adminTemplate"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "AdminRotation";
+                };
+                readonly contextHint: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Hint for the admin grant's target context. The wire `payload.context` is authoritative.";
+                };
+                readonly adminTemplate: {
+                    readonly $ref: "#/$defs/DidTemplateRef";
+                    readonly description: "Admin-DID template. MUST be registered at the maintainer and MUST declare `kind == \"admin\"`.";
+                };
+                readonly note: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 1024;
+                    readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                };
+            };
+        };
+        readonly DidTemplateRef: {
+            readonly $anchor: "did-template-ref";
+            readonly title: "DidTemplateRef";
+            readonly description: "Reference to a DID template already registered at the maintainer. Inline template definitions are deliberately not supported — templates must be uploaded out-of-band first (operator-authored or built-in) so the maintainer can validate `vars` against the template's declared schema.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["name"];
+            readonly properties: {
+                readonly name: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Template name as registered at the maintainer (built-in or operator-uploaded). Examples of built-ins shipped with VTA deployments: `didcomm-mediator`, `vta-admin`, `did-hosting-control`, `did-hosting-daemon`, `did-hosting-server`.";
+                };
+                readonly vars: {
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly default: {};
+                    readonly description: "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.";
+                };
+            };
+        };
+        readonly DataIntegrityProof: {
+            readonly $anchor: "data-integrity-proof";
+            readonly title: "DataIntegrityProof";
+            readonly description: "W3C Data Integrity proof. Spec body pins cryptosuite and proofPurpose; this schema permits the standard property bag so future cryptosuites can ride the same shape.";
+            readonly type: "object";
+            readonly additionalProperties: true;
+            readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "This version pins `eddsa-jcs-2022`. Maintainers MUST reject other values until a future minor extends the allowlist.";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "DID URL with fragment. The DID portion (left of `#`) MUST equal `holder`.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly proofPurpose: {
+                    readonly const: "authentication";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Multibase-encoded Ed25519 signature.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Provision Integration — response payload";
+            readonly description: "Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["bundle", "digest", "summary"];
+            readonly properties: {
+                readonly bundle: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.";
+                };
+                readonly digest: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9a-f]{64}$";
+                    readonly description: "SHA-256 of the armored ciphertext, lowercase hex. Used by holders that pin the bundle out-of-band.";
+                };
+                readonly summary: {
+                    readonly $ref: "#/$defs/ProvisionSummary";
+                    readonly description: "Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly ProvisionSummary: {
+            readonly $anchor: "provision-summary";
+            readonly title: "ProvisionSummary";
+            readonly description: "Audit-grade metadata about the provisioning outcome. Mirrors the existing `vta_sdk::provision_integration::http::ProvisionSummary` Rust type but uses camelCase wire fields per Trust Task convention.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["clientDid", "bundleIdHex", "secretCount", "outputCount"];
+            readonly properties: {
+                readonly clientDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Ephemeral did:key the holder signed the VP with and opens the sealed bundle with. Echo of `request.holder`.";
+                };
+                readonly adminDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Long-term admin DID after this provisioning. Equals `clientDid` when no admin rollover occurred (TemplateBootstrap with no `adminTemplate`); equals the freshly-minted admin DID when `adminTemplate` was used or when the ask was `AdminRotation`. Maintainers that pre-date admin rollover MAY omit this; consumers SHOULD default it to `clientDid` for backward compatibility.";
+                };
+                readonly adminRolledOver: {
+                    readonly type: "boolean";
+                    readonly default: false;
+                    readonly description: "True when the maintainer minted a fresh long-term admin DID and bound the authorization VC + ACL row to it (i.e. `adminDid != clientDid`).";
+                };
+                readonly integrationDid: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "DID rendered from the integration template. Absent for `AdminRotation` (no integration was rendered).";
+                };
+                readonly templateName: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Name of the integration template that was rendered. Absent for `AdminRotation`.";
+                };
+                readonly templateKind: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "`kind` of the integration template (e.g. `mediator`, `did-hosting-control`, `app`). Absent for `AdminRotation`.";
