@openvtc/trust-tasks 0.14.2 → 0.16.0

package/CHANGELOG.md

@@ -0,0 +1,372 @@
+# Changelog — `@openvtc/trust-tasks`
+
+All notable changes to the TypeScript bindings package.
+
+This file starts at 0.15.0. Earlier releases are in the git history of
+`trust-tasks-ts/`; `trust-tasks-rs/CHANGELOG.md` records the changes the two
+libraries shipped together, which is most of them.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+The package versions over **its own API** — what a consumer compiles against —
+not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
+component.
+
+## 0.16.0 — 2026-08-27
+
+
+### Added
+
+- **specs**: Re-target every live specification to framework 0.5 (#306)
+
+* feat(specs): target framework 0.5 in the framework-reserved specs
+
+  The five framework-reserved families -- trust-task-error,
+  trust-task-next-step, trust-task-discovery, trust-task-control and
+  trust-ceremony-receipt -- are always compiled and are the ones every
+  other spec composes with, so they move first.
+
+  SPEC 7.2 item 1 selects the envelope schema by the specification's
+  declared target framework version, so this is the member that decides
+  which envelope a consumer validates these documents against. Framework
+  0.5.0 has been published under specs/_framework/0.5/ since it merged
+  canonically, but nothing targeted it, so none of its requirements bound
+  anything.
+
+  The 0.5 envelope is byte-identical to 0.4's apart from $id, title and
+  descriptions, and is a strict superset of 0.1-0.3 (same required set,
+  additionalProperties true, adding only constraints on ceremony and
+  parentThreadId). No document that conformed before stops conforming.
+
+- **specs**: Require issuedAt on every live consequential spec, and make the §7.3 item 17 floor fatal (#302)
+
+* spec: make the §7.3 item 17 freshness floor a hard failure
+
+- **rs**: Make SPEC §7.3 item 17's issuedAt MUST expressible (#300)
+
+Framework 0.5.0's §7.3 item 17 says a Trust Task specification defining a
+  consequential Trust Task MUST require the `issuedAt` member, raising §4.2's
+  SHOULD to a MUST for documents conforming to it. There was no way to declare
+  that: the meta-schema had `proofRequirement` for the `proof` envelope member
+  and nothing equivalent for `issuedAt`, so the MUST was unexpressible and none
+  of the 209 consequential specs in the registry could comply.
+
+  Adds `issuedAtRequirement` to the front-matter meta-schema, modelled on
+  `proofRequirement` — same two forms (a single `requirement`, or a per-variant
+  `request`/`response` pair), same enum, same `rationale`. It governs an envelope
+  member, admits a per-variant reading because request and response are relied on
+  differently, and reading one declaration now teaches the other.
+
+  Declared rather than derived, with the derived floor checked and reported:
+
+    * `sideEffects` and `exposure` are DESCRIPTIVE (§7.3 items 13/14). Deriving
+      `issuedAt`-REQUIRED from them would mean that correcting `sideEffects.level`
+      from `none` to `mutating` for accuracy silently changed which documents
+      every consumer of that spec must reject.
+    * §2 makes the *handler* authoritative for consequentiality, not the front
+      matter — so a value computed from the front matter would enforce something
+      the front matter does not authoritatively state.
+    * A non-consequential spec may legitimately require `issuedAt` anyway; a
+      derived-only mechanism cannot express that.
+    * Deriving would flip 209 specs' wire behaviour in one commit, invisibly.
+
+  So the build derives the floor instead of substituting for the declaration.
+  `npm run validate` prints a `Freshness floor (§7.3 item 17)` line counting the
+  consequential specs that have not declared it (currently 0/209), *fails* on a
+  spec that declares something weaker than REQUIRED, and escalates the undeclared
+  case to a hard error under `TT_STRICT_ISSUED_AT=1` — the ratchet that becomes
+  the default once the registry has caught up.
+
+  Enforcement reaches consumers the same way `IS_PROOF_REQUIRED` does:
+
+    * `Payload::IS_ISSUED_AT_REQUIRED` (Rust) and `SpecPolicy.isIssuedAtRequired`
