@openvtc/trust-tasks 0.12.17 → 0.13.0

package/dist/_runtime/consume.js

@@ -1,12 +1,20 @@
 /**
- * Inbound-document orchestration for SPEC.md §7.2 item 2 and items 4–8.
+ * Inbound-document orchestration for SPEC.md §7.2 item 2, items 4–8, and the
+ * two stateful checks — the freshness bound of item 4 and the
+ * duplicate-execution record of item 11.
  *
  * Hand-written. Mirrors `consume.rs` in trust-tasks-rs, deliberately closely:
  * a TypeScript consumer and a Rust one must reach the same verdict on the same
  * document, or the two reference implementations disagree about what conforms.
  *
  * ```ts
- * import { consumeInbound, StaticTransport, AclGrant_v0_1 } from "@openvtc/trust-tasks";
+ * import {
+ *   consequentialChecks, consumeInbound, InMemoryReplayGuard,
+ *   StaticTransport, AclGrant_v0_1,
+ * } from "@openvtc/trust-tasks";
+ *
+ * // One guard per consumer, not one per document: it *is* the record.
+ * const guard = new InMemoryReplayGuard();
  *
  * const outcome = await consumeInbound({
  *   transport,
@@ -14,6 +22,8 @@
  *   proofPolicy: { kind: "verify", verify: myVerifier },
  *   // ajv, or whatever validator you already run — see PayloadPolicy.
  *   payloadPolicy: { kind: "validate", validate: myValidator },
+ *   // acl/grant is consequential: a replayed envelope must not grant twice.
+ *   checks: consequentialChecks(guard),
  *   doc,
  *   myVid: "did:web:maintainer.example",
  *   now: Date.now(),
@@ -27,6 +37,11 @@
  *   case "rejected":   emit(outcome.error); break;
  *   case "suppressed": logSuppressed(); break;
  *   case "accepted":   break; // fire-and-forget: nothing to emit
+ *   // §7.2 item 11: already executed. Not an error — return the prior result
+ *   // if there is one, otherwise emit nothing.
+ *   case "duplicate":
+ *     if (outcome.priorResponse !== undefined) emit(outcome.priorResponse);
+ *     break;
  * }
  * ```
  *
@@ -45,7 +60,32 @@
  * `payloadPolicy` decides what to do with it. See {@link PayloadPolicy}.
  */
 import { enforceSpecPolicy, rejectWith, toErrorPayload, validateBasic, } from "./document.js";
+import { CONSEQUENTIAL_FRESHNESS, DEFAULT_FRESHNESS, STALE_WIRE_MESSAGE, recordExpiry, validateFreshness, } from "./freshness.js";
+import { documentDigest, } from "./replay.js";
 import { identityMismatchReason, reject, resolveParties, } from "./transport.js";
+/**
+ * The posture for a *consequential Trust Task* (§2): item 11 enforced against
+ * `guard`, and the bounded acceptance window that makes the record droppable.
+ *
+ * The right choice for any task whose execution grants access, moves value,
+ * discloses a secret, or otherwise cannot be undone by ignoring the next
+ * document.
+ */
+export function consequentialChecks(guard) {
+    return { freshness: CONSEQUENTIAL_FRESHNESS, replay: { kind: "guard", guard } };
+}
+/**
+ * The posture for a task that is **not** consequential, or whose specification
+ * "explicitly declares repeated execution safe and intended" — the narrow
+ * disapplication item 11 permits.
+ *
+ * Keeps no record. Still applies the default freshness policy, because a
+ * future-dated document and one with an empty validity interval are malformed
+ * whatever the task does.
+ */
+export function notConsequentialChecks() {
+    return { freshness: DEFAULT_FRESHNESS, replay: { kind: "notConsequential" } };
+}
 /** Wire-safe message for the `rejectIfPresent` path. */
 export const PROOF_NOT_ACCEPTED_BY_POLICY = "in-band proof not accepted by consumer policy (SPEC §7.2 item 7)";
 /**
@@ -59,7 +99,7 @@ export const PROOF_NOT_ACCEPTED_BY_POLICY = "in-band proof not accepted by consu
  * safe for ordinary refusals but not for one that contests that identity.
  */
 export async function consumeInbound(opts) {
-    const { transport, spec, proofPolicy, payloadPolicy, doc, myVid, now, newErrorId, handler, clock } = opts;
+    const { transport, spec, proofPolicy, payloadPolicy, checks, doc, myVid, now, newErrorId, handler, clock, } = opts;
     const route = (reason) => {
         const error = reject(transport, doc, newErrorId(), reason, clock);
         return error === undefined ? { kind: "suppressed", reason } : { kind: "rejected", error };
@@ -74,6 +114,16 @@ export async function consumeInbound(opts) {
             "`spec.payloadSchema`, or { kind: \"acceptUnvalidated\" } to state that you " +
             "are deliberately not checking it.");
     }
+    // Same reasoning, for the check that decides whether a replayed envelope
+    // executes a second time. A JavaScript caller gets no compile-time check,
+    // and defaulting to "keep no record" would silently reproduce the defect
+    // this option exists to remove.