+                };
+                readonly adminTemplateName: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Name of the admin template that was rendered. Present when an admin DID was minted (either via `TemplateBootstrap.adminTemplate` or `AdminRotation`).";
+                };
+                readonly bundleIdHex: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9a-f]{32}$";
+                    readonly description: "VP nonce as lowercase hex (32 characters = 16 bytes). MUST equal the `Bundle-Id` armor header of `bundle`. Cross-check anchor: a holder that decodes the VP nonce can verify the bundle they opened matches the one the maintainer minted for them.";
+                };
+                readonly secretCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Number of DIDs the sealed bundle carries private key material for. `TemplateBootstrap` with no adminTemplate typically yields 1 (the integration DID's keys). `AdminRotation` yields 0 (the `admin` field is top-level, not under `secrets`).";
+                };
+                readonly outputCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Number of template-declared side outputs the sealed bundle carries (`did.jsonl` logs, DIDComm service advertisements, etc.). Always 0 for `AdminRotation`.";
+                };
+                readonly webvhServerId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Identifier of the registered webvh hosting server the maintainer published the integration's `did.jsonl` to, if any. Absent when the integration is self-hosted or when the template did not declare a webvh server var.";
+                };
+                readonly contextCreated: {
+                    readonly type: "boolean";
+                    readonly default: false;
+                    readonly description: "True when `payload.createContext` was honoured and the maintainer provisioned the target context inline. False when the context already existed (or when `createContext` was omitted / false).";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/provision/integration/0.1";
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/provision/integration/0.1";
+        readonly title: "Provision Integration — payload";
+        readonly description: "Relayer presents a VP-signed bootstrap request from an integration holder; the maintainer mints the integration's DIDs and admin credential from a registered DID template and ships the material back HPKE-sealed to the holder's ephemeral did:key. Two ask variants are supported: TemplateBootstrap (mint integration DID + optional admin DID) and AdminRotation (mint only the long-term admin DID).";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["request"];
+        readonly properties: {
+            readonly request: {
+                readonly $ref: "#/$defs/BootstrapRequest";
+                readonly description: "VP-framed bootstrap request signed by the holder's ephemeral did:key. The proof here is independent of, and additional to, the outer Trust Task envelope's proof — it authenticates the holder (the party the sealed bundle is encrypted for), whereas the envelope's proof authenticates the relayer (the party making the call). The two MAY be the same DID in the common case.";
+            };
+            readonly context: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The maintainer's context identifier the integration is to be provisioned into. When present, authoritative — overrides any `contextHint` carried inside `request.ask`. When ABSENT, the maintainer infers the target context using these rules in order: (1) if the relayer's grant scopes to exactly one context, use that context; (2) if the relayer is a super-admin (Admin role with unrestricted scope) and the maintainer has exactly one context registered, use that context; (3) otherwise reject the request with `provision/integration:context_required`. Wallet-class consumers (browser plugins, mobile companions) that don't know the maintainer's context layout SHOULD omit this field; integration-class consumers (mediator, did-hosting) targeting a specific operational context SHOULD send it explicitly.";
+            };
+            readonly assertion: {
+                readonly type: "string";
+                readonly enum: readonly ["did-signed", "pinned-only"];
+                readonly default: "did-signed";
+                readonly description: "Producer-assertion mode the maintainer should apply to the returned sealed bundle. `did-signed` (default) — Ed25519 signature over the bundle's domain-bound digest, verified by the holder against the maintainer's published key. `pinned-only` — holder pins the bundle's SHA-256 digest as the sole integrity anchor; for dev/test only. Maintainers MAY support additional modes (e.g. `attested` for TEE deployments) and respond with `provision/integration:assertion_unsupported` to unsupported requests.";
+            };
+            readonly vcValiditySeconds: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly maximum: 31536000;
+                readonly description: "Caller-preferred validity window for the issued VtaAuthorizationCredential, in seconds. The maintainer's policy applies a floor and ceiling; values outside that range MAY be silently clamped. Defaults to the maintainer's policy default (typically 3600s).";
+            };
+            readonly createContext: {
+                readonly type: "boolean";
+                readonly default: false;
+                readonly description: "When `true`, the maintainer provisions the target context inline if it does not already exist. Requires super-admin role on the maintainer; context-admin callers MUST receive `provision/integration:forbidden` against a missing context. Idempotent when the context already exists.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly BootstrapRequest: {