+      (TypeScript), emitted per variant by both generators from the front matter.
+    * `TrustTask::enforce_spec_policy` / `enforceSpecPolicy` reject a document
+      with no `issuedAt` as `malformedRequest`. Not `expired`: §8.3 defines no
+      dedicated code, `expired` names a document that was once acceptable, and
+      §7.2 item 13 already uses `malformedRequest` for the other freshness
+      rejections.
+    * The trait constant has a default of `false`, so hand-written impls — the
+      crate's own `trust-task-error`, hand-modelled in `error.rs` because it is
+      in the codegen's SKIP_SLUGS, and every downstream impl — keep compiling.
+    * `check-bindings` compares the new key across front matter, Rust and
+      TypeScript, so the two languages cannot drift on it.
+
+  Distinct from `FreshnessPolicy::require_issued_at`, which is a *consumer's*
+  own posture applied to every document it sees. This is the *specification's*
+  requirement, published in the registry and not the consumer's to relax.
+
+  No specification declares `issuedAtRequirement` yet — that is a follow-up,
+  spec by spec. The generated Rust tree is therefore byte-identical (the const is
+  emitted only on override) and the generated TypeScript gains one
+  `isIssuedAtRequired: false` line per policy object. Nothing that was accepted
+  before is rejected now.
+
+  Also documents the declaration in CONTRIBUTING-SPECS.md, and teaches
+  `npm run new-spec` to emit it on a scaffold whose declared classes make the
+  task consequential.
+
+
+
+### Specifications
+
+- Bound the remaining free-text payload members and state who reads them (#301)
+
+SPEC.md §7.3 (framework 0.5.0) item 19 has three parts. PR #296 closed most
+  of part 1 for eight member names (`reason`, `note`, `detail`, `description`,
+  `message`, `text`, `label`, `comment`), 92 members in all. Sweeping the whole
+  corpus rather than a name list finds **48 more** unbounded free-text members
+  across 27 draft specifications and 10 shared schemas, under names the earlier
+  sweep did not look for: `purpose`, `deviceLabel`, `displayName`, `explanation`,
+  `summary`, `title`, `name`, `blurb`, `filename`, `trace`, `error`, `lastError`,
+  `deniedReason`, `displayHint`, `consequences`, `rpName`, `userName`,
+  `userDisplayName`.
+
+  The one the earlier review named specifically is here: `task-consent`'s
+  `Effect.summary` — the member its own schema calls "the ONLY member a consent
+  surface is guaranteed to be able to render" — was unbounded on the surface a
+  human reads to approve an action. It is now 500, the same figure as the `note`
+  beside it.
+
+  Bounds are drawn from the vocabulary the corpus already uses and sized per
+  member, not applied uniformly:
+
+      64   WebAuthn entity names (`rp.name`, `user.name`, `user.displayName`,
+           `rpName`, `userName`, `userDisplayName`) — the length WebAuthn tells
+           authenticators to truncate to, so a longer value would be silently
+           cut on the device rather than carried.
+     128   `purpose` where it names a decision slot or a declared intent. This
+           is consistency repair, not a new judgement: policy/activate/0.1 and
+           policy/active/0.1 already declared `maxLength: 128` on the request
+           member while the response that echoes it declared none.
+     256   display labels and names — `deviceLabel`, `displayName`,
+           `displayHint`, `label`, `title`, `name`, `blurb`, `filename`;
+           matches #296's reasoning that a display name is not prose.
+     500   consent-surface prose a human reads while deciding — `Effect.summary`,
+           `consequences[]`, credential-exchange `purpose`, `deniedReason`;
+           matches task-consent/request/0.1 `note`.
+    1024   operator or service diagnostic prose — `explanation`, `trace[]`,
+           `error`, `lastError`, and vta/credentials/issue `purpose`.
+
+  **Part 3 of the MUST is the half nobody had done.** Item 19 also requires each
+  specification to state who reads a free-text value, whether the recipient is
+  expected to retain it, and whether it is trusted. Prose is added to the