+    if (checks === undefined) {
+        throw new TypeError("consumeInbound: `checks` is required as of 0.12.18 (SPEC §7.2 items 4 and 11). " +
+            "Pass consequentialChecks(guard) for a task whose execution grants access, " +
+            "moves value or is otherwise irreversible, or notConsequentialChecks() to " +
+            "state that repeated execution of this task is safe and intended.");
+    }
     // §7.2 item 2 — payload schema. Runs first, in the spec's own order, and
     // before anything that reasons about what the payload means: a payload that
     // is not the shape the specification declares should be refused as malformed
@@ -105,6 +155,15 @@ export async function consumeInbound(opts) {
     const basic = validateBasic(doc, now, myVid);
     if (basic !== null)
         return route(basic);
+    // §7.2 item 4, the other half — the freshness bound over `issuedAt`.
+    // `validateBasic` honours `expiresAt`, which is optional and which a
+    // producer sets for its own reasons; on its own it leaves a document stamped
+    // years ago, or years hence, indefinitely acceptable. It is also what bounds
+    // the replay record below: §7.2 makes the acceptance window and the record's
+    // retention one bound.
+    const fresh = validateFreshness(doc, now, checks.freshness);
+    if (fresh !== null)
+        return route(fresh);
     // §7.2 item 6 — in-band vs transport-derived identity cross-check.
     const resolved = resolveParties(transport, doc);
     if ("error" in resolved)
@@ -121,9 +180,15 @@ export async function consumeInbound(opts) {
                     ok = false;
                 }
                 if (!ok) {
+                    // A constant, never the verifier's own error text. SPEC §10.4
+                    // extends the §8.1 identity rule to every code, and a verifier's
+                    // vocabulary names DIDs it tried to resolve, whether a resolver
+                    // answered, and what a fetched DID document contained — a
+                    // resolver-reachability oracle for a sender who is, by construction,
+                    // unauthenticated. Log the detail; do not send it.
                     return route({
                         code: "proofInvalid",
-                        message: "proof verification failed",
+                        message: PROOF_INVALID_WIRE_MESSAGE,
                         retryable: false,
                     });
                 }
@@ -144,13 +209,114 @@ export async function consumeInbound(opts) {
     const policy = enforceSpecPolicy(doc, spec);
     if (policy !== null)
         return route(policy);
+    // §7.2 item 11 — the duplicate-execution record. Deliberately **last**:
+    // claiming the `id` marks the document as accepted for execution, and a
+    // document some earlier check refuses was never accepted. Claiming first
+    // would burn the `id` on every malformed or unauthorised arrival, so a
+    // corrected resend under the same `id` would come back `idConflict` forever
+    // — and an attacker could pre-burn an `id` it had merely observed.
+    let claim;
+    if (checks.replay.kind === "guard") {
+        const { guard } = checks.replay;
+        const digest = documentDigest(doc);
+        // §7.2 (*Bounding the record*): "A consumer that can establish neither an
+        // `expiresAt` nor an age for a document has no window in which to place
+        // it, and MUST NOT execute a consequential Trust Task on it." A guard
+        // asked to retain a record forever is not a guard, so refuse rather than
+        // pretend.
+        const retainUntil = recordExpiry(doc, checks.freshness, now);
+        if (retainUntil === undefined) {
+            return route({ code: "expired", message: STALE_WIRE_MESSAGE, retryable: false });
+        }
+        let verdict;
+        try {
+            verdict = await guard.claim(doc.id, digest, retainUntil, now);
+        }
+        catch {
+            // Fail closed. A consumer that cannot consult its record has not
+            // satisfied item 11, and executing anyway is exactly the double
+            // execution the rule forbids. `unavailable` is retryable, which is the
+            // honest answer: the producer's bit-for-bit resend will be absorbed
+            // correctly once the store is back. The thrown detail — a hostname, a
+            // connection string — stays out of the message, per §10.4.
+            return route({
+                code: "unavailable",
+                message: REPLAY_RECORD_UNAVAILABLE,
+                retryable: true,
+            });
+        }
+        switch (verdict.kind) {
+            case "duplicate":
+                return verdict.priorResponse === undefined
+                    ? { kind: "duplicate", inFlight: verdict.inFlight }
+                    : { kind: "duplicate", priorResponse: verdict.priorResponse, inFlight: verdict.inFlight };
+            case "conflict":
+                return route({
+                    code: "idConflict",
+                    message: ID_CONFLICT_WIRE_MESSAGE,
+                    retryable: false,
+                });
+            case "fresh":
+                claim = { guard, digest };
+                break;
+        }
+    }
     const result = await handler(doc, resolved.parties);
-    if (result === undefined || result === null)
+    if (result === undefined || result === null) {
+        // Fire-and-forget: nothing to cache, but the claim stands — the effect
+        // happened, and item 11 is about the effect, not about the response.