+                readonly $anchor: "bootstrap-request";
+                readonly title: "BootstrapRequest";
+                readonly description: "W3C Verifiable Presentation 2.0 (§6.1: VPs MAY omit `verifiableCredential`). Custom members `nonce`, `validUntil`, `label`, and `ask` sit alongside the standard VP fields and are covered by the same DataIntegrityProof.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["@context", "type", "id", "holder", "nonce", "validUntil", "ask", "proof"];
+                readonly properties: {
+                    readonly "@context": {
+                        readonly type: "array";
+                        readonly minItems: 2;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                        };
+                        readonly description: "JSON-LD contexts. MUST contain both `https://www.w3.org/ns/credentials/v2` and `https://openvtc.org/contexts/bootstrap-v1`. Maintainers verifying the proof MAY refuse other shapes.";
+                    };
+                    readonly type: {
+                        readonly type: "array";
+                        readonly minItems: 2;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly description: "VP types. MUST contain both `VerifiablePresentation` and `BootstrapRequest`. Additional task-specific types MAY be present.";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "URN-shaped identifier for this presentation. `urn:uuid:<v4>` is RECOMMENDED.";
+                    };
+                    readonly holder: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The integration's ephemeral did:key (Ed25519). Identifies the party the returned bundle is HPKE-sealed for; the VP proof verifies under this DID's verification method.";
+                    };
+                    readonly nonce: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z0-9_-]{22}$";
+                        readonly description: "16 random bytes encoded as base64url-no-pad (22 characters). The maintainer treats this as the sealed bundle's `bundleId` (decoded to hex, exposed in `summary.bundleIdHex`) and SHOULD enforce one-shot semantics — a second provisioning with the same nonce MUST be refused as a replay.";
+                    };
+                    readonly validUntil: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Freshness bound for the VP. RFC 3339 UTC. Maintainers SHOULD allow ±5 minutes of clock skew.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label carried into the maintainer's audit log.";
+                    };
+                    readonly ask: {
+                        readonly $ref: "#/$defs/BootstrapAsk";
+                        readonly description: "What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/DataIntegrityProof";
+                        readonly description: "Data Integrity proof signed by the holder's Ed25519 key. Cryptosuite MUST equal `eddsa-jcs-2022`. `proofPurpose` MUST equal `authentication`. `verificationMethod` MUST resolve under `holder`. Signs the JCS canonicalisation of the VP with `proof` removed.";
+                    };
+                };
+            };
+            readonly BootstrapAsk: {
+                readonly $anchor: "bootstrap-ask";
+                readonly title: "BootstrapAsk";
+                readonly description: "Discriminated union of bootstrap intents. Extensible — future minor versions MAY add variants.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/TemplateBootstrapAsk";
+                }, {
+                    readonly $ref: "#/$defs/AdminRotationAsk";
+                }];
+            };
+            readonly TemplateBootstrapAsk: {
+                readonly $anchor: "template-bootstrap-ask";
+                readonly title: "TemplateBootstrapAsk";
+                readonly description: "Mint an integration DID from `template`, and (when `adminTemplate` is present) atomically roll over the holder to a fresh long-term admin DID minted from `adminTemplate`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "template"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "TemplateBootstrap";
+                    };
+                    readonly contextHint: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Hint for the integration's target context. The wire `payload.context` is authoritative; this hint exists for documentation / cross-check only.";
+                    };
+                    readonly template: {
+                        readonly $ref: "#/$defs/DidTemplateRef";
+                        readonly description: "Integration template. MUST be registered at the maintainer; MUST declare a `kind` other than `\"admin\"`.";
+                    };
+                    readonly adminTemplate: {
+                        readonly $ref: "#/$defs/DidTemplateRef";
+                        readonly description: "Optional admin-DID template. When present, the maintainer mints a fresh long-term admin DID + keys, binds the authorization VC + ACL row to it, and rolls the holder over from the ephemeral did:key in the same transaction. When absent, the authorization VC's subject and ACL row are bound to the ephemeral `holder`, which the operator is expected to swap via `acl/swap-key/0.1` before steady-state operation. MUST declare `kind == \"admin\"` when present.";
+                    };
+                    readonly note: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 1024;
+                        readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                    };
+                };
+            };
+            readonly AdminRotationAsk: {
+                readonly $anchor: "admin-rotation-ask";
+                readonly title: "AdminRotationAsk";