+  `## Security & Privacy` section of all **37** draft specifications that reach a
+  newly bounded member — the 27 whose own payload schema moved, plus 10 that
+  reach one through a shared `$def`. `vta/credentials/issue/0.{1,2}` had no such
+  section at all and now carry one containing the item 19 statement; both remain
+  on the Security & Privacy debt allowlist, because neither yet has the four
+  sub-headings the repo lint wants. The other 35 sections were extended in place.
+
+  Deliberately untouched, matching #296's own carve-outs:
+
+    * `messaging/_shared/0.1` `AuditEntry.detail` and `did-management/_shared/0.1`
+      `DomainEntry.label` — shared `$defs` reachable from a retired specification,
+      so bounding them would move a frozen specification's wire contract. These
+      are the only two shared schemas in this change's blast radius that a
+      retired spec reaches; the ten this PR edits are draft-only.
+    * Members item 19's own last paragraph excludes: identifiers, opaque handles,
+      digests and references; and values carried verbatim from an external
+      vocabulary — DNS domains, did:webvh agent-name local parts, DID logs, Rego
+      source, RFC 6901 pointers, HTTP header and cookie names, APNs topics, IANA
+      media types, BCP 47 language tags, and maintainer- or community-defined
+      role and kind vocabularies.
+
+  Two members were bounded where the schema's own description calls the value an
+  undeclared closed set (`nature`, `wired` in vtc/ceremonies/list) — deliberately
+  left alone, because the right fix there is the closed enumeration item 19
+  prefers, not a length.
+
+  All 48 members sit in `status: draft` specifications and are amended in place
+  per SPEC §5.2. `npm run validate` re-checks all 533 fenced example documents
+  against the amended schemas; none is rejected by a new bound.
+
+  **Still open, and deliberately not in this PR:** item 19's "SHOULD be OPTIONAL"
+  half. 18 of the 48 members bounded here are REQUIRED — `CredentialCreationOptions`
+  `rp.name`/`user.name`/`user.displayName`, credential-exchange `purpose` (both
+  copies), `Effect.summary`, `ContextRecord.name` and vta/contexts/create `name`,
+  the three `enroll-challenge` WebAuthn names, `CommunityProfile.name`,
+  `CommunityProfileView.name`, `CommunityProfileSnapshot.name`, and the four
+  decision-slot `purpose` members. Added to the 13 #296 found, that is 31.
+  Making any of them optional is a wire-compatibility change and belongs in its
+  own PR; several (purpose binding, `Effect.summary`) are required by design and
+  the specification should say so rather than change.
+
+  This is **breaking**, on the same terms #296 judged itself so: typify emits a
+  bounded member as a validating newtype, so `Option<String>` becomes
+  `Option<PayloadDeviceLabel>`, `Option<PayloadDeniedReason>`,
+  `Option<AttachmentRefFilename>` and so on, and the newtype rejects in
+  `Deserialize` a document the library previously accepted. `@openvtc/trust-tasks`
+  generates unchanged *types* — TypeScript has no length refinement — but its
+  embedded schemas now reject over-long values at runtime. No version is bumped
+  and no changelog is written: release-plz computes both from this title.
+
+- **trust-task-ok**: Retire the registry entry, deprecated by framework 0.5.0 (#292)
+
+Framework 0.5.0 lets a fire-and-forget specification's consumer return that
+  task's own <type>#response with payload {} as a courtesy acknowledgement.
+  That removes the only reason this slug existed: the previous text forbade a
+  response-less specification from emitting a #response, so 'received and
+  performed' needed a document of its own.
+
+  - specs/trust-task-ok/0.1/spec.md: status draft -> retired (SPEC 5.3
+    permitted transition 3), a Deprecation and retirement section carrying the
+    three normative consequences from framework 0.5.0, and a rewritten Status
+    of this Document. No supersededBy: the replacement is a framework
+    mechanism, not another Trust Task specification, so there is no successor
+    slug and none is invented. SPEC 7.3 item 11 RECOMMENDS one rather than
+    requiring it, and the build warns rather than fails.