+        await settle(claim, doc.id, undefined);
         return { kind: "accepted" };
-    return isErrorResponse(result)
-        ? { kind: "rejected", error: result }
-        : { kind: "handled", response: result };
+    }
+    if (isErrorResponse(result)) {
+        // §8.4: a retryable refusal has just invited the producer to re-send this
+        // document bit-for-bit. Holding the claim would answer that invited retry
+        // with the cached failure forever. A non-retryable refusal is final, so
+        // the record stands and a replay is answered with the same determination.
+        if (result.payload.retryable === true) {
+            await claim?.guard.release?.(doc.id, claim.digest);
+        }
+        else {
+            await settle(claim, doc.id, result);
+        }
+        return { kind: "rejected", error: result };
+    }
+    await settle(claim, doc.id, result);
+    return { kind: "handled", response: result };
 }
+/**
+ * Record the response for a completed execution, best-effort.
+ *
+ * The effect has already happened, so a guard that cannot cache the response
+ * cannot un-happen it. The record of the *claim* is what item 11 needs and it
+ * is already written; all that is lost is the ability to hand the same
+ * response back, and the duplicate is still absorbed. Guards should log their
+ * own failures — there is nowhere to report this from here.
+ */
+async function settle(claim, id, response) {
+    if (claim === undefined)
+        return;
+    try {
+        await claim.guard.recordResponse?.(id, response);
+    }
+    catch {
+        /* see above */
+    }
+}
+/**
+ * Wire message for `proofInvalid`.
+ *
+ * Constant by design — see the §10.4 note at the rejection site. The Rust
+ * counterpart is `PROOF_INVALID_WIRE_MESSAGE` in `trust-tasks-rs`, kept equal.
+ */
+export const PROOF_INVALID_WIRE_MESSAGE = "proof verification failed";
+/** Wire message for `idConflict` (SPEC §7.2 item 11, §8.3). */
+export const ID_CONFLICT_WIRE_MESSAGE = "a different document has already been accepted under this id (SPEC §7.2 item 11)";
+/**
+ * Wire message for a replay-record outage. A constant, so a store's hostname
+ * or connection string never reaches the wire (SPEC §10.4).
+ */
+export const REPLAY_RECORD_UNAVAILABLE = "temporarily unavailable";
 /**
  * Whether a handler returned an error response rather than a success response.
  *

package/dist/_runtime/consume.js.map

@@ -1 +1 @@
-{"version":3,"file":"consume.js","sourceRoot":"","sources":["../../src/_runtime/consume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,aAAa,GAKd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,MAAM,EACN,cAAc,GAGf,MAAM,gBAAgB,CAAC;AAkHxB,wDAAwD;AACxD,MAAM,CAAC,MAAM,4BAA4B,GACvC,kEAAkE,CAAC;AAmCrE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA0B;IAE1B,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,GAChG,IAAI,CAAC;IAEP,MAAM,KAAK,GAAG,CAAC,MAAoB,EAAqB,EAAE;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,+CAA+C;IAC/C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CACjB,8EAA8E;YAC5E,mEAAmE;YACnE,6EAA6E;YAC7E,mCAAmC,CACtC,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,2BAA2B;IAC3B,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC1E,IAAI,OAA8D,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACzE,OAAO,KAAK,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EACL,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBACvC,CAAC,CAAC,8DAA8D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACnF,CAAC,CAAC,2DAA2D;gBACjE,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IAExC,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9E,6DAA6D;IAC7D,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,EAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,EAAE,GAAG,KAAK,CAAC;gBACb,CAAC;gBACD,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO,KAAK,CAAC;wBACX,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,2BAA2B;wBACpC,SAAS,EAAE,KAAK;qBACjB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,iBAAiB;gBACpB,OAAO,KAAK,CAAC;oBACX,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,4BAA4B;oBACrC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,KAAK,kBAAkB;gBACrB,MAAM;QACV,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACzE,OAAO,eAAe,CAAC,MAAM,CAAC;QAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAA8B,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAA+B;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,OAA6B,EAC7B,EAAU,EACV,MAAoB,EACpB,KAAoB;IAEpB,OAAO,UAAU,CAAC,OAAO,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"consume.js","sourceRoot":"","sources":["../../src/_runtime/consume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,aAAa,GAKd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,MAAM,EACN,cAAc,GAGf,MAAM,gBAAgB,CAAC;AAwBxB;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAkB;IACpD,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC;AAChF,CAAC;AA2ID,wDAAwD;AACxD,MAAM,CAAC,MAAM,4BAA4B,GACvC,kEAAkE,CAAC;AAyCrE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA0B;IAE1B,MAAM,EACJ,SAAS,EACT,IAAI,EACJ,WAAW,EACX,aAAa,EACb,MAAM,EACN,GAAG,EACH,KAAK,EACL,GAAG,EACH,UAAU,EACV,OAAO,EACP,KAAK,GACN,GAAG,IAAI,CAAC;IAET,MAAM,KAAK,GAAG,CAAC,MAAoB,EAAqB,EAAE;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,+CAA+C;IAC/C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CACjB,8EAA8E;YAC5E,mEAAmE;YACnE,6EAA6E;YAC7E,mCAAmC,CACtC,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CACjB,iFAAiF;YAC/E,4EAA4E;YAC5E,2EAA2E;YAC3E,kEAAkE,CACrE,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,2BAA2B;IAC3B,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC1E,IAAI,OAA8D,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACzE,OAAO,KAAK,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EACL,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBACvC,CAAC,CAAC,8DAA8D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACnF,CAAC,CAAC,2DAA2D;gBACjE,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