+                readonly description: "Admin-only mint. No integration DID is produced. Used by holders that bring (or will mint elsewhere) their own integration-side identity and only need an admin credential at this maintainer.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "adminTemplate"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "AdminRotation";
+                    };
+                    readonly contextHint: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Hint for the admin grant's target context. The wire `payload.context` is authoritative.";
+                    };
+                    readonly adminTemplate: {
+                        readonly $ref: "#/$defs/DidTemplateRef";
+                        readonly description: "Admin-DID template. MUST be registered at the maintainer and MUST declare `kind == \"admin\"`.";
+                    };
+                    readonly note: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 1024;
+                        readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                    };
+                };
+            };
+            readonly DidTemplateRef: {
+                readonly $anchor: "did-template-ref";
+                readonly title: "DidTemplateRef";
+                readonly description: "Reference to a DID template already registered at the maintainer. Inline template definitions are deliberately not supported — templates must be uploaded out-of-band first (operator-authored or built-in) so the maintainer can validate `vars` against the template's declared schema.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["name"];
+                readonly properties: {
+                    readonly name: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Template name as registered at the maintainer (built-in or operator-uploaded). Examples of built-ins shipped with VTA deployments: `didcomm-mediator`, `vta-admin`, `did-hosting-control`, `did-hosting-daemon`, `did-hosting-server`.";
+                    };
+                    readonly vars: {
+                        readonly type: "object";
+                        readonly additionalProperties: true;
+                        readonly default: {};
+                        readonly description: "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.";
+                    };
+                };
+            };
+            readonly DataIntegrityProof: {
+                readonly $anchor: "data-integrity-proof";
+                readonly title: "DataIntegrityProof";
+                readonly description: "W3C Data Integrity proof. Spec body pins cryptosuite and proofPurpose; this schema permits the standard property bag so future cryptosuites can ride the same shape.";
+                readonly type: "object";
+                readonly additionalProperties: true;
+                readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "This version pins `eddsa-jcs-2022`. Maintainers MUST reject other values until a future minor extends the allowlist.";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID URL with fragment. The DID portion (left of `#`) MUST equal `holder`.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly proofPurpose: {
+                        readonly const: "authentication";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Multibase-encoded Ed25519 signature.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Provision Integration — response payload";
+                readonly description: "Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["bundle", "digest", "summary"];
+                readonly properties: {
+                    readonly bundle: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.";
+                    };
+                    readonly digest: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-f]{64}$";
+                        readonly description: "SHA-256 of the armored ciphertext, lowercase hex. Used by holders that pin the bundle out-of-band.";
+                    };
+                    readonly summary: {
+                        readonly $ref: "#/$defs/ProvisionSummary";
+                        readonly description: "Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly ProvisionSummary: {
+                readonly $anchor: "provision-summary";
+                readonly title: "ProvisionSummary";
+                readonly description: "Audit-grade metadata about the provisioning outcome. Mirrors the existing `vta_sdk::provision_integration::http::ProvisionSummary` Rust type but uses camelCase wire fields per Trust Task convention.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["clientDid", "bundleIdHex", "secretCount", "outputCount"];
+                readonly properties: {
+                    readonly clientDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Ephemeral did:key the holder signed the VP with and opens the sealed bundle with. Echo of `request.holder`.";
+                    };
+                    readonly adminDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Long-term admin DID after this provisioning. Equals `clientDid` when no admin rollover occurred (TemplateBootstrap with no `adminTemplate`); equals the freshly-minted admin DID when `adminTemplate` was used or when the ask was `AdminRotation`. Maintainers that pre-date admin rollover MAY omit this; consumers SHOULD default it to `clientDid` for backward compatibility.";
+                    };
+                    readonly adminRolledOver: {
+                        readonly type: "boolean";
+                        readonly default: false;
+                        readonly description: "True when the maintainer minted a fresh long-term admin DID and bound the authorization VC + ACL row to it (i.e. `adminDid != clientDid`).";
+                    };
