@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/audit/list/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/audit/list/0.1/payload.schema.json
  */
 
-/**
- * Hash-chain link: the `entryHash` of the immediately-preceding entry. Present only on chained logs; its integrity is what audit/verify checks. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the predecessor's immutable content — the same derivation as `entryHash`, so a verifier recomputes both the same way.
- */
-export type DigestMultibase = string;
-/**
- * Hash-chain commitment over this entry's immutable content. The next entry's `prevHash` points here. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of that content; the canonicalization is what makes the commitment reproducible by a verifier that did not write the entry.
- */
-export type DigestMultibase1 = string;
+import type { AuditEnvelope, DigestMultibase, Ext } from "../../../_shared/components.js";
+
 
 export interface AuditListPayload {
   /**
@@ -47,12 +41,6 @@ export interface AuditListPayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface AuditListResponsePayload {
   /**
    * The matching audit entries, newest first.
@@ -68,52 +56,9 @@ export interface AuditListResponsePayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * One entry in an append-only audit log. Only eventId/recordedAt/action are universal; every other field is populated by maintainers that track it. `prevHash`/`entryHash` are present on hash-chained logs (see audit/verify) and absent otherwise. Principal DIDs are plaintext and MAY be absent when a right-to-be-forgotten redaction has nulled them after the fact.
- */
-export interface AuditEnvelope {
-  /**
-   * Stable identifier for this event. Also the tie-breaker component of a cursor's position key.
-   */
-  eventId: string;
-  /**
-   * Wall-clock time the entry was written. The primary ordering key.
-   */
-  recordedAt: string;
-  /**
-   * The operation this entry records — a maintainer-defined action name (e.g. `member.removed`, `policy.activated`). The discriminator for `detail`.
-   */
-  action: string;
-  /**
-   * How the operation resolved. Typically `success` or `denied`; a maintainer MAY use others. Absent for events that have no pass/fail sense.
-   */
-  outcome?: string;
-  /**
-   * DID of the principal that performed the action. `null` when a right-to-be-forgotten redaction has removed the plaintext; a maintainer that keeps a keyed hash of the actor for correlation carries it in `ext`, not here.
-   */
-  actor?: string | null;
-  /**
-   * DID of the principal the action acted upon, when the event has one. `null`/absent for events whose target is the maintainer itself. Same redaction semantics as `actor`.
-   */
-  target?: string | null;
-  /**
-   * Trust context the event occurred in, for a maintainer that partitions its log per context.
-   */
-  contextId?: string;
-  /**
-   * Envelope-shape version at the maintainer, for consumers that need to reason about wire-shape evolution.
-   */
-  schemaVersion?: number;
-  prevHash?: DigestMultibase;
-  entryHash?: DigestMultibase1;
-  /**
-   * Event-specific payload, keyed by `action`. Opaque to the framework; a consumer that does not recognise the action treats it as an unstructured record.
-   */
-  detail?: {
-    [k: string]: unknown | undefined;
-  };
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuditEnvelope, DigestMultibase, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/audit/list/0.1" as const;
@@ -456,6 +401,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -469,5 +415,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/audit/verify/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/audit/verify/0.1/payload.schema.json
  */
 
-/**
- * The `entryHash` of the newest envelope reached, in the same multibase-multihash encoding the envelope carries it. Absent when the log is empty.
- */
-export type DigestMultibase = string;
+import type { DigestMultibase, Ext } from "../../../_shared/components.js";
+
 
 /**
  * Request to verify the integrity of a maintainer's append-only audit hash chain. The request carries no parameters — verification is store-wide.
@@ -14,12 +12,6 @@ export type DigestMultibase = string;
 export interface AuditVerifyPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The outcome of walking the audit log in chronological order and checking each envelope's hash links. `verified` is true only when every chainable envelope re-derived its own `entryHash` and pointed at its predecessor's. When false, `chainBreak` locates the first failure.
  */
@@ -44,6 +36,9 @@ export interface AuditVerifyResponsePayload {
    * Envelopes that could not be deserialized and so could not be checked. Reported at the same prominence as a break, not swallowed.
    */
   unparseableSkipped: number;
+  /**
+   * The `entryHash` of the newest envelope reached, in the same multibase-multihash encoding the envelope carries it. Absent when the log is empty.
+   */
   head?: DigestMultibase;
   chainBreak?: ChainBreak;
   ext?: Ext;
@@ -66,6 +61,9 @@ export interface ChainBreak {
   eventId?: string;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/audit/verify/0.1" as const;
 