IAExC,qEAAqE;IACrE,qEAAqE;IACrE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,uBAAuB;IACvB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IAExC,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9E,6DAA6D;IAC7D,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,EAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,EAAE,GAAG,KAAK,CAAC;gBACb,CAAC;gBACD,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,8DAA8D;oBAC9D,iEAAiE;oBACjE,gEAAgE;oBAChE,0DAA0D;oBAC1D,qEAAqE;oBACrE,mDAAmD;oBACnD,OAAO,KAAK,CAAC;wBACX,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,0BAA0B;wBACnC,SAAS,EAAE,KAAK;qBACjB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,iBAAiB;gBACpB,OAAO,KAAK,CAAC;oBACX,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,4BAA4B;oBACrC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,KAAK,kBAAkB;gBACrB,MAAM;QACV,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IAE1C,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,KAAyD,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAEnC,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,WAAW;QACX,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,gEAAgE;YAChE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,2DAA2D;YAC3D,OAAO,KAAK,CAAC;gBACX,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,yBAAyB;gBAClC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,WAAW;gBACd,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACnD,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC9F,KAAK,UAAU;gBACb,OAAO,KAAK,CAAC;oBACX,IAAI,EAAE,YAAY;oBAClB,OAAO,EAAE,wBAAwB;oBACjC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,KAAK,OAAO;gBACV,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC1B,MAAM;QACV,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAA8B,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,MAAM,CACnB,KAAyD,EACzD,EAAU,EACV,QAAiB;IAEjB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAEtE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,kFAAkF,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAA+B;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,OAA6B,EAC7B,EAAU,EACV,MAAoB,EACpB,KAAoB;IAEpB,OAAO,UAAU,CAAC,OAAO,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/_runtime/document.d.ts

@@ -184,10 +184,23 @@ export interface RejectReason {
 /**
  * The Type URI a consumer emits error responses under.
  *
- * `0.3`, because this runtime populates the `inResponseTo` member of §8.2 and
- * `0.2`'s payload schema is `additionalProperties: false` — a document carrying
- * it would not validate as `0.2`. Per §5.2 forward-minor compatibility a `0.2`
- * consumer SHOULD accept it.
+ * **The single source of truth for the emitted `trust-task-error` version on
+ * this side.** Three different answers were in circulation — this runtime and
+ * `trust-tasks-rs` emitted `0.5`, the HTTPS server emitted `0.2`, and the
+ * READMEs described `0.1` — so a producer could not tell from the
+ * documentation which schema an error response would validate against. Build
+ * error responses with `rejectWith` / `rejectWithRecipient`, or read the URI
+ * from here; do not spell it out again.
+ *
+ * The Rust counterpart is `trust_task_error_type_uri()` in `trust-tasks-rs`,
+ * kept equal to this value.
+ *
+ * `0.5` because this runtime populates the `inResponseTo` member of §8.2 and
+ * can emit `idConflict` (§8.3), which is absent from `0.3`'s code enum and does
+ * not match its extended-code pattern — a document carrying it would not
+ * validate as `0.3`. Per §5.2 forward-minor compatibility a `0.3` consumer
+ * SHOULD accept it. (This comment said `0.3` while the value said `0.5`: the
+ * value moved and the prose did not.)
  */
 export declare const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.5";
 /**

package/dist/_runtime/document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/_runtime/document.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,iFAAiF;AACjF,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,qGAAqG;IACrG,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;CACvB;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;OAIG;IACH,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,qDAAqD,CAAC;AAE5F;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,YAAY,GAAG,IAAI,CA6BrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAWrB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAiBrB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,GAAE,MAAM,MAAuC,GACjD,aAAa,CAkCf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,GAAG,CAAC,EAAE,MAAM,MAAM,GACjB,aAAa,CAEf;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CASjE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,EAC9B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,CAAC,EACV,GAAG,GAAE,MAAM,MAAuC,GACjD,iBAAiB,CAAC,CAAC,CAAC,CAgBtB"}
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/_runtime/document.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,iFAAiF;AACjF,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,qGAAqG;IACrG,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;CACvB;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;OAIG;IACH,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,qDAAqD,CAAC;AAE5F;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,YAAY,GAAG,IAAI,CA6BrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAWrB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAiBrB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,GAAE,MAAM,MAAuC,GACjD,aAAa,CAkCf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,GAAG,CAAC,EAAE,MAAM,MAAM,GACjB,aAAa,CAEf;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CASjE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,EAC9B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,CAAC,EACV,GAAG,GAAE,MAAM,MAAuC,GACjD,iBAAiB,CAAC,CAAC,CAAC,CAgBtB"}

package/dist/_runtime/document.js

@@ -8,10 +8,23 @@ import { normalizeCode } from "./codes.js";
 /**
  * The Type URI a consumer emits error responses under.