+                    readonly integrationDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID rendered from the integration template. Absent for `AdminRotation` (no integration was rendered).";
+                    };
+                    readonly templateName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Name of the integration template that was rendered. Absent for `AdminRotation`.";
+                    };
+                    readonly templateKind: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "`kind` of the integration template (e.g. `mediator`, `did-hosting-control`, `app`). Absent for `AdminRotation`.";
+                    };
+                    readonly adminTemplateName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Name of the admin template that was rendered. Present when an admin DID was minted (either via `TemplateBootstrap.adminTemplate` or `AdminRotation`).";
+                    };
+                    readonly bundleIdHex: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-f]{32}$";
+                        readonly description: "VP nonce as lowercase hex (32 characters = 16 bytes). MUST equal the `Bundle-Id` armor header of `bundle`. Cross-check anchor: a holder that decodes the VP nonce can verify the bundle they opened matches the one the maintainer minted for them.";
+                    };
+                    readonly secretCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Number of DIDs the sealed bundle carries private key material for. `TemplateBootstrap` with no adminTemplate typically yields 1 (the integration DID's keys). `AdminRotation` yields 0 (the `admin` field is top-level, not under `secrets`).";
+                    };
+                    readonly outputCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Number of template-declared side outputs the sealed bundle carries (`did.jsonl` logs, DIDComm service advertisements, etc.). Always 0 for `AdminRotation`.";
+                    };
+                    readonly webvhServerId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Identifier of the registered webvh hosting server the maintainer published the integration's `did.jsonl` to, if any. Absent when the integration is self-hosted or when the template did not declare a webvh server var.";
+                    };
+                    readonly contextCreated: {
+                        readonly type: "boolean";
+                        readonly default: false;
+                        readonly description: "True when `payload.createContext` was honoured and the maintainer provisioned the target context inline. False when the context already existed (or when `createContext` was omitted / false).";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -274,5 +1268,308 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly BootstrapRequest: {
+                readonly $anchor: "bootstrap-request";
+                readonly title: "BootstrapRequest";
+                readonly description: "W3C Verifiable Presentation 2.0 (§6.1: VPs MAY omit `verifiableCredential`). Custom members `nonce`, `validUntil`, `label`, and `ask` sit alongside the standard VP fields and are covered by the same DataIntegrityProof.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["@context", "type", "id", "holder", "nonce", "validUntil", "ask", "proof"];
+                readonly properties: {
+                    readonly "@context": {
+                        readonly type: "array";
+                        readonly minItems: 2;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                        };
+                        readonly description: "JSON-LD contexts. MUST contain both `https://www.w3.org/ns/credentials/v2` and `https://openvtc.org/contexts/bootstrap-v1`. Maintainers verifying the proof MAY refuse other shapes.";
+                    };
+                    readonly type: {
+                        readonly type: "array";
+                        readonly minItems: 2;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly description: "VP types. MUST contain both `VerifiablePresentation` and `BootstrapRequest`. Additional task-specific types MAY be present.";
+                    };
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "URN-shaped identifier for this presentation. `urn:uuid:<v4>` is RECOMMENDED.";
+                    };
+                    readonly holder: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^did:key:z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The integration's ephemeral did:key (Ed25519). Identifies the party the returned bundle is HPKE-sealed for; the VP proof verifies under this DID's verification method.";
+                    };
+                    readonly nonce: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z0-9_-]{22}$";
+                        readonly description: "16 random bytes encoded as base64url-no-pad (22 characters). The maintainer treats this as the sealed bundle's `bundleId` (decoded to hex, exposed in `summary.bundleIdHex`) and SHOULD enforce one-shot semantics — a second provisioning with the same nonce MUST be refused as a replay.";
+                    };
+                    readonly validUntil: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Freshness bound for the VP. RFC 3339 UTC. Maintainers SHOULD allow ±5 minutes of clock skew.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label carried into the maintainer's audit log.";
+                    };
+                    readonly ask: {
+                        readonly $ref: "#/$defs/BootstrapAsk";
+                        readonly description: "What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/DataIntegrityProof";