+  - SPEC.md 6.1 and 8.6: adopt the framework 0.5.0 wording for the
+    deprecation, including that the slug and its Type URI remain RESERVED
+    permanently, plus a clearly marked registry note recording the retirement.
+
+  Retirement is a status, not a deletion. The entry stays published, stays in
+  the codegen (it is not in SKIP_SLUGS), and stays on the website; the reserved
+  slug allowlists in specs/spec.meta.schema.json and trust-tasks-rs/src/type_uri.rs
+  are untouched, so the name is not freed for anyone else. Neither generator
+  reads front-matter status, so regenerating both bindings produced no diff and
+  no library version bump is needed.
+
+- Bound every free-text payload member with a maxLength (§7.3) (#296)
+
+* spec: bound every free-text payload member with a maxLength
+
+  SPEC.md §7.3 (framework 0.5.0) requires that any member holding free
+  text declare a `maxLength`. 92 free-text string members across 83 draft
+  schemas carried none, leaving the wire contract unbounded and every
+  consumer to invent its own ceiling — or none, which is what §10.3
+  (schema-validation DoS) exists to prevent.
+
+  Bounds are chosen per member from the vocabulary the registry already
+  uses rather than applied uniformly:
+
+    256   `label`, `comment` — a display name or an OpenSSH key comment;
+          matches the existing 256 on provision/integration `label` and
+          the `name` members alongside it.
+    500   requester-authored prose that a surface renders to a human who
+          is deciding something; matches task-consent/request/0.1 `note`,
+          the registry's considered consent-surface bound.
+    1024  `reason`, `description`, `message` — operator or service prose
+          recorded for audit or returned as a diagnostic; matches the six
+          existing `reason: 1024` and the `description: 1024` in policy/
+          and vtc/endorsement-type.
+    16384 chat/message `text` — the task's actual content rather than
+          metadata about it; matches the corpus's long-form bound on
+          vault `secureNotes`.
+
+  All amended specifications are `status: draft`, so the change is made in
+  place per SPEC §5.2. Deliberately untouched:
+
+    * 17 members in `retired` specifications, frozen by SPEC §6.4.
+    * messaging/_shared/0.1 `AuditEntry.detail` and did-management/
+      _shared/0.1 `DomainEntry.label` — shared $defs reachable from a
+      retired specification, so bounding them would change a frozen
+      specification's effective wire contract.
+    * vault/_shared/{0.1,0.2,0.3} `TspMessageEnvelope.message` — opaque
+      base64url TSP bytes, not free text.
+
+  The `label` description in vault/_shared/*/vault-entry.schema.json said
+  the wire spec enforced no maximum length. It now does, so the sentence
+  is corrected rather than left contradicting the schema it annotates.
+
+  `npm run validate` re-checks all 533 fenced example documents against
+  the amended schemas; none is rejected by a new bound.
+
+## [0.15.0] - 2026-08-26
+
+### Changed
+
+- **BREAKING. Cross-file schema definitions are declared once, in
+  `_shared/components.ts`, instead of being copied into every module that
+  references them.** The counter-suffixed duplicates the copying produced —
+  `Ext1`, `Ext2`, `Ext3`, `Vid1`, `Vid2`, `SecretKind1`, `DigestMultibase1` and
+  the rest — are gone. 200 exported names disappear; **every one of them ends
+  in a digit**, and every unsuffixed name a module exported before it still
+  exports now.
+
+  Before, `Ext` — the framework's `ext` object, SPEC §4.5.1 — was declared 481
+  times across 341 modules, and which of `Ext`, `Ext1` or `Ext2` you got
+  depended on declaration order inside a generated file. There was no way to
+  write a signature over "the framework extension object". Now there is one
+  `Ext`.
+
+  **Migration.** Replace the suffix with the bare name:
+
+  | Before | After |
+  |---|---|
+  | `Ext1`, `Ext2`, `Ext3` | `Ext` |
+  | `Vid1`, `Vid2` | `Vid` |
+  | `DigestMultibase1` | `DigestMultibase` |
+  | `SecretKind1` | `SecretKind` |