  *
- * `0.3`, because this runtime populates the `inResponseTo` member of §8.2 and
- * `0.2`'s payload schema is `additionalProperties: false` — a document carrying
- * it would not validate as `0.2`. Per §5.2 forward-minor compatibility a `0.2`
- * consumer SHOULD accept it.
+ * **The single source of truth for the emitted `trust-task-error` version on
+ * this side.** Three different answers were in circulation — this runtime and
+ * `trust-tasks-rs` emitted `0.5`, the HTTPS server emitted `0.2`, and the
+ * READMEs described `0.1` — so a producer could not tell from the
+ * documentation which schema an error response would validate against. Build
+ * error responses with `rejectWith` / `rejectWithRecipient`, or read the URI
+ * from here; do not spell it out again.
+ *
+ * The Rust counterpart is `trust_task_error_type_uri()` in `trust-tasks-rs`,
+ * kept equal to this value.
+ *
+ * `0.5` because this runtime populates the `inResponseTo` member of §8.2 and
+ * can emit `idConflict` (§8.3), which is absent from `0.3`'s code enum and does
+ * not match its extended-code pattern — a document carrying it would not
+ * validate as `0.3`. Per §5.2 forward-minor compatibility a `0.3` consumer
+ * SHOULD accept it. (This comment said `0.3` while the value said `0.5`: the
+ * value moved and the prose did not.)
  */
 export const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.5";
 /**

package/dist/_runtime/document.js.map

@@ -1 +1 @@
-{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/_runtime/document.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAqB,MAAM,YAAY,CAAC;AA2L9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kDAAkD,CAAC;AAE5F;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAyB,EACzB,GAAW,EACX,KAAa;IAEb,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,6CAA6C;gBACtD,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,uBAAuB,GAAG,CAAC,SAAS,EAAE;gBAC/C,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,mDAAmD;YAC5D,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAyB,EACzB,IAAgB;IAEhB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,wEAAwE;gBACxE,gCAAgC;YAClC,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,IAAgB;IAEhB,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,yFAAyF;YAC3F,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,qEAAqE;YAC9E,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,EAAU,EACV,OAAqB,EACrB,SAA6B,EAC7B,MAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAElD,6EAA6E;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,UAAU,GAAiB,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACtD,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACvD,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACxB,CAAC;QACD,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,EAAE;QACF,mEAAmE;QACnE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;QACxC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,SAAS;QACT,QAAQ,EAAE,GAAG,EAAE;QACf,OAAO,EAAE,UAAU;KACpB,CAAC;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,OAA6B,EAC7B,EAAU,EACV,OAAqB,EACrB,GAAkB;IAElB,OAAO,mBAAmB,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,MAAM,OAAO,GAAiB;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAA6B,EAC7B,EAAU,EACV,OAAU,EACV,MAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAElD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzC,MAAM,QAAQ,GAAyB;QACrC,EAAE;QACF,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;QACxC,IAAI,EAAE,GAAG,IAAI,WAAW;QACxB,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,SAAS,EAAE,OAAO,CAAC,MAAM;QACzB,QAAQ,EAAE,GAAG,EAAE;QACf,OAAO;KACR,CAAC;IACF,iDAAiD;IACjD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/_runtime/document.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAqB,MAAM,YAAY,CAAC;AA2L9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kDAAkD,CAAC;AAE5F;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAyB,EACzB,GAAW,EACX,KAAa;IAEb,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,6CAA6C;gBACtD,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,uBAAuB,GAAG,CAAC,SAAS,EAAE;gBAC/C,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,mDAAmD;YAC5D,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAyB,EACzB,IAAgB;IAEhB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,wEAAwE;gBACxE,gCAAgC;YAClC,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,IAAgB;IAEhB,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,yFAAyF;YAC3F,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,qEAAqE;YAC9E,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,EAAU,EACV,OAAqB,EACrB,SAA6B,EAC7B,MAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAElD,6EAA6E;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,UAAU,GAAiB,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACtD,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACvD,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACxB,CAAC;QACD,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,EAAE;QACF,mEAAmE;QACnE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;QACxC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,SAAS;QACT,QAAQ,EAAE,GAAG,EAAE;QACf,OAAO,EAAE,UAAU;KACpB,CAAC;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,OAA6B,EAC7B,EAAU,EACV,OAAqB,EACrB,GAAkB;IAElB,OAAO,mBAAmB,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,MAAM,OAAO,GAAiB;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAA6B,EAC7B,EAAU,EACV,OAAU,EACV,MAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAElD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzC,MAAM,QAAQ,GAAyB;QACrC,EAAE;QACF,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;QACxC,IAAI,EAAE,GAAG,IAAI,WAAW;QACxB,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,SAAS,EAAE,OAAO,CAAC,MAAM;QACzB,QAAQ,EAAE,GAAG,EAAE;QACf,OAAO;KACR,CAAC;IACF,iDAAiD;IACjD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/_runtime/freshness.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Freshness bounds over `issuedAt` / `expiresAt` (SPEC §4.2, §7.2).