+                        readonly description: "Data Integrity proof signed by the holder's Ed25519 key. Cryptosuite MUST equal `eddsa-jcs-2022`. `proofPurpose` MUST equal `authentication`. `verificationMethod` MUST resolve under `holder`. Signs the JCS canonicalisation of the VP with `proof` removed.";
+                    };
+                };
+            };
+            readonly BootstrapAsk: {
+                readonly $anchor: "bootstrap-ask";
+                readonly title: "BootstrapAsk";
+                readonly description: "Discriminated union of bootstrap intents. Extensible — future minor versions MAY add variants.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/TemplateBootstrapAsk";
+                }, {
+                    readonly $ref: "#/$defs/AdminRotationAsk";
+                }];
+            };
+            readonly TemplateBootstrapAsk: {
+                readonly $anchor: "template-bootstrap-ask";
+                readonly title: "TemplateBootstrapAsk";
+                readonly description: "Mint an integration DID from `template`, and (when `adminTemplate` is present) atomically roll over the holder to a fresh long-term admin DID minted from `adminTemplate`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "template"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "TemplateBootstrap";
+                    };
+                    readonly contextHint: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Hint for the integration's target context. The wire `payload.context` is authoritative; this hint exists for documentation / cross-check only.";
+                    };
+                    readonly template: {
+                        readonly $ref: "#/$defs/DidTemplateRef";
+                        readonly description: "Integration template. MUST be registered at the maintainer; MUST declare a `kind` other than `\"admin\"`.";
+                    };
+                    readonly adminTemplate: {
+                        readonly $ref: "#/$defs/DidTemplateRef";
+                        readonly description: "Optional admin-DID template. When present, the maintainer mints a fresh long-term admin DID + keys, binds the authorization VC + ACL row to it, and rolls the holder over from the ephemeral did:key in the same transaction. When absent, the authorization VC's subject and ACL row are bound to the ephemeral `holder`, which the operator is expected to swap via `acl/swap-key/0.1` before steady-state operation. MUST declare `kind == \"admin\"` when present.";
+                    };
+                    readonly note: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 1024;
+                        readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                    };
+                };
+            };
+            readonly AdminRotationAsk: {
+                readonly $anchor: "admin-rotation-ask";
+                readonly title: "AdminRotationAsk";
+                readonly description: "Admin-only mint. No integration DID is produced. Used by holders that bring (or will mint elsewhere) their own integration-side identity and only need an admin credential at this maintainer.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "adminTemplate"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "AdminRotation";
+                    };
+                    readonly contextHint: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Hint for the admin grant's target context. The wire `payload.context` is authoritative.";
+                    };
+                    readonly adminTemplate: {
+                        readonly $ref: "#/$defs/DidTemplateRef";
+                        readonly description: "Admin-DID template. MUST be registered at the maintainer and MUST declare `kind == \"admin\"`.";
+                    };
+                    readonly note: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 1024;
+                        readonly description: "Free-form operator note carried into the maintainer's audit log.";
+                    };
+                };
+            };
+            readonly DidTemplateRef: {
+                readonly $anchor: "did-template-ref";
+                readonly title: "DidTemplateRef";
+                readonly description: "Reference to a DID template already registered at the maintainer. Inline template definitions are deliberately not supported — templates must be uploaded out-of-band first (operator-authored or built-in) so the maintainer can validate `vars` against the template's declared schema.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["name"];
+                readonly properties: {
+                    readonly name: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Template name as registered at the maintainer (built-in or operator-uploaded). Examples of built-ins shipped with VTA deployments: `didcomm-mediator`, `vta-admin`, `did-hosting-control`, `did-hosting-daemon`, `did-hosting-server`.";
+                    };
+                    readonly vars: {
+                        readonly type: "object";
+                        readonly additionalProperties: true;
+                        readonly default: {};
+                        readonly description: "Variable bindings the maintainer feeds to the template renderer. MUST satisfy the template's `requiredVars`; values for `optionalVars` MAY be supplied. Unknown vars are rejected with `provision/integration:template_vars_invalid`.";
+                    };
+                };
+            };
+            readonly DataIntegrityProof: {
+                readonly $anchor: "data-integrity-proof";
+                readonly title: "DataIntegrityProof";
+                readonly description: "W3C Data Integrity proof. Spec body pins cryptosuite and proofPurpose; this schema permits the standard property bag so future cryptosuites can ride the same shape.";
+                readonly type: "object";