+  | `AclEntry1`, `AccountType1`, `MediatorAcl1`, `QueueLimits1`, `KeyCustody1`, `KeyType1`, `KeyStatus1`, `SignAlgorithm1`, `WakeTriggerPolicy1`, `Namespace1`, `Version1`, `Version2`, `CredentialId1`, `ConsentSubject1`, `PersonhoodGovernance1` | the same name without the digit |
+
+  The rule is mechanical: `NameN` → `Name`, imported from the same module as
+  before. Nothing else moves. Because the suffixed and unsuffixed forms were
+  structurally identical, the replacement is type-safe — TypeScript is
+  structurally typed, so the two were already mutually assignable and no value
+  changes type.
+
+  The same hoist was **declined for the Rust bindings** (#283) and the
+  asymmetry is deliberate: `upsert::v0_3::VaultEntry` and
+  `delete::v0_1::VaultEntry` are distinct *nominal* types in Rust, so merging
+  them is an E0119 coherence break for any consumer holding a trait impl on
+  each. TypeScript has no coherence rule, so the same merge changes names and
+  nothing else.
+
+- **A definition name that denotes more than one shape is now qualified.**
+  Grouping is by structure, not by name: `VaultEntry` exists in three
+  structurally different versions, `Scope` in two unrelated ones (consent's and
+  vta's), and 22 names in all cover more than one shape. In
+  `_shared/components.ts` these are `VaultEntry_VaultV0_1`,
+  `VaultEntry_VaultV0_2`, `VaultEntry_VaultV0_3`, `Scope_ConsentV0_1`,
+  `Scope_VtaV0_1` and so on — every shape qualified, including the oldest,
+  because there is no canonical one. **Spec modules are unaffected**: each
+  re-exports what it uses under the name it used before, so
+  `vault/get/0.3/payload.js` still exports `VaultEntry`.
+
+### Added
+
+- **`_shared/components.ts`**, exported from the barrel as `SharedComponents`.
+  Import a definition once and use it across specs:
+  `import { SharedComponents } from "@openvtc/trust-tasks"` then
+  `SharedComponents.Ext`, or reach it directly at
+  `@openvtc/trust-tasks/_shared/components.js`.
+
+### Fixed
+
+- **The `_shared/` and `_framework/` modules publish their definitions.** They
+  are generated from schemas whose root declares no `type` and no `properties`,
+  so the compiler emitted a lone `[k: string]: unknown` interface and dropped
+  every `$def` as unreachable: `VaultEntryShared_v0_1.VaultEntry` in the barrel
+  named nothing at all, and the generator's own header comment claimed
+  otherwise. Each now re-exports the definitions it owns.
+
+### Notes for the next person adding a framework standard error code
+
+`StandardCode` stays a **closed** union — `(typeof STANDARD_CODES)[number]` —
+and this is a deliberate choice, re-taken here rather than inherited.
+
+It means the two SDKs treat a new SPEC §8.3 code differently. In
+`trust-tasks-rs` `StandardCode` is `#[non_exhaustive]` (since 0.7.0), so adding
+one is **additive**: downstream `match` expressions already carry a wildcard
+arm. Here the union is exhaustive by construction, so adding one is
+**breaking**: a `switch` that covers every member stops being exhaustive and
+`never`-typed default arms start erroring. `@openvtc/trust-tasks` went to 0.7.0
+for precisely that, alongside `trust-tasks-rs` 0.7.0 which took the
+`#[non_exhaustive]` break once and was done.
+
+So budget a **minor bump on this package** for the next standard code, and
+expect only a patch on the Rust side.
+
+The alternative — widening to `StandardCode | (string & {})` — was considered
+and rejected. It would make every `StandardCode`-typed position accept any
+string, so a misspelled `"proofRequred"` would compile everywhere the union is
+used, including `RejectReason.code`, which decides what error document the
+runtime emits. That cost is paid on every line of every consumer, forever, to
+soften a break that arrives once per framework minor and arrives as a compile
+error naming the exact sites to fix.
+
+Consumers who want to be immune should narrow rather than switch exhaustively:
+`isStandardCode(code)` (exported from the root) is a type guard from `string`,
+it normalizes the frozen framework 0.1 snake_case spellings on the way, and a
+`switch` over its narrowed result with a `default` arm survives any addition.
+That pattern is documented on `StandardCode` itself.