@@ -324,6 +322,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -337,5 +336,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/_shared/0.1/session.ts

@@ -9,3 +9,9 @@
 export interface AuthSharedSessionDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Session } from "../../../_shared/components.js";

package/src/auth/_shared/0.1/tokens.ts

@@ -9,3 +9,9 @@
 export interface AuthSharedTokenDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { TokenBundle } from "../../../_shared/components.js";

package/src/auth/_shared/0.1/webauthn.ts

@@ -11,3 +11,9 @@
 export interface AuthSharedWebAuthnDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { AuthenticatorAssertionResponseLogin, AuthenticatorAttestationResponseRegistration, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions, RegisteredCredential } from "../../../_shared/components.js";

package/src/auth/authenticate/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/authenticate/0.1/payload.schema.json
  */
 
+import type { Ext, Session, TokenBundle } from "../../../_shared/components.js";
+
+
 /**
  * The subject presents a previously-issued challenge along with the framework `proof` that binds the document to their VID. The proof IS the authentication.
  */
@@ -19,103 +22,32 @@ export interface AuthAuthenticate {
    * Optional capability tags the subject is requesting on the issued tokens. The consumer's authorization layer decides which are granted; the issued TokenBundle's `scope` MAY be a subset.
    */
   scope?: string[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Issued by the auth service after verifying the proof on the authenticate document. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/authenticate/0.1#response.
  */
 export interface AuthAuthenticateResponsePayload {
-  session: Session;
-  tokens: TokenBundle;
-  ext?: Ext3;
-}
-/**
- * The session the consumer has just created or refreshed for this subject.
- */
-export interface Session {
   /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   * The session the consumer has just created or refreshed for this subject.
    */
-  id: string;
-  /**
-   * The authenticated party's VID (typically a DID URL).
-   */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Access + optional refresh tokens. Consumers MAY omit a refresh token when their policy doesn't support refresh.
- */
-export interface TokenBundle {
-  /**
-   * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
-   */
-  accessToken: string;
-  /**
-   * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
-   */
-  refreshToken?: string;
-  /**
-   * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
-   */
-  tokenType: string;
-  /**
-   * Seconds from issuance until the access token expires.
-   */
-  expiresIn: number;
+  session: Session;
   /**
-   * Seconds from issuance until the refresh token expires, when one was issued.
+   * Access + optional refresh tokens. Consumers MAY omit a refresh token when their policy doesn't support refresh.
    */
-  refreshExpiresIn?: number;
+  tokens: TokenBundle;
   /**
-   * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  scope?: string[];
-  ext?: Ext2;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext2 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext3 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Session, TokenBundle };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/authenticate/0.1" as const;
 
@@ -471,6 +403,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -484,5 +417,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/challenge/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/challenge/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Request a one-time challenge nonce that the subject will sign to prove control of their VID.
  */
@@ -15,14 +18,11 @@ export interface AuthChallenge {
    * Producer-declared intent (e.g. "login", "step-up", "sign-out"). Consumers MAY surface this in audit logs or use it to scope the issued nonce. Free-form; ecosystems define the vocabulary.
    */
   purpose?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Issued by the auth service in reply to a challenge request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/challenge/0.1#response.
  */
@@ -39,15 +39,15 @@ export interface AuthChallengeResponsePayload {
    * ISO-8601 timestamp after which the challenge MUST NOT be accepted. Issuers SHOULD pick a window between 30 seconds and 5 minutes.
    */
   expiresAt: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/challenge/0.1" as const;
 
@@ -85,6 +85,7 @@ export const PAYLOAD_SCHEMA = {
     "purpose": {
       "type": "string",
       "minLength": 1,
+      "maxLength": 128,
       "description": "Producer-declared intent (e.g. \"login\", \"step-up\", \"sign-out\"). Consumers MAY surface this in audit logs or use it to scope the issued nonce. Free-form; ecosystems define the vocabulary."
     },
     "ext": {
@@ -201,6 +202,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -214,5 +216,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/enroll/finish/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/finish/0.1/payload.schema.json
  */
 