+ *
+ * Mirrors `freshness.rs` in trust-tasks-rs, deliberately closely: a TypeScript
+ * consumer and a Rust one must reach the same verdict on the same document.
+ *
+ * Until this module, the only temporal check either runtime made was §7.2
+ * item 4 — `expiresAt`, and only where the producer chose to set it.
+ * `issuedAt` was carried on the type and looked at by nobody. That accepted a
+ * document stamped a year in the future (for the whole of that year), and one
+ * whose `expiresAt` sat at or before its own `issuedAt` — a validity interval
+ * that never contained a valid instant.
+ *
+ * It is also what makes {@link ReplayGuard} implementable. SPEC §7.2
+ * (*Bounding the record*) ties the duplicate-execution record to the
+ * acceptance window and says the two bounds are the same bound: a consumer
+ * "**MUST NOT** accept for execution a document older than the window over
+ * which it retains records". Without {@link FreshnessPolicy.maxAgeMs} there is
+ * no window, so a record for a document carrying no `expiresAt` would have to
+ * be kept forever.
+ */
+import type { RejectReason, TrustTaskDocument } from "./document.js";
+/** The clock-skew tolerance SPEC §4.2 sanctions ("typically ≤ 60s"), in ms. */
+export declare const DEFAULT_SKEW_MS = 60000;
+/**
+ * The acceptance window {@link consequentialFreshness} applies, in ms.
+ *
+ * Five minutes survives a mediator queue, a retry with backoff and a modest
+ * clock disagreement, and keeps the record it bounds small. A deployment whose
+ * transport buffers for longer must widen it *and* widen its guard's retention
+ * to match — §7.2 makes them one bound.
+ */
+export declare const DEFAULT_MAX_AGE_MS: number;
+/** How a consumer bounds a document in time before acting on it. */
+export interface FreshnessPolicy {
+    /**
+     * Tolerance applied to the document's timestamps against this consumer's
+     * clock, per SPEC §4.2. Applied to the future-dating check and to
+     * {@link maxAgeMs}; **not** to `expiresAt`, which `validateBasic` compares
+     * against the raw `now` it is given.
+     */
+    readonly skewMs: number;
+    /**
+     * Oldest `issuedAt` this consumer accepts, measured back from `now`.
+     * `undefined` means unbounded — the pre-existing behaviour, and the only
+     * setting under which a document carrying neither timestamp is acceptable.
+     */
+    readonly maxAgeMs?: number;
+    /** Reject a document carrying no `issuedAt`, with `malformedRequest`. */
+    readonly requireIssuedAt?: boolean;
+}
+/**
+ * The minimum every consumer should apply: reject a future-dated document and
+ * one whose stated validity interval is empty. No conforming producer emits
+ * either, so this costs a correct deployment nothing.
+ *
+ * Deliberately sets no `maxAgeMs` — an acceptance window depends on how long
+ * the transport may hold a message, which is a deployment fact, and a library
+ * that guessed one would start refusing documents that had arrived for years.
+ */
+export declare const DEFAULT_FRESHNESS: FreshnessPolicy;
+/**
+ * The posture SPEC §7.2 (*Bounding the record*) describes for a *consequential
+ * Trust Task*: `issuedAt` REQUIRED and a bounded acceptance window, so every
+ * accepted document sits inside a window a {@link ReplayGuard} can retain a
+ * record for.
+ */
+export declare const CONSEQUENTIAL_FRESHNESS: FreshnessPolicy;
+/** Wire-safe reason for a `malformedRequest` from a future-dated `issuedAt`. */
+export declare const FUTURE_ISSUED_AT = "issuedAt is in the future beyond the consumer's skew tolerance (SPEC \u00A74.2)";
+/** Wire-safe reason for a `malformedRequest` from `expiresAt <= issuedAt`. */
+export declare const EXPIRY_NOT_AFTER_ISSUANCE = "expiresAt is not after issuedAt: the document states an empty validity interval (SPEC \u00A74.2)";
+/** Wire-safe reason for a `malformedRequest` from a missing `issuedAt`. */
+export declare const ISSUED_AT_REQUIRED = "issuedAt is required by consumer policy (SPEC \u00A77.2, bounding the duplicate-execution record)";
+/**
+ * Wire message for a document outside the consumer's acceptance window.
+ *
+ * A constant, not a rendering of the window or the consumer's clock: §10.4
+ * keeps consumer-side state off the wire, and echoing the delta would turn
+ * every rejection into a remote `ntpdate` — and a probe for the window's exact
+ * boundary — for an unauthenticated sender.
+ */
+export declare const STALE_WIRE_MESSAGE = "document is outside the consumer's acceptance window (SPEC \u00A77.2)";
+/**
+ * Apply `policy` to this document's `issuedAt` / `expiresAt`. Returns `null`
+ * when the document is acceptable.