package/README.md

@@ -85,6 +85,32 @@ appending `_v<MAJOR>_<MINOR>`. Multiple versions of the same spec
 land in sibling directories (`0.1/`, `1.0/`, …) and export
 distinct names — there is no "latest" alias by design.
 
+### Shared definitions
+
+A definition several specs `$ref` — `Ext` (the SPEC §4.5.1 extension object),
+`AclEntry`, `VaultEntry`, `DigestMultibase` — is declared **once**, in
+`src/_shared/components.ts`, and re-exported from every spec module that uses
+it under the name that module has always used. So `AclGrant_v0_1.AclEntry` and
+`AclShow_v0_1.AclEntry` are the same type, not two copies of one shape:
+
+```ts
+import { SharedComponents, type AclGrant_v0_1 } from "@openvtc/trust-tasks";
+
+// Write a helper once, over the shared definition, and it takes any spec's.
+const namespaces = (ext: SharedComponents.Ext) => Object.keys(ext);
+```
+
+Where one definition *name* covers more than one shape — `VaultEntry` differs
+between `vault/_shared/0.1`, `0.2` and `0.3` — `components.ts` qualifies each
+(`VaultEntry_VaultV0_1`, …) rather than pretending they are interchangeable.
+The spec modules still export the bare `VaultEntry`, bound to the version they
+were generated against.
+
+Before 0.15.0 these definitions were copied into every module that referenced
+them, and repeated copies inside one module were numbered `Ext1`, `Ext2`, `Vid1`
+and so on. Those numbered names are gone; see
+[CHANGELOG.md](./CHANGELOG.md) for the one-line migration.
+
 ## Consuming a document
 
 A conforming *consumer* applies all eight checks in
@@ -197,9 +223,18 @@ specification's `targetFrameworkVersion` declaration instead.
 A bump in an individual spec's own `MAJOR.MINOR` ships as a new exported module
 name (`AclGrant_v1_0` alongside `AclGrant_v0_1`) and so is additive here.
 
-`trust-tasks-rs` and `@openvtc/trust-tasks` are released together and carry
-matching version numbers, so a given pair is known to be generated from the
-same registry revision.
+`trust-tasks-rs` and `@openvtc/trust-tasks` are usually released together and
+carry matching version numbers, so a given pair is known to be generated from
+the same registry revision. They diverge when a change is breaking on one side
+only — 0.15.0 is such a release, hoisting the shared definitions in a way that
+is safe here (TypeScript is structurally typed) and a coherence break in Rust.
+
+One divergence is standing and worth knowing before you write a `switch`:
+`StandardCode` is a **closed** union here and `#[non_exhaustive]` in
+`trust-tasks-rs`, so a new SPEC §8.3 error code is a **minor** bump on this
+package and a patch on the crate. Narrow with `isStandardCode` and keep a
+`default` arm to be immune to it; the reasoning is on the type itself and in
+[CHANGELOG.md](./CHANGELOG.md).
 
 ## License
 

package/dist/_framework/0.1/framework.d.ts

@@ -8,4 +8,9 @@
 export interface TrustTasksFrameworkReusableJSONSchemaDefinitions {
     [k: string]: unknown | undefined;
 }
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../_shared/components.js".
+ */
+export type { Ext } from "../../_shared/components.js";
 //# sourceMappingURL=framework.d.ts.map

package/dist/_framework/0.1/framework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.1/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC"}
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.1/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,GAAG,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/_framework/0.2/framework.d.ts

@@ -8,4 +8,9 @@
 export interface TrustTasksFrameworkReusableJSONSchemaDefinitions {
     [k: string]: unknown | undefined;
 }
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../_shared/components.js".
+ */
+export type { Ext } from "../../_shared/components.js";
 //# sourceMappingURL=framework.d.ts.map

package/dist/_framework/0.2/framework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.2/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC"}
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.2/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,GAAG,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/_framework/0.3/framework.d.ts

@@ -10,4 +10,9 @@
 export interface TrustTasksFrameworkReusableJSONSchemaDefinitions {
     [k: string]: unknown | undefined;
 }
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../_shared/components.js".
+ */
+export type { DigestMultibase, Ext } from "../../_shared/components.js";
 //# sourceMappingURL=framework.d.ts.map

package/dist/_framework/0.3/framework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.3/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC"}
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.3/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/_runtime/codes.d.ts