+import type { AuthenticatorAttestationResponseRegistration, Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * Submit the WebAuthn attestation that completes a passkey-enrollment ceremony. On success the auth service binds the credential to the subject's VID.
  */
@@ -11,34 +14,19 @@ export interface AuthPasskeyEnrollFinish {
    * The enrollmentId issued by the matching `auth/passkey/enroll/start` response. Echoed verbatim.
    */
   enrollmentId: string;
+  /**
+   * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
+   */
   credential: AuthenticatorAttestationResponseRegistration;
   /**
    * Final operator-facing label for the credential. Overrides any label passed at start.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
- */
-export interface AuthenticatorAttestationResponseRegistration {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    attestationObject: string;
-    transports?: string[];
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement of the registered credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/finish/0.1#response.
  */
@@ -56,15 +44,15 @@ export interface AuthPasskeyEnrollFinishResponsePayload {
    */
   deviceLabel?: string;
   registeredAt: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAttestationResponseRegistration, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.1" as const;
 
@@ -109,6 +97,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "deviceLabel": {
       "type": "string",
+      "maxLength": 256,
       "description": "Final operator-facing label for the credential. Overrides any label passed at start."
     },
     "ext": {
@@ -139,6 +128,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "deviceLabel": {
           "type": "string",
+          "maxLength": 256,
           "description": "The label persisted with the credential."
         },
         "registeredAt": {
@@ -246,6 +236,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "deviceLabel": {
           "type": "string",
+          "maxLength": 256,
           "description": "The label persisted with the credential."
         },
         "registeredAt": {
@@ -337,6 +328,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -350,5 +342,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/enroll/finish/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/finish/0.2/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, AuthenticatorAttestationResponseRegistration, Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * Submit the WebAuthn attestation that completes a passkey-enrollment ceremony. On success the auth service binds the credential to the subject's VID.
  */
@@ -11,51 +14,23 @@ export interface AuthPasskeyEnrollFinish {
    * The enrollmentId issued by the matching `auth/passkey/enroll/start` response. Echoed verbatim.
    */
   enrollmentId: string;
+  /**
+   * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
+   */
   credential: AuthenticatorAttestationResponseRegistration;
+  /**
+   * New in 0.2. AuthenticatorAssertionResponse over the uvOptions returned by start, proving a human with an already-enrolled authenticator authorized adding this one. REQUIRED whenever start returned uvOptions; omitted otherwise. A consumer that issued uvOptions MUST reject a finish that lacks this member — the re-authentication requirement is the consumer's, so treating a missing assertion as consent would let a producer decline it unilaterally.
+   */
   uvCredential?: AuthenticatorAssertionResponseLogin;
   /**
    * Final operator-facing label for the credential. Overrides any label passed at start.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
- */
-export interface AuthenticatorAttestationResponseRegistration {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    attestationObject: string;
-    transports?: string[];
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * New in 0.2. AuthenticatorAssertionResponse over the uvOptions returned by start, proving a human with an already-enrolled authenticator authorized adding this one. REQUIRED whenever start returned uvOptions; omitted otherwise. A consumer that issued uvOptions MUST reject a finish that lacks this member — the re-authentication requirement is the consumer's, so treating a missing assertion as consent would let a producer decline it unilaterally.
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement of the registered credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2#response.
  */
@@ -73,15 +48,15 @@ export interface AuthPasskeyEnrollFinishResponsePayload {
    */
   deviceLabel?: string;
   registeredAt: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, AuthenticatorAttestationResponseRegistration, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2" as const;
 
@@ -130,6 +105,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "deviceLabel": {
       "type": "string",
+      "maxLength": 256,
       "description": "Final operator-facing label for the credential. Overrides any label passed at start."
     },
     "ext": {
@@ -160,6 +136,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "deviceLabel": {
           "type": "string",
+          "maxLength": 256,
           "description": "The label persisted with the credential."
         },
         "registeredAt": {
@@ -326,6 +303,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "deviceLabel": {
           "type": "string",
+          "maxLength": 256,
           "description": "The label persisted with the credential."
         },
         "registeredAt": {
@@ -476,6 +454,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -489,5 +468,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;