+ *
+ * This is the freshness half of SPEC §7.2 item 4 that `validateBasic` does not
+ * cover. {@link consumeInbound} calls it for you.
+ *
+ * @param now Milliseconds since the epoch, as from `Date.now()`.
+ */
+export declare function validateFreshness<P>(doc: TrustTaskDocument<P>, now: number, policy: FreshnessPolicy): RejectReason | null;
+/**
+ * The instant past which a replay record for `doc` may be dropped — the end of
+ * this consumer's willingness to execute it, which SPEC §7.2 makes the same
+ * instant as the end of the record's required retention.
+ *
+ * `expiresAt` fixes it where present; otherwise `issuedAt + maxAgeMs`.
+ * `undefined` means this policy places no bound on the document, in which case
+ * a consumer **MUST NOT** execute a consequential task on it — there is no
+ * window in which to keep the record.
+ */
+export declare function recordExpiry<P>(doc: TrustTaskDocument<P>, policy: FreshnessPolicy, now: number): number | undefined;
+//# sourceMappingURL=freshness.d.ts.map

package/dist/_runtime/freshness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness.d.ts","sourceRoot":"","sources":["../../src/_runtime/freshness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAErE,+EAA+E;AAC/E,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,QAAa,CAAC;AAE7C,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,EAAE,eAA6C,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,eAIrC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,oFACiD,CAAC;AAE/E,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,qGACyD,CAAC;AAEhG,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,sGACiE,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,0EAAqE,CAAC;AAErG;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,GACtB,YAAY,GAAG,IAAI,CAyCrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAWpB"}

package/dist/_runtime/freshness.js

@@ -0,0 +1,142 @@
+/**
+ * Freshness bounds over `issuedAt` / `expiresAt` (SPEC §4.2, §7.2).
+ *
+ * Mirrors `freshness.rs` in trust-tasks-rs, deliberately closely: a TypeScript
+ * consumer and a Rust one must reach the same verdict on the same document.
+ *
+ * Until this module, the only temporal check either runtime made was §7.2
+ * item 4 — `expiresAt`, and only where the producer chose to set it.
+ * `issuedAt` was carried on the type and looked at by nobody. That accepted a
+ * document stamped a year in the future (for the whole of that year), and one
+ * whose `expiresAt` sat at or before its own `issuedAt` — a validity interval
+ * that never contained a valid instant.
+ *
+ * It is also what makes {@link ReplayGuard} implementable. SPEC §7.2
+ * (*Bounding the record*) ties the duplicate-execution record to the
+ * acceptance window and says the two bounds are the same bound: a consumer
+ * "**MUST NOT** accept for execution a document older than the window over
+ * which it retains records". Without {@link FreshnessPolicy.maxAgeMs} there is
+ * no window, so a record for a document carrying no `expiresAt` would have to
+ * be kept forever.
+ */
+/** The clock-skew tolerance SPEC §4.2 sanctions ("typically ≤ 60s"), in ms. */
+export const DEFAULT_SKEW_MS = 60_000;
+/**
+ * The acceptance window {@link consequentialFreshness} applies, in ms.
+ *
+ * Five minutes survives a mediator queue, a retry with backoff and a modest
+ * clock disagreement, and keeps the record it bounds small. A deployment whose
+ * transport buffers for longer must widen it *and* widen its guard's retention
+ * to match — §7.2 makes them one bound.
+ */
+export const DEFAULT_MAX_AGE_MS = 5 * 60_000;
+/**
+ * The minimum every consumer should apply: reject a future-dated document and
+ * one whose stated validity interval is empty. No conforming producer emits
+ * either, so this costs a correct deployment nothing.
+ *
+ * Deliberately sets no `maxAgeMs` — an acceptance window depends on how long
+ * the transport may hold a message, which is a deployment fact, and a library
+ * that guessed one would start refusing documents that had arrived for years.
+ */
+export const DEFAULT_FRESHNESS = { skewMs: DEFAULT_SKEW_MS };
+/**
+ * The posture SPEC §7.2 (*Bounding the record*) describes for a *consequential
+ * Trust Task*: `issuedAt` REQUIRED and a bounded acceptance window, so every
+ * accepted document sits inside a window a {@link ReplayGuard} can retain a
+ * record for.
+ */
+export const CONSEQUENTIAL_FRESHNESS = {
+    skewMs: DEFAULT_SKEW_MS,
+    maxAgeMs: DEFAULT_MAX_AGE_MS,
+    requireIssuedAt: true,
+};
+/** Wire-safe reason for a `malformedRequest` from a future-dated `issuedAt`. */
+export const FUTURE_ISSUED_AT = "issuedAt is in the future beyond the consumer's skew tolerance (SPEC §4.2)";
+/** Wire-safe reason for a `malformedRequest` from `expiresAt <= issuedAt`. */
+export const EXPIRY_NOT_AFTER_ISSUANCE = "expiresAt is not after issuedAt: the document states an empty validity interval (SPEC §4.2)";
+/** Wire-safe reason for a `malformedRequest` from a missing `issuedAt`. */
+export const ISSUED_AT_REQUIRED = "issuedAt is required by consumer policy (SPEC §7.2, bounding the duplicate-execution record)";
+/**
+ * Wire message for a document outside the consumer's acceptance window.
+ *
+ * A constant, not a rendering of the window or the consumer's clock: §10.4
+ * keeps consumer-side state off the wire, and echoing the delta would turn
+ * every rejection into a remote `ntpdate` — and a probe for the window's exact
+ * boundary — for an unauthenticated sender.
+ */
+export const STALE_WIRE_MESSAGE = "document is outside the consumer's acceptance window (SPEC §7.2)";
+/**
+ * Apply `policy` to this document's `issuedAt` / `expiresAt`. Returns `null`
+ * when the document is acceptable.
+ *
+ * This is the freshness half of SPEC §7.2 item 4 that `validateBasic` does not
+ * cover. {@link consumeInbound} calls it for you.
+ *
+ * @param now Milliseconds since the epoch, as from `Date.now()`.
+ */
+export function validateFreshness(doc, now, policy) {
+    const malformed = (message) => ({
+        code: "malformedRequest",
+        message,
+        retryable: false,
+    });
+    const stale = () => ({
+        code: "expired",
+        message: STALE_WIRE_MESSAGE,
+        retryable: false,
+    });
+    if (doc.issuedAt !== undefined) {
+        const issuedAt = Date.parse(doc.issuedAt);
+        if (Number.isNaN(issuedAt)) {
+            return malformed("issuedAt is not a valid RFC 3339 timestamp");
+        }
+        if (issuedAt > now + policy.skewMs)
+            return malformed(FUTURE_ISSUED_AT);
+        if (doc.expiresAt !== undefined) {
+            const expiresAt = Date.parse(doc.expiresAt);
+            // A malformed `expiresAt` is `validateBasic`'s to report; skip it here
+            // rather than raise a second, differently-worded rejection for it.
+            if (!Number.isNaN(expiresAt) && expiresAt <= issuedAt) {
+                return malformed(EXPIRY_NOT_AFTER_ISSUANCE);
+            }
+        }
+        if (policy.maxAgeMs !== undefined && issuedAt + policy.maxAgeMs + policy.skewMs < now) {
+            return stale();
+        }
+        return null;
+    }
+    if (policy.requireIssuedAt === true)
+        return malformed(ISSUED_AT_REQUIRED);
+    // No `issuedAt`. A policy with a window cannot place the document in it
+    // unless the producer supplied an `expiresAt` instead (SPEC §7.2, *Bounding
+    // the record*).
+    if (policy.maxAgeMs !== undefined && doc.expiresAt === undefined)
+        return stale();
+    return null;
+}
+/**
+ * The instant past which a replay record for `doc` may be dropped — the end of
+ * this consumer's willingness to execute it, which SPEC §7.2 makes the same
+ * instant as the end of the record's required retention.
+ *
+ * `expiresAt` fixes it where present; otherwise `issuedAt + maxAgeMs`.
+ * `undefined` means this policy places no bound on the document, in which case
+ * a consumer **MUST NOT** execute a consequential task on it — there is no
+ * window in which to keep the record.
+ */
+export function recordExpiry(doc, policy, now) {
+    if (doc.expiresAt !== undefined) {
+        const expiresAt = Date.parse(doc.expiresAt);
+        if (!Number.isNaN(expiresAt))
+            return expiresAt;
+    }
+    if (policy.maxAgeMs === undefined)
+        return undefined;
+    const issuedAt = doc.issuedAt === undefined ? NaN : Date.parse(doc.issuedAt);
+    // Fall back to `now` when the producer stamped no usable `issuedAt`: the
+    // record then lives a full window from first sight, which is the longest the
+    // document could still be arriving from a queue.
+    return (Number.isNaN(issuedAt) ? now : issuedAt) + policy.maxAgeMs;
+}
+//# sourceMappingURL=freshness.js.map

package/dist/_runtime/freshness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness.js","sourceRoot":"","sources":["../../src/_runtime/freshness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAqB7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACtD,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,kBAAkB;IAC5B,eAAe,EAAE,IAAI;CACtB,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAC3B,4EAA4E,CAAC;AAE/E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GACpC,6FAA6F,CAAC;AAEhG,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAC7B,8FAA8F,CAAC;AAEjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,kEAAkE,CAAC;AAErG;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,GAAW,EACX,MAAuB;IAEvB,MAAM,SAAS,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC;QACpD,IAAI,EAAE,kBAAkB;QACxB,OAAO;QACP,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,GAAiB,EAAE,CAAC,CAAC;QACjC,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,kBAAkB;QAC3B,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,QAAQ,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAEvE,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;gBACtD,OAAO,SAAS,CAAC,yBAAyB,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtF,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAE1E,wEAAwE;IACxE,4EAA4E;IAC5E,gBAAgB;IAChB,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,EAAE,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAyB,EACzB,MAAuB,EACvB,GAAW;IAEX,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,iDAAiD;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;AACrE,CAAC"}