@@ -8,6 +8,44 @@
  */
 /** The framework-defined standard error codes (SPEC.md §8.3). */
 export declare const STANDARD_CODES: readonly ["malformedRequest", "unsupportedType", "unsupportedVersion", "expired", "proofRequired", "proofInvalid", "permissionDenied", "wrongRecipient", "identityMismatch", "idConflict", "cancelled", "taskFailed", "unavailable", "internalError"];
+/**
+ * The framework-defined standard error codes, as a **closed** union.
+ *
+ * ── The asymmetry with Rust, and why it is kept ────────────────────────────
+ *
+ * `trust-tasks-rs` marks its `StandardCode` `#[non_exhaustive]` (since 0.7.0),
+ * so adding a framework standard code there is additive: a downstream `match`
+ * already carries a wildcard arm. TypeScript has no `#[non_exhaustive]`, and
+ * this union is exhaustive by construction, so the same addition is a
+ * **breaking change on this side** — a `switch` that covers every member today
+ * stops being exhaustive, and `never`-typed default arms start erroring.
+ * `@openvtc/trust-tasks` went to 0.7.0 for exactly that reason.
+ *
+ * The obvious defence is to widen the type — `StandardCode | (string & {})` —
+ * and it was considered and rejected. Widening pays a permanent cost for an
+ * occasional event: it makes every `StandardCode`-typed position accept any
+ * string, so a misspelled `"proofRequred"` would compile everywhere the union
+ * is used, including `RejectReason.code`, which is how this runtime decides
+ * what error document to emit. That is a worse failure than a release
+ * that tells you where to add an arm, and it would be paid on every line of
+ * every consumer, forever, to soften a break that arrives once per framework
+ * minor and arrives *as a compile error naming the exact sites*.
+ *
+ * ── What a consumer should do instead ──────────────────────────────────────
+ *
+ * Nothing on the receive path forces the closed union on you. Wire values
+ * arrive as `string` and narrow through {@link isStandardCode}, which is the
+ * supported pattern:
+ *
+ * ```ts
+ * if (isStandardCode(code)) handleStandard(code); // narrowed to StandardCode
+ * else handleExtended(code);                      // §8.5 extended code
+ * ```
+ *
+ * Write `switch` statements over a value narrowed that way, and keep a
+ * `default` arm rather than relying on exhaustiveness, and a new standard code
+ * costs you a recompile rather than a rewrite.
+ */
 export type StandardCode = (typeof STANDARD_CODES)[number];
 /**
  * Normalize a wire `code` to its canonical 0.2 spelling when it is a standard

package/dist/_runtime/codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,uPAejB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAuB3D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,YAAY,CAEjE;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CASnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAepF;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAavD"}
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,uPAejB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAuB3D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,YAAY,CAEjE;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CASnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAepF;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAavD"}

package/dist/_runtime/codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,SAAS;IACT,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;CACP,CAAC;AAIX;;;GAGG;AACH,MAAM,eAAe,GAA2C;IAC9D,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,oBAAoB;IACzC,cAAc,EAAE,eAAe;IAC/B,aAAa,EAAE,cAAc;IAC7B,iBAAiB,EAAE,kBAAkB;IACrC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,kBAAkB;IACrC,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,YAAY;IACzB,cAAc,EAAE,eAAe;CAChC,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC,sEAAsE;AACtE,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,GAAG;YACzE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,SAAiB,EAAE,KAAa;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,uBAAuB;YACvE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+CAA+C;YACtE,cAAc,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,8BAA8B,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,iFAAiF;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,SAAS;IACT,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;CACP,CAAC;AA0CX;;;GAGG;AACH,MAAM,eAAe,GAA2C;IAC9D,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,oBAAoB;IACzC,cAAc,EAAE,eAAe;IAC/B,aAAa,EAAE,cAAc;IAC7B,iBAAiB,EAAE,kBAAkB;IACrC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,kBAAkB;IACrC,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,YAAY;IACzB,cAAc,EAAE,eAAe;CAChC,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC,sEAAsE;AACtE,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,GAAG;YACzE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,SAAiB,EAAE,KAAa;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,uBAAuB;YACvE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+CAA+C;YACtE,cAAc,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,8BAA8B,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,iFAAiF;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/_runtime/document.d.ts