+                readonly additionalProperties: true;
+                readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "This version pins `eddsa-jcs-2022`. Maintainers MUST reject other values until a future minor extends the allowlist.";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID URL with fragment. The DID portion (left of `#`) MUST equal `holder`.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly proofPurpose: {
+                        readonly const: "authentication";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Multibase-encoded Ed25519 signature.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Provision Integration — response payload";
+                readonly description: "Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["bundle", "digest", "summary"];
+                readonly properties: {
+                    readonly bundle: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.";
+                    };
+                    readonly digest: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-f]{64}$";
+                        readonly description: "SHA-256 of the armored ciphertext, lowercase hex. Used by holders that pin the bundle out-of-band.";
+                    };
+                    readonly summary: {
+                        readonly $ref: "#/$defs/ProvisionSummary";
+                        readonly description: "Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly ProvisionSummary: {
+                readonly $anchor: "provision-summary";
+                readonly title: "ProvisionSummary";
+                readonly description: "Audit-grade metadata about the provisioning outcome. Mirrors the existing `vta_sdk::provision_integration::http::ProvisionSummary` Rust type but uses camelCase wire fields per Trust Task convention.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["clientDid", "bundleIdHex", "secretCount", "outputCount"];
+                readonly properties: {
+                    readonly clientDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Ephemeral did:key the holder signed the VP with and opens the sealed bundle with. Echo of `request.holder`.";
+                    };
+                    readonly adminDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Long-term admin DID after this provisioning. Equals `clientDid` when no admin rollover occurred (TemplateBootstrap with no `adminTemplate`); equals the freshly-minted admin DID when `adminTemplate` was used or when the ask was `AdminRotation`. Maintainers that pre-date admin rollover MAY omit this; consumers SHOULD default it to `clientDid` for backward compatibility.";
+                    };
+                    readonly adminRolledOver: {
+                        readonly type: "boolean";
+                        readonly default: false;
+                        readonly description: "True when the maintainer minted a fresh long-term admin DID and bound the authorization VC + ACL row to it (i.e. `adminDid != clientDid`).";
+                    };
+                    readonly integrationDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "DID rendered from the integration template. Absent for `AdminRotation` (no integration was rendered).";
+                    };
+                    readonly templateName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Name of the integration template that was rendered. Absent for `AdminRotation`.";
+                    };
+                    readonly templateKind: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "`kind` of the integration template (e.g. `mediator`, `did-hosting-control`, `app`). Absent for `AdminRotation`.";
+                    };
+                    readonly adminTemplateName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Name of the admin template that was rendered. Present when an admin DID was minted (either via `TemplateBootstrap.adminTemplate` or `AdminRotation`).";
+                    };
+                    readonly bundleIdHex: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-f]{32}$";
+                        readonly description: "VP nonce as lowercase hex (32 characters = 16 bytes). MUST equal the `Bundle-Id` armor header of `bundle`. Cross-check anchor: a holder that decodes the VP nonce can verify the bundle they opened matches the one the maintainer minted for them.";
+                    };
+                    readonly secretCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Number of DIDs the sealed bundle carries private key material for. `TemplateBootstrap` with no adminTemplate typically yields 1 (the integration DID's keys). `AdminRotation` yields 0 (the `admin` field is top-level, not under `secrets`).";
+                    };
+                    readonly outputCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Number of template-declared side outputs the sealed bundle carries (`did.jsonl` logs, DIDComm service advertisements, etc.). Always 0 for `AdminRotation`.";
+                    };
+                    readonly webvhServerId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Identifier of the registered webvh hosting server the maintainer published the integration's `did.jsonl` to, if any. Absent when the integration is self-hosted or when the template did not declare a webvh server var.";
+                    };
+                    readonly contextCreated: {
+                        readonly type: "boolean";
+                        readonly default: false;
+                        readonly description: "True when `payload.createContext` was honoured and the maintainer provisioned the target context inline. False when the context already existed (or when `createContext` was omitted / false).";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map