@@ -163,6 +163,18 @@ export interface SpecPolicy {
     readonly isProofRequired: boolean;
     /** §7.3 item 5 — the party filling `recipient` is REQUIRED. */
     readonly isRecipientRequired: boolean;
+    /**
+     * §7.3 item 17 — `issuedAtRequirement` is REQUIRED, raising §4.2's `issuedAt`
+     * SHOULD to a MUST for this specification's documents. A specification
+     * defining a *consequential Trust Task* (§2) must declare it, so that §7.2
+     * item 11's duplicate-execution record always has a window to sit in.
+     *
+     * Optional, defaulting to `false`, so a hand-written policy predating the
+     * declaration still type-checks. This is the *specification's* requirement,
+     * published in the registry — distinct from a consumer's own freshness
+     * posture, which is chosen at the call site and applied to every document.
+     */
+    readonly isIssuedAtRequired?: boolean;
     /**
      * §7.2 item 2 — this variant's payload schema, as a value.
      *
@@ -221,12 +233,13 @@ export declare function validateBasic<P>(doc: TrustTaskDocument<P>, now: number,
  */
 export declare function enforceAudienceBinding<P>(doc: TrustTaskDocument<P>, spec: SpecPolicy): RejectReason | null;
 /**
- * The policy-driven subset of SPEC §7.2 — items 5b, 7 clause A, and 8.
+ * The policy-driven subset of SPEC §7.2 — items 5b, 7 clause A, and 8, plus
+ * §7.3 item 17's `issuedAt` requirement.
  *
  * Single source of truth for the flag-driven checks, so a binding-specific
  * pipeline and {@link consumeInbound} cannot diverge on the check set. Ordering
  * matches trust-tasks-rs `enforce_spec_policy`: recipient, then proof, then
- * audience binding.
+ * issuedAt (§7.3 item 17), then audience binding.
  */
 export declare function enforceSpecPolicy<P>(doc: TrustTaskDocument<P>, spec: SpecPolicy): RejectReason | null;
 /**

package/dist/_runtime/document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/_runtime/document.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,iFAAiF;AACjF,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,qGAAqG;IACrG,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;CACvB;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;OAIG;IACH,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,qDAAqD,CAAC;AAE5F;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,YAAY,GAAG,IAAI,CA6BrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAWrB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAiBrB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,GAAE,MAAM,MAAuC,GACjD,aAAa,CAkCf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,GAAG,CAAC,EAAE,MAAM,MAAM,GACjB,aAAa,CAEf;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CASjE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,EAC9B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,CAAC,EACV,GAAG,GAAE,MAAM,MAAuC,GACjD,iBAAiB,CAAC,CAAC,CAAC,CAgBtB"}
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/_runtime/document.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,iFAAiF;AACjF,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,qGAAqG;IACrG,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;CACvB;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;OAIG;IACH,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,qDAAqD,CAAC;AAE5F;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,YAAY,GAAG,IAAI,CA6BrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAWrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,UAAU,GACf,YAAY,GAAG,IAAI,CAwBrB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,GAAE,MAAM,MAAuC,GACjD,aAAa,CAkCf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,YAAY,EACrB,GAAG,CAAC,EAAE,MAAM,MAAM,GACjB,aAAa,CAEf;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CASjE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,EAC9B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,CAAC,EACV,GAAG,GAAE,MAAM,MAAuC,GACjD,iBAAiB,CAAC,CAAC,CAAC,CAgBtB"}

package/dist/_runtime/document.js

@@ -82,12 +82,13 @@ export function enforceAudienceBinding(doc, spec) {
     return null;
 }
 /**
- * The policy-driven subset of SPEC §7.2 — items 5b, 7 clause A, and 8.
+ * The policy-driven subset of SPEC §7.2 — items 5b, 7 clause A, and 8, plus
+ * §7.3 item 17's `issuedAt` requirement.
  *
  * Single source of truth for the flag-driven checks, so a binding-specific
  * pipeline and {@link consumeInbound} cannot diverge on the check set. Ordering
  * matches trust-tasks-rs `enforce_spec_policy`: recipient, then proof, then
- * audience binding.
+ * issuedAt (§7.3 item 17), then audience binding.
  */
 export function enforceSpecPolicy(doc, spec) {
     if (doc.recipient === undefined && spec.isRecipientRequired) {
@@ -104,6 +105,13 @@ export function enforceSpecPolicy(doc, spec) {
             retryable: false,
         };
     }
+    if (doc.issuedAt === undefined && spec.isIssuedAtRequired === true) {
+        return {
+            code: "malformedRequest",
+            message: "issuedAt is required by this Trust Task specification (SPEC §7.3 item 17)",
+            retryable: false,
+        };
+    }
     return enforceAudienceBinding(doc, spec);
 }